git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request from GHSA-652x-m2gr-hppm
0279fa7Nick Meves
providers/gitlab.go+5−17
compare with master
unifiedsplit
@@ -295,21 +295,13 @@ func (p *GitLabProvider) EnrichSession(ctx context.Context, s *sessions.SessionS
295
295
296 s.User = userInfo.Username
296 s.User = userInfo.Username
297 s.Email = userInfo.Email
297 s.Email = userInfo.Email
298−
298+ for _, group := range userInfo.Groups {
299− p.addGroupsToSession(ctx, s)
299+ s.Groups = append(s.Groups, fmt.Sprintf("group:%s", group))
300+ }
300
301
301 p.addProjectsToSession(ctx, s)
302 p.addProjectsToSession(ctx, s)
302
303
303 return nil
304 return nil
304−
305−}
306−
307−// addGroupsToSession projects into session.Groups
308−func (p *GitLabProvider) addGroupsToSession(ctx context.Context, s *sessions.SessionState) {
309− // Iterate over projects, check if oauth2-proxy can get project information on behalf of the user
310− for _, group := range p.Groups {
311− s.Groups = append(s.Groups, fmt.Sprintf("group:%s", group))
312− }
313}
305}
314
306
315// addProjectsToSession adds projects matching user access requirements into the session state groups list
307// addProjectsToSession adds projects matching user access requirements into the session state groups list
@@ -341,24 +333,20 @@ func (p *GitLabProvider) addProjectsToSession(ctx context.Context, s *sessions.S
341 } else {
333 } else {
342 logger.Errorf("Warning: user %q does not have the minimum required access level for project %q", s.Email, project.Name)
334 logger.Errorf("Warning: user %q does not have the minimum required access level for project %q", s.Email, project.Name)
343 }
335 }
344− } else {
336+ continue
345− logger.Errorf("Warning: project %s is archived", project.Name)
346 }
337 }
347
338
339+ logger.Errorf("Warning: project %s is archived", project.Name)
348 }
340 }
349−
350}
341}
351
342
352// PrefixAllowedGroups returns a list of allowed groups, prefixed by their `kind` value
343// PrefixAllowedGroups returns a list of allowed groups, prefixed by their `kind` value
353func (p *GitLabProvider) PrefixAllowedGroups() (groups []string) {
344func (p *GitLabProvider) PrefixAllowedGroups() (groups []string) {
354−
355 for _, val := range p.Groups {
345 for _, val := range p.Groups {
356 groups = append(groups, fmt.Sprintf("group:%s", val))
346 groups = append(groups, fmt.Sprintf("group:%s", val))
357 }
347 }
358−
359 for _, val := range p.Projects {
348 for _, val := range p.Projects {
360 groups = append(groups, fmt.Sprintf("project:%s", val.Name))
349 groups = append(groups, fmt.Sprintf("project:%s", val.Name))
361 }
350 }
362−
363 return groups
351 return groups
364}
352}
providers/gitlab_test.go+8−8
@@ -232,11 +232,11 @@ var _ = Describe("Gitlab Provider Tests", func() {
232 Expect(session.Groups).To(Equal(in.expectedValue))
232 Expect(session.Groups).To(Equal(in.expectedValue))
233 },
233 },
234 Entry("project membership valid on group project", entitiesTableInput{
234 Entry("project membership valid on group project", entitiesTableInput{
235− expectedValue: []string{"project:my_group/my_project"},
235+ expectedValue: []string{"group:foo", "group:bar", "project:my_group/my_project"},
236 projects: []string{"my_group/my_project"},
236 projects: []string{"my_group/my_project"},
237 }),
237 }),
238 Entry("project membership invalid on group project, insufficient access level level", entitiesTableInput{
238 Entry("project membership invalid on group project, insufficient access level level", entitiesTableInput{
239− expectedValue: nil,
239+ expectedValue: []string{"group:foo", "group:bar"},
240 projects: []string{"my_group/my_project=40"},
240 projects: []string{"my_group/my_project=40"},
241 }),
241 }),
242 Entry("project membership invalid on group project, no access at all", entitiesTableInput{
242 Entry("project membership invalid on group project, no access at all", entitiesTableInput{
@@ -244,28 +244,28 @@ var _ = Describe("Gitlab Provider Tests", func() {
244 projects: []string{"no_access_group/no_access_project=30"},
244 projects: []string{"no_access_group/no_access_project=30"},
245 }),
245 }),
246 Entry("project membership valid on personnal project", entitiesTableInput{
246 Entry("project membership valid on personnal project", entitiesTableInput{
247− expectedValue: []string{"project:my_profile/my_personal_project"},
247+ expectedValue: []string{"group:foo", "group:bar", "project:my_profile/my_personal_project"},
248 projects: []string{"my_profile/my_personal_project"},
248 projects: []string{"my_profile/my_personal_project"},
249 }),
249 }),
250 Entry("project membership invalid on personnal project, insufficient access level", entitiesTableInput{
250 Entry("project membership invalid on personnal project, insufficient access level", entitiesTableInput{
251− expectedValue: nil,
251+ expectedValue: []string{"group:foo", "group:bar"},
252 projects: []string{"my_profile/my_personal_project=40"},
252 projects: []string{"my_profile/my_personal_project=40"},
253 }),
253 }),
254 Entry("project membership invalid", entitiesTableInput{
254 Entry("project membership invalid", entitiesTableInput{
255− expectedValue: nil,
255+ expectedValue: []string{"group:foo", "group:bar"},
256 projects: []string{"my_group/my_bad_project"},
256 projects: []string{"my_group/my_bad_project"},
257 }),
257 }),
258 Entry("group membership valid", entitiesTableInput{
258 Entry("group membership valid", entitiesTableInput{
259− expectedValue: []string{"group:foo"},
259+ expectedValue: []string{"group:foo", "group:bar"},
260 groups: []string{"foo"},
260 groups: []string{"foo"},
261 }),
261 }),
262 Entry("groups and projects", entitiesTableInput{
262 Entry("groups and projects", entitiesTableInput{
263− expectedValue: []string{"group:foo", "group:baz", "project:my_group/my_project", "project:my_profile/my_personal_project"},
263+ expectedValue: []string{"group:foo", "group:bar", "project:my_group/my_project", "project:my_profile/my_personal_project"},
264 groups: []string{"foo", "baz"},
264 groups: []string{"foo", "baz"},
265 projects: []string{"my_group/my_project", "my_profile/my_personal_project"},
265 projects: []string{"my_group/my_project", "my_profile/my_personal_project"},
266 }),
266 }),
267 Entry("archived projects", entitiesTableInput{
267 Entry("archived projects", entitiesTableInput{
268− expectedValue: nil,
268+ expectedValue: []string{"group:foo", "group:bar"},
269 groups: []string{},
269 groups: []string{},
270 projects: []string{"my_group/my_archived_project"},
270 projects: []string{"my_group/my_archived_project"},
271 }),
271 }),