0af18d6 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge pull request #141 from openai/googleGroupEmail

Check google group membership based on email address

commit0af18d6d7cd44f03ebd447f3331e33bf3092d580 authorJoel Speed <Joel.speed@hotmail.co.uk> dateSat 15 Jun 2019, 14:05 (7 years ago) parent77e1fff 7179c57

3 files changed+50−6

compare with master

unifiedsplit

CHANGELOG.md+3 providers/google.go+10−6 providers/google_test.go+37

CHANGELOG.md+3

@@ -57,6 +57,9 @@

5757- [#170](https://github.com/pusher/oauth2_proxy/pull/170) Restore binary tarball contents to be compatible with bitlys original tarballs (@zeha)

5858- [#185](https://github.com/pusher/oauth2_proxy/pull/185) Fix an unsupported protocol scheme error during token validation when using the Azure provider (@jonas)

5959

60+- [#141](https://github.com/pusher/oauth2_proxy/pull/141) Check google group membership based on email address (@bchess)

61+ - Google Group membership is additionally checked via email address, allowing users outside a GSuite domain to be authorized.

62+

6063# v3.2.0

6164

6265## Release highlights

providers/google.go+10−6

@@ -191,11 +191,9 @@ func getAdminService(adminEmail string, credentialsReader io.Reader) *admin.Serv

191191func userInGroup(service *admin.Service, groups []string, email string) bool {

192192 user, err := fetchUser(service, email)

193193 if err != nil {

194− logger.Printf("error fetching user: %v", err)

195− return false

194+ logger.Printf("Warning: unable to fetch user: %v", err)

195+ user = nil

196196 }

197− id := user.Id

198− custID := user.CustomerId

199197

200198 for _, group := range groups {

201199 members, err := fetchGroupMembers(service, group)

@@ -209,13 +207,19 @@ func userInGroup(service *admin.Service, groups []string, email string) bool {

209207 }

210208

211209 for _, member := range members {

210+ if member.Email == email {

211+ return true

212+ }

213+ if user == nil {

214+ continue

215+ }

212216 switch member.Type {

213217 case "CUSTOMER":

214− if member.Id == custID {

218+ if member.Id == user.CustomerId {

215219 return true

216220 }

217221 case "USER":

218− if member.Id == id {

222+ if member.Id == user.Id {

219223 return true

220224 }

221225 }

providers/google_test.go+37

@@ -3,12 +3,15 @@ package providers

33import (

44 "encoding/base64"

55 "encoding/json"

6+ "fmt"

67 "net/http"

78 "net/http/httptest"

89 "net/url"

910 "testing"

1011

1112 "github.com/stretchr/testify/assert"

13+

14+ admin "google.golang.org/api/admin/directory/v1"

1215)

1316

1417func newRedeemServer(body []byte) (*url.URL, *httptest.Server) {

@@ -179,3 +182,37 @@ func TestGoogleProviderGetEmailAddressEmailMissing(t *testing.T) {

179182 }

180183

181184}

185+

186+func TestGoogleProviderUserInGroup(t *testing.T) {

187+ ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

188+ if r.URL.Path == "/users/member-by-email@example.com" {

189+ fmt.Fprintln(w, "{}")

190+ } else if r.URL.Path == "/users/non-member-by-email@example.com" {

191+ fmt.Fprintln(w, "{}")

192+ } else if r.URL.Path == "/users/member-by-id@example.com" {

193+ fmt.Fprintln(w, "{\"id\": \"member-id\"}")

194+ } else if r.URL.Path == "/users/non-member-by-id@example.com" {

195+ fmt.Fprintln(w, "{\"id\": \"non-member-id\"}")

196+ } else if r.URL.Path == "/groups/group@example.com/members" {

197+ fmt.Fprintln(w, "{\"members\": [{\"email\": \"member-by-email@example.com\"}, {\"id\": \"member-id\", \"type\": \"USER\"}]}")

198+ }

199+ }))

200+ defer ts.Close()

201+

202+ client := ts.Client()

203+ service, err := admin.New(client)

204+ service.BasePath = ts.URL

205+ assert.Equal(t, nil, err)

206+

207+ result := userInGroup(service, []string{"group@example.com"}, "member-by-email@example.com")

208+ assert.True(t, result)

209+

210+ result = userInGroup(service, []string{"group@example.com"}, "member-by-id@example.com")

211+ assert.True(t, result)

212+

213+ result = userInGroup(service, []string{"group@example.com"}, "non-member-by-id@example.com")

214+ assert.False(t, result)

215+

216+ result = userInGroup(service, []string{"group@example.com"}, "non-member-by-email@example.com")

217+ assert.False(t, result)

218+}