git.iko.soy/typeable/oauth2-proxy
on master help sign in
typeable/oauth2-proxy/providers/atlassian-cloud.go
99 lines 2.6 kB history raw
1package providers
3import (
4 "context"
5 "errors"
6 "net/url"
8 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
12// AtlassianProvider represents an Atlassian Cloud based Identity Provider
13type AtlassianProvider struct {
14 *ProviderData
17var _ Provider = (*AtlassianProvider)(nil)
19const (
20 atlassianProviderName = "Atlassian"
21 atlassianDefaultScope = "read:me"
22 atlassianPrompt = "consent"
23 atlassianAudience = "api.atlassian.com"
26var (
27 atlassianDefaultLoginURL = &url.URL{
28 Scheme: "https",
29 Host: "auth.atlassian.com",
30 Path: "/authorize",
31 }
33 atlassianDefaultRedeemURL = &url.URL{
34 Scheme: "https",
35 Host: "auth.atlassian.com",
36 Path: "/oauth/token",
37 }
39 // atlassianDefaultProfileURL returns the signed-in user's profile.
40 atlassianDefaultProfileURL = &url.URL{
41 Scheme: "https",
42 Host: "api.atlassian.com",
43 Path: "/me",
44 }
47// NewAtlassianProvider initiates a new AtlassianProvider
48func NewAtlassianProvider(p *ProviderData) *AtlassianProvider {
49 p.setProviderDefaults(providerDefaults{
50 name: atlassianProviderName,
51 loginURL: atlassianDefaultLoginURL,
52 redeemURL: atlassianDefaultRedeemURL,
53 profileURL: atlassianDefaultProfileURL,
54 validateURL: atlassianDefaultProfileURL,
55 scope: atlassianDefaultScope,
56 })
57 return &AtlassianProvider{ProviderData: p}
60// GetLoginURL adds the audience and prompt parameters Atlassian requires.
61func (p *AtlassianProvider) GetLoginURL(redirectURI, state, _ string, extraParams url.Values) string {
62 params := url.Values{}
63 for k, v := range extraParams {
64 params[k] = v
65 }
66 params.Del("approval_prompt")
67 if params.Get("prompt") == "" {
68 params.Set("prompt", atlassianPrompt)
69 }
70 params.Set("audience", atlassianAudience)
72 loginURL := makeLoginURL(p.ProviderData, redirectURI, state, params)
73 return loginURL.String()
76// EnrichSession sets the session's email from the Atlassian profile.
77func (p *AtlassianProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
78 var profile struct {
79 Email string `json:"email"`
80 }
81 err := requests.New(p.ProfileURL.String()).
82 WithContext(ctx).
83 WithHeaders(makeOIDCHeader(s.AccessToken)).
84 Do().
85 UnmarshalInto(&profile)
86 if err != nil {
87 return err
88 }
89 if profile.Email == "" {
90 return errors.New("no email in Atlassian profile")
91 }
92 s.Email = profile.Email
93 return nil
96// ValidateSession validates the AccessToken
97func (p *AtlassianProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
98 return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))