git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request from GHSA-652x-m2gr-hppm

* Populate session Groups from userinfo response * Fix: gitlab tests Co-authored-by: Wilfried OLLIVIER <wollivier@bearstech.com>

commit0279fa7dff1752f1710707dbd1ffac839de8bbfc authorNick Meves <nick.meves@greenhouse.io> dateThu 25 Mar 2021, 10:20 (6 years ago) parent73d9f38
2 files changed+13−25
compare with master
unifiedsplit
providers/gitlab.go+5−17 providers/gitlab_test.go+8−8
providers/gitlab.go+5−17
@@ -295,21 +295,13 @@ func (p *GitLabProvider) EnrichSession(ctx context.Context, s *sessions.SessionS
295295
296296 s.User = userInfo.Username
297297 s.Email = userInfo.Email
298−
299− p.addGroupsToSession(ctx, s)
298+ for _, group := range userInfo.Groups {
299+ s.Groups = append(s.Groups, fmt.Sprintf("group:%s", group))
300+ }
300301
301302 p.addProjectsToSession(ctx, s)
302303
303304 return nil
304−
305−}
306−
307−// addGroupsToSession projects into session.Groups
308−func (p *GitLabProvider) addGroupsToSession(ctx context.Context, s *sessions.SessionState) {
309− // Iterate over projects, check if oauth2-proxy can get project information on behalf of the user
310− for _, group := range p.Groups {
311− s.Groups = append(s.Groups, fmt.Sprintf("group:%s", group))
312− }
313305}
314306
315307// addProjectsToSession adds projects matching user access requirements into the session state groups list
@@ -341,24 +333,20 @@ func (p *GitLabProvider) addProjectsToSession(ctx context.Context, s *sessions.S
341333 } else {
342334 logger.Errorf("Warning: user %q does not have the minimum required access level for project %q", s.Email, project.Name)
343335 }
344− } else {
345− logger.Errorf("Warning: project %s is archived", project.Name)
336+ continue
346337 }
347338
339+ logger.Errorf("Warning: project %s is archived", project.Name)
348340 }
349−
350341}
351342
352343// PrefixAllowedGroups returns a list of allowed groups, prefixed by their `kind` value
353344func (p *GitLabProvider) PrefixAllowedGroups() (groups []string) {
354−
355345 for _, val := range p.Groups {
356346 groups = append(groups, fmt.Sprintf("group:%s", val))
357347 }
358−
359348 for _, val := range p.Projects {
360349 groups = append(groups, fmt.Sprintf("project:%s", val.Name))
361350 }
362−
363351 return groups
364352}
providers/gitlab_test.go+8−8
@@ -232,11 +232,11 @@ var _ = Describe("Gitlab Provider Tests", func() {
232232 Expect(session.Groups).To(Equal(in.expectedValue))
233233 },
234234 Entry("project membership valid on group project", entitiesTableInput{
235− expectedValue: []string{"project:my_group/my_project"},
235+ expectedValue: []string{"group:foo", "group:bar", "project:my_group/my_project"},
236236 projects: []string{"my_group/my_project"},
237237 }),
238238 Entry("project membership invalid on group project, insufficient access level level", entitiesTableInput{
239− expectedValue: nil,
239+ expectedValue: []string{"group:foo", "group:bar"},
240240 projects: []string{"my_group/my_project=40"},
241241 }),
242242 Entry("project membership invalid on group project, no access at all", entitiesTableInput{
@@ -244,28 +244,28 @@ var _ = Describe("Gitlab Provider Tests", func() {
244244 projects: []string{"no_access_group/no_access_project=30"},
245245 }),
246246 Entry("project membership valid on personnal project", entitiesTableInput{
247− expectedValue: []string{"project:my_profile/my_personal_project"},
247+ expectedValue: []string{"group:foo", "group:bar", "project:my_profile/my_personal_project"},
248248 projects: []string{"my_profile/my_personal_project"},
249249 }),
250250 Entry("project membership invalid on personnal project, insufficient access level", entitiesTableInput{
251− expectedValue: nil,
251+ expectedValue: []string{"group:foo", "group:bar"},
252252 projects: []string{"my_profile/my_personal_project=40"},
253253 }),
254254 Entry("project membership invalid", entitiesTableInput{
255− expectedValue: nil,
255+ expectedValue: []string{"group:foo", "group:bar"},
256256 projects: []string{"my_group/my_bad_project"},
257257 }),
258258 Entry("group membership valid", entitiesTableInput{
259− expectedValue: []string{"group:foo"},
259+ expectedValue: []string{"group:foo", "group:bar"},
260260 groups: []string{"foo"},
261261 }),
262262 Entry("groups and projects", entitiesTableInput{
263− expectedValue: []string{"group:foo", "group:baz", "project:my_group/my_project", "project:my_profile/my_personal_project"},
263+ expectedValue: []string{"group:foo", "group:bar", "project:my_group/my_project", "project:my_profile/my_personal_project"},
264264 groups: []string{"foo", "baz"},
265265 projects: []string{"my_group/my_project", "my_profile/my_personal_project"},
266266 }),
267267 Entry("archived projects", entitiesTableInput{
268− expectedValue: nil,
268+ expectedValue: []string{"group:foo", "group:bar"},
269269 groups: []string{},
270270 projects: []string{"my_group/my_archived_project"},
271271 }),