git.iko.soy/typeable/oauth2-proxy
on v3.2.0 help sign in
typeable/oauth2-proxy/providers/azure.go
129 lines 2.7 kB history raw
1package providers
3import (
4 "errors"
5 "fmt"
6 "log"
7 "net/http"
8 "net/url"
10 "github.com/bitly/go-simplejson"
11 "github.com/pusher/oauth2_proxy/api"
14// AzureProvider represents an Azure based Identity Provider
15type AzureProvider struct {
16 *ProviderData
17 Tenant string
20// NewAzureProvider initiates a new AzureProvider
21func NewAzureProvider(p *ProviderData) *AzureProvider {
22 p.ProviderName = "Azure"
24 if p.ProfileURL == nil || p.ProfileURL.String() == "" {
25 p.ProfileURL = &url.URL{
26 Scheme: "https",
27 Host: "graph.windows.net",
28 Path: "/me",
29 RawQuery: "api-version=1.6",
30 }
31 }
32 if p.ProtectedResource == nil || p.ProtectedResource.String() == "" {
33 p.ProtectedResource = &url.URL{
34 Scheme: "https",
35 Host: "graph.windows.net",
36 }
37 }
38 if p.Scope == "" {
39 p.Scope = "openid"
40 }
42 return &AzureProvider{ProviderData: p}
45// Configure defaults the AzureProvider configuration options
46func (p *AzureProvider) Configure(tenant string) {
47 p.Tenant = tenant
48 if tenant == "" {
49 p.Tenant = "common"
50 }
52 if p.LoginURL == nil || p.LoginURL.String() == "" {
53 p.LoginURL = &url.URL{
54 Scheme: "https",
55 Host: "login.microsoftonline.com",
56 Path: "/" + p.Tenant + "/oauth2/authorize"}
57 }
58 if p.RedeemURL == nil || p.RedeemURL.String() == "" {
59 p.RedeemURL = &url.URL{
60 Scheme: "https",
61 Host: "login.microsoftonline.com",
62 Path: "/" + p.Tenant + "/oauth2/token",
63 }
64 }
67func getAzureHeader(accessToken string) http.Header {
68 header := make(http.Header)
69 header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))
70 return header
73func getEmailFromJSON(json *simplejson.Json) (string, error) {
74 var email string
75 var err error
77 email, err = json.Get("mail").String()
79 if err != nil || email == "" {
80 otherMails, otherMailsErr := json.Get("otherMails").Array()
81 if len(otherMails) > 0 {
82 email = otherMails[0].(string)
83 }
84 err = otherMailsErr
85 }
87 return email, err
90// GetEmailAddress returns the Account email address
91func (p *AzureProvider) GetEmailAddress(s *SessionState) (string, error) {
92 var email string
93 var err error
95 if s.AccessToken == "" {
96 return "", errors.New("missing access token")
97 }
98 req, err := http.NewRequest("GET", p.ProfileURL.String(), nil)
99 if err != nil {
100 return "", err
101 }
102 req.Header = getAzureHeader(s.AccessToken)
104 json, err := api.Request(req)
106 if err != nil {
107 return "", err
108 }
110 email, err = getEmailFromJSON(json)
112 if err == nil && email != "" {
113 return email, err
114 }
116 email, err = json.Get("userPrincipalName").String()
118 if err != nil {
119 log.Printf("failed making request %s", err)
120 return "", err
121 }
123 if email == "" {
124 log.Printf("failed to get email address")
125 return "", err
126 }
128 return email, err