git.iko.soy/typeable/oauth2-proxy
on master help sign in
Create option to skip verified email check in OIDC provider
commit018a25be04dfcab9fae3ee12ea6710bc52d578ad authorDaryl Finlay <djfinlay@users.noreply.github.com> dateMon 20 May 2019, 12:32 (7 years ago) parentecd0f89
4 files changed+41−35
compare with master
unifiedsplit
docs/configuration/configuration.md+1 main.go+1 options.go+36−33 providers/oidc.go+3−2
docs/configuration/configuration.md+1
@@ -63,6 +63,7 @@ Usage of oauth2_proxy:
6363 -jwt-key string: private key in PEM format used to sign JWT, so that you can say something like -jwt-key="${OAUTH2_PROXY_JWT_KEY}": required by login.gov
6464 -jwt-key-file string: path to the private key file in PEM format used to sign the JWT so that you can say something like -jwt-key-file=/etc/ssl/private/jwt_signing_key.pem: required by login.gov
6565 -login-url string: Authentication endpoint
66+ -oidc-allow-unverified-email: don't fail if an email address in an id_token is not verified
6667 -oidc-issuer-url: the OpenID Connect issuer URL. ie: "https://accounts.google.com"
6768 -oidc-jwks-url string: OIDC JWKS URI for token verification; required if OIDC discovery is disabled
6869 -pass-access-token: pass OAuth access_token to upstream via X-Forwarded-Access-Token header
main.go+1
@@ -104,6 +104,7 @@ func main() {
104104
105105 flagSet.String("provider", "google", "OAuth provider")
106106 flagSet.String("oidc-issuer-url", "", "OpenID Connect issuer URL (ie: https://accounts.google.com)")
107+ flagSet.Bool("oidc-allow-unverified-email", false, "Don't fail if an email address in an id_token is not verified")
107108 flagSet.Bool("skip-oidc-discovery", false, "Skip OIDC discovery and use manually supplied Endpoints")
108109 flagSet.String("oidc-jwks-url", "", "OpenID Connect JWKS URL (ie: https://www.googleapis.com/oauth2/v3/certs)")
109110 flagSet.String("login-url", "", "Authentication endpoint")
options.go+36−33
@@ -79,17 +79,18 @@ type Options struct {
7979
8080 // These options allow for other providers besides Google, with
8181 // potential overrides.
82− Provider string `flag:"provider" cfg:"provider" env:"OAUTH2_PROXY_PROVIDER"`
83− OIDCIssuerURL string `flag:"oidc-issuer-url" cfg:"oidc_issuer_url" env:"OAUTH2_PROXY_OIDC_ISSUER_URL"`
84− SkipOIDCDiscovery bool `flag:"skip-oidc-discovery" cfg:"skip_oidc_discovery" env:"OAUTH2_SKIP_OIDC_DISCOVERY"`
85− OIDCJwksURL string `flag:"oidc-jwks-url" cfg:"oidc_jwks_url" env:"OAUTH2_OIDC_JWKS_URL"`
86− LoginURL string `flag:"login-url" cfg:"login_url" env:"OAUTH2_PROXY_LOGIN_URL"`
87− RedeemURL string `flag:"redeem-url" cfg:"redeem_url" env:"OAUTH2_PROXY_REDEEM_URL"`
88− ProfileURL string `flag:"profile-url" cfg:"profile_url" env:"OAUTH2_PROXY_PROFILE_URL"`
89− ProtectedResource string `flag:"resource" cfg:"resource" env:"OAUTH2_PROXY_RESOURCE"`
90− ValidateURL string `flag:"validate-url" cfg:"validate_url" env:"OAUTH2_PROXY_VALIDATE_URL"`
91− Scope string `flag:"scope" cfg:"scope" env:"OAUTH2_PROXY_SCOPE"`
92− ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt" env:"OAUTH2_PROXY_APPROVAL_PROMPT"`
82+ Provider string `flag:"provider" cfg:"provider" env:"OAUTH2_PROXY_PROVIDER"`
83+ OIDCIssuerURL string `flag:"oidc-issuer-url" cfg:"oidc_issuer_url" env:"OAUTH2_PROXY_OIDC_ISSUER_URL"`
84+ OIDCAllowUnverifiedEmail bool `flag:"oidc-allow-unverified-email" cfg:"oidc_allow_unverified_email" env:"OAUTH2_PROXY_OIDC_ALLOW_UNVERIFIED_EMAIL"`
85+ SkipOIDCDiscovery bool `flag:"skip-oidc-discovery" cfg:"skip_oidc_discovery" env:"OAUTH2_SKIP_OIDC_DISCOVERY"`
86+ OIDCJwksURL string `flag:"oidc-jwks-url" cfg:"oidc_jwks_url" env:"OAUTH2_OIDC_JWKS_URL"`
87+ LoginURL string `flag:"login-url" cfg:"login_url" env:"OAUTH2_PROXY_LOGIN_URL"`
88+ RedeemURL string `flag:"redeem-url" cfg:"redeem_url" env:"OAUTH2_PROXY_REDEEM_URL"`
89+ ProfileURL string `flag:"profile-url" cfg:"profile_url" env:"OAUTH2_PROXY_PROFILE_URL"`
90+ ProtectedResource string `flag:"resource" cfg:"resource" env:"OAUTH2_PROXY_RESOURCE"`
91+ ValidateURL string `flag:"validate-url" cfg:"validate_url" env:"OAUTH2_PROXY_VALIDATE_URL"`
92+ Scope string `flag:"scope" cfg:"scope" env:"OAUTH2_PROXY_SCOPE"`
93+ ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt" env:"OAUTH2_PROXY_APPROVAL_PROMPT"`
9394
9495 // Configuration values for logging
9596 LoggingFilename string `flag:"logging-filename" cfg:"logging_filename" env:"OAUTH2_LOGGING_FILENAME"`
@@ -147,28 +148,29 @@ func NewOptions() *Options {
147148 SessionOptions: options.SessionOptions{
148149 Type: "cookie",
149150 },
150− SetXAuthRequest: false,
151− SkipAuthPreflight: false,
152− PassBasicAuth: true,
153− PassUserHeaders: true,
154− PassAccessToken: false,
155− PassHostHeader: true,
156− SetAuthorization: false,
157− PassAuthorization: false,
158− ApprovalPrompt: "force",
159− SkipOIDCDiscovery: false,
160− LoggingFilename: "",
161− LoggingMaxSize: 100,
162− LoggingMaxAge: 7,
163− LoggingMaxBackups: 0,
164− LoggingLocalTime: true,
165− LoggingCompress: false,
166− StandardLogging: true,
167− StandardLoggingFormat: logger.DefaultStandardLoggingFormat,
168− RequestLogging: true,
169− RequestLoggingFormat: logger.DefaultRequestLoggingFormat,
170− AuthLogging: true,
171− AuthLoggingFormat: logger.DefaultAuthLoggingFormat,
151+ SetXAuthRequest: false,
152+ SkipAuthPreflight: false,
153+ PassBasicAuth: true,
154+ PassUserHeaders: true,
155+ PassAccessToken: false,
156+ PassHostHeader: true,
157+ SetAuthorization: false,
158+ PassAuthorization: false,
159+ ApprovalPrompt: "force",
160+ OIDCAllowUnverifiedEmail: false,
161+ SkipOIDCDiscovery: false,
162+ LoggingFilename: "",
163+ LoggingMaxSize: 100,
164+ LoggingMaxAge: 7,
165+ LoggingMaxBackups: 0,
166+ LoggingLocalTime: true,
167+ LoggingCompress: false,
168+ StandardLogging: true,
169+ StandardLoggingFormat: logger.DefaultStandardLoggingFormat,
170+ RequestLogging: true,
171+ RequestLoggingFormat: logger.DefaultRequestLoggingFormat,
172+ AuthLogging: true,
173+ AuthLoggingFormat: logger.DefaultAuthLoggingFormat,
172174 }
173175}
174176
@@ -397,6 +399,7 @@ func parseProviderInfo(o *Options, msgs []string) []string {
397399 }
398400 }
399401 case *providers.OIDCProvider:
402+ p.AllowUnverifiedEmail = o.OIDCAllowUnverifiedEmail
400403 if o.oidcVerifier == nil {
401404 msgs = append(msgs, "oidc provider requires an oidc issuer URL")
402405 } else {
providers/oidc.go+3−2
@@ -14,7 +14,8 @@ import (
1414type OIDCProvider struct {
1515 *ProviderData
1616
17− Verifier *oidc.IDTokenVerifier
17+ Verifier *oidc.IDTokenVerifier
18+ AllowUnverifiedEmail bool
1819}
1920
2021// NewOIDCProvider initiates a new OIDCProvider
@@ -119,7 +120,7 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok
119120 // TODO: Try getting email from /userinfo before falling back to Subject
120121 claims.Email = claims.Subject
121122 }
122− if claims.Verified != nil && !*claims.Verified {
123+ if !p.AllowUnverifiedEmail && claims.Verified != nil && !*claims.Verified {
123124 return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)
124125 }
125126