0791aef · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Integrate new provider constructor in main

commit0791aef8cc5604990d3464dc7c533c32e8680069 authorJoel Speed <joel.speed@hotmail.co.uk> dateTue 15 Feb 2022, 12:00 (5 years ago) parent2e15f57

2 files changed+29−17

compare with master

unifiedsplit

oauthproxy.go+13−8 oauthproxy_test.go+16−9

oauthproxy.go+13−8

@@ -114,6 +114,11 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr

114114 }

115115 }

116116

117+ provider, err := providers.NewProvider(opts.Providers[0])

118+ if err != nil {

119+ return nil, fmt.Errorf("error intiailising provider: %v", err)

120+ }

121+

117122 pageWriter, err := pagewriter.NewWriter(pagewriter.Opts{

118123 TemplatesPath: opts.Templates.Path,

119124 CustomLogo: opts.Templates.CustomLogo,

@@ -121,7 +126,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr

121126 Footer: opts.Templates.Footer,

122127 Version: VERSION,

123128 Debug: opts.Templates.Debug,

124− ProviderName: buildProviderName(opts.GetProvider(), opts.Providers[0].Name),

129+ ProviderName: buildProviderName(provider, opts.Providers[0].Name),

125130 SignInMessage: buildSignInMessage(opts),

126131 DisplayLoginForm: basicAuthValidator != nil && opts.Templates.DisplayLoginForm,

127132 })

@@ -145,7 +150,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr

145150 redirectURL.Path = fmt.Sprintf("%s/callback", opts.ProxyPrefix)

146151 }

147152

148− logger.Printf("OAuthProxy configured for %s Client ID: %s", opts.GetProvider().Data().ProviderName, opts.Providers[0].ClientID)

153+ logger.Printf("OAuthProxy configured for %s Client ID: %s", provider.Data().ProviderName, opts.Providers[0].ClientID)

149154 refresh := "disabled"

150155 if opts.Cookie.Refresh != time.Duration(0) {

151156 refresh = fmt.Sprintf("after %s", opts.Cookie.Refresh)

@@ -171,7 +176,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr

171176 if err != nil {

172177 return nil, fmt.Errorf("could not build pre-auth chain: %v", err)

173178 }

174− sessionChain := buildSessionChain(opts, sessionStore, basicAuthValidator)

179+ sessionChain := buildSessionChain(opts, provider, sessionStore, basicAuthValidator)

175180 headersChain, err := buildHeadersChain(opts)

176181 if err != nil {

177182 return nil, fmt.Errorf("could not build headers chain: %v", err)

@@ -190,7 +195,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr

190195 SignInPath: fmt.Sprintf("%s/sign_in", opts.ProxyPrefix),

191196

192197 ProxyPrefix: opts.ProxyPrefix,

193− provider: opts.GetProvider(),

198+ provider: provider,

194199 sessionStore: sessionStore,

195200 redirectURL: redirectURL,

196201 allowedRoutes: allowedRoutes,

@@ -346,12 +351,12 @@ func buildPreAuthChain(opts *options.Options) (alice.Chain, error) {

346351 return chain, nil

347352}

348353

349−func buildSessionChain(opts *options.Options, sessionStore sessionsapi.SessionStore, validator basic.Validator) alice.Chain {

354+func buildSessionChain(opts *options.Options, provider providers.Provider, sessionStore sessionsapi.SessionStore, validator basic.Validator) alice.Chain {

350355 chain := alice.New()

351356

352357 if opts.SkipJwtBearerTokens {

353358 sessionLoaders := []middlewareapi.TokenToSessionFunc{

354− opts.GetProvider().CreateSessionFromToken,

359+ provider.CreateSessionFromToken,

355360 }

356361

357362 for _, verifier := range opts.GetJWTBearerVerifiers() {

@@ -369,8 +374,8 @@ func buildSessionChain(opts *options.Options, sessionStore sessionsapi.SessionSt

369374 chain = chain.Append(middleware.NewStoredSessionLoader(&middleware.StoredSessionLoaderOptions{

370375 SessionStore: sessionStore,

371376 RefreshPeriod: opts.Cookie.Refresh,

372− RefreshSession: opts.GetProvider().RefreshSession,

373− ValidateSession: opts.GetProvider().ValidateSession,

377+ RefreshSession: provider.RefreshSession,

378+ ValidateSession: provider.ValidateSession,

374379 }))

375380

376381 return chain

oauthproxy_test.go+16−9

@@ -161,13 +161,11 @@ func Test_enrichSession(t *testing.T) {

161161 err := validation.Validate(opts)

162162 assert.NoError(t, err)

163163

164− // intentionally set after validation.Validate(opts) since it will clobber

165− // our TestProvider and call `providers.New` defaulting to `providers.GoogleProvider`

166− opts.SetProvider(NewTestProvider(&url.URL{Host: "www.example.com"}, providerEmail))

167164 proxy, err := NewOAuthProxy(opts, func(string) bool { return true })

168165 if err != nil {

169166 t.Fatal(err)

170167 }

168+ proxy.provider = NewTestProvider(&url.URL{Host: "www.example.com"}, providerEmail)

171169

172170 err = proxy.enrichSessionState(context.Background(), tc.session)

173171 assert.NoError(t, err)

@@ -232,13 +230,13 @@ func TestBasicAuthPassword(t *testing.T) {

232230 providerURL, _ := url.Parse(providerServer.URL)

233231 const emailAddress = "john.doe@example.com"

234232

235− opts.SetProvider(NewTestProvider(providerURL, emailAddress))

236233 proxy, err := NewOAuthProxy(opts, func(email string) bool {

237234 return email == emailAddress

238235 })

239236 if err != nil {

240237 t.Fatal(err)

241238 }

239+ proxy.provider = NewTestProvider(providerURL, emailAddress)

242240

243241 // Save the required session

244242 rw := httptest.NewRecorder()

@@ -390,10 +388,10 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) (*PassAccessTokenTe

390388

391389 testProvider := NewTestProvider(providerURL, emailAddress)

392390 testProvider.ValidToken = opts.ValidToken

393− patt.opts.SetProvider(testProvider)

394391 patt.proxy, err = NewOAuthProxy(patt.opts, func(email string) bool {

395392 return email == emailAddress

396393 })

394+ patt.proxy.provider = testProvider

397395 if err != nil {

398396 return nil, err

399397 }

@@ -769,11 +767,17 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts, modifiers ...OptionsModifi

769767 if err != nil {

770768 return nil, err

771769 }

772− pcTest.proxy.provider = &TestProvider{

770+ testProvider := &TestProvider{

773771 ProviderData: &providers.ProviderData{},

774772 ValidToken: opts.providerValidateCookieResponse,

775773 }

776− pcTest.proxy.provider.(*TestProvider).SetAllowedGroups(pcTest.opts.Providers[0].AllowedGroups)

774+

775+ groups := pcTest.opts.Providers[0].AllowedGroups

776+ testProvider.AllowedGroups = make(map[string]struct{}, len(groups))

777+ for _, group := range groups {

778+ testProvider.AllowedGroups[group] = struct{}{}

779+ }

780+ pcTest.proxy.provider = testProvider

777781

778782 // Now, zero-out proxy.CookieRefresh for the cases that don't involve

779783 // access_token validation.

@@ -1359,12 +1363,12 @@ func TestAuthSkippedForPreflightRequests(t *testing.T) {

13591363 assert.NoError(t, err)

13601364

13611365 upstreamURL, _ := url.Parse(upstreamServer.URL)

1362− opts.SetProvider(NewTestProvider(upstreamURL, ""))

13631366

13641367 proxy, err := NewOAuthProxy(opts, func(string) bool { return false })

13651368 if err != nil {

13661369 t.Fatal(err)

13671370 }

1371+ proxy.provider = NewTestProvider(upstreamURL, "")

13681372 rw := httptest.NewRecorder()

13691373 req, _ := http.NewRequest("OPTIONS", "/preflight-request", nil)

13701374 proxy.ServeHTTP(rw, req)

@@ -1409,6 +1413,7 @@ type SignatureTest struct {

14091413 header http.Header

14101414 rw *httptest.ResponseRecorder

14111415 authenticator *SignatureAuthenticator

1416+ authProvider providers.Provider

14121417}

14131418

14141419func NewSignatureTest() (*SignatureTest, error) {

@@ -1443,7 +1448,7 @@ func NewSignatureTest() (*SignatureTest, error) {

14431448 if err != nil {

14441449 return nil, err

14451450 }

1446− opts.SetProvider(NewTestProvider(providerURL, "mbland@acm.org"))

1451+ testProvider := NewTestProvider(providerURL, "mbland@acm.org")

14471452

14481453 return &SignatureTest{

14491454 opts,

@@ -1453,6 +1458,7 @@ func NewSignatureTest() (*SignatureTest, error) {

14531458 make(http.Header),

14541459 httptest.NewRecorder(),

14551460 authenticator,

1461+ testProvider,

14561462 }, nil

14571463}

14581464

@@ -1486,6 +1492,7 @@ func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) er

14861492 if err != nil {

14871493 return err

14881494 }

1495+ proxy.provider = st.authProvider

14891496

14901497 var bodyBuf io.ReadCloser

14911498 if body != "" {