git.iko.soy/typeable/oauth2-proxy
on master help sign in
Use `nickname` claim as User for GitLab

Previously this was only done in the `EnrichSession` stage which would've missed Bearer usages & `RefreshSession` would've overriden the User to the Subject.

commit11c2177f186e337b557c11d4c13c053c205aee95 authorNick Meves <nick.meves@greenhouse.io> dateSat 19 Jun 2021, 14:22 (5 years ago) parentc84a5a4
4 files changed+52−4
compare with master
unifiedsplit
CHANGELOG.md+4 providers/gitlab.go+13−4 providers/provider_data.go+12 providers/provider_data_test.go+23
CHANGELOG.md+4
@@ -13,9 +13,13 @@
1313
1414## Breaking Changes
1515
16+- [#1239](https://github.com/oauth2-proxy/oauth2-proxy/pull/1239) GitLab groups sent in the `X-Forwarded-Groups` header
17+ to the upstream server will no longer be prefixed with `group:`
18+
1619## Changes since v7.1.3
1720
1821- [#1337](https://github.com/oauth2-proxy/oauth2-proxy/pull/1337) Changing user field type to text when using htpasswd (@pburgisser)
22+- [#1239](https://github.com/oauth2-proxy/oauth2-proxy/pull/1239) Base GitLab provider implementation on OIDCProvider (@NickMeves)
1923- [#1276](https://github.com/oauth2-proxy/oauth2-proxy/pull/1276) Update crypto and switched to new github.com/golang-jwt/jwt (@JVecsei)
2024- [#1264](https://github.com/oauth2-proxy/oauth2-proxy/pull/1264) Update go-oidc to v3 (@NickMeves)
2125- [#1233](https://github.com/oauth2-proxy/oauth2-proxy/pull/1233) Extend email-domain validation with sub-domain capability (@morarucostel)
providers/gitlab.go+13−4
@@ -15,6 +15,7 @@ import (
1515const (
1616 gitlabProviderName = "GitLab"
1717 gitlabDefaultScope = "openid email"
18+ gitlabUserClaim = "nickname"
1819)
1920
2021// GitLabProvider represents a GitLab based Identity Provider
@@ -29,6 +30,7 @@ var _ Provider = (*GitLabProvider)(nil)
2930// NewGitLabProvider initiates a new GitLabProvider
3031func NewGitLabProvider(p *ProviderData) *GitLabProvider {
3132 p.ProviderName = gitlabProviderName
33+ p.UserClaim = gitlabUserClaim
3234 if p.Scope == "" {
3335 p.Scope = gitlabDefaultScope
3436 }
@@ -119,17 +121,24 @@ func (p *GitLabProvider) EnrichSession(ctx context.Context, s *sessions.SessionS
119121 return fmt.Errorf("user email is not verified")
120122 }
121123
122− s.User = userinfo.Username
123− s.Email = userinfo.Email
124− s.Groups = append(s.Groups, userinfo.Groups...)
124+ if userinfo.Nickname != "" {
125+ s.User = userinfo.Nickname
126+ }
127+ if userinfo.Email != "" {
128+ s.Email = userinfo.Email
129+ }
130+ if len(userinfo.Groups) > 0 {
131+ s.Groups = userinfo.Groups
132+ }
125133
134+ // Add projects as `project:blah` to s.Groups
126135 p.addProjectsToSession(ctx, s)
127136
128137 return nil
129138}
130139
131140type gitlabUserinfo struct {
132− Username string `json:"nickname"`
141+ Nickname string `json:"nickname"`
133142 Email string `json:"email"`
134143 EmailVerified bool `json:"email_verified"`
135144 Groups []string `json:"groups"`
providers/provider_data.go+12
@@ -41,6 +41,7 @@ type ProviderData struct {
4141
4242 // Common OIDC options for any OIDC-based providers to consume
4343 AllowUnverifiedEmail bool
44+ UserClaim string
4445 EmailClaim string
4546 GroupsClaim string
4647 Verifier *oidc.IDTokenVerifier
@@ -156,6 +157,17 @@ func (p *ProviderData) buildSessionFromClaims(idToken *oidc.IDToken) (*sessions.
156157 ss.Email = claims.Email
157158 ss.Groups = claims.Groups
158159
160+ // Allow specialized providers that embed OIDCProvider to control the User
161+ // claim. Not exposed as a configuration flag to generic OIDC provider
162+ // users (yet).
163+ if p.UserClaim != "" {
164+ user, ok := claims.raw[p.UserClaim].(string)
165+ if !ok {
166+ return nil, fmt.Errorf("unable to extract custom UserClaim (%s)", p.UserClaim)
167+ }
168+ ss.User = user
169+ }
170+
159171 // TODO (@NickMeves) Deprecate for dynamic claim to session mapping
160172 if pref, ok := claims.raw["preferred_username"].(string); ok {
161173 ss.PreferredUsername = pref
providers/provider_data_test.go+23
@@ -211,6 +211,7 @@ func TestProviderData_buildSessionFromClaims(t *testing.T) {
211211 testCases := map[string]struct {
212212 IDToken idTokenClaims
213213 AllowUnverified bool
214+ UserClaim string
214215 EmailClaim string
215216 GroupsClaim string
216217 ExpectedError error
@@ -259,6 +260,27 @@ func TestProviderData_buildSessionFromClaims(t *testing.T) {
259260 PreferredUsername: "Complex Claim",
260261 },
261262 },
263+ "User Claim Switched": {
264+ IDToken: defaultIDToken,
265+ AllowUnverified: true,
266+ UserClaim: "phone_number",
267+ EmailClaim: "email",
268+ GroupsClaim: "groups",
269+ ExpectedSession: &sessions.SessionState{
270+ User: "+4798765432",
271+ Email: "janed@me.com",
272+ Groups: []string{"test:a", "test:b"},
273+ PreferredUsername: "Jane Dobbs",
274+ },
275+ },
276+ "User Claim Invalid": {
277+ IDToken: defaultIDToken,
278+ AllowUnverified: true,
279+ UserClaim: "groups",
280+ EmailClaim: "email",
281+ GroupsClaim: "groups",
282+ ExpectedError: errors.New("unable to extract custom UserClaim (groups)"),
283+ },
262284 "Email Claim Switched": {
263285 IDToken: unverifiedIDToken,
264286 AllowUnverified: true,
@@ -332,6 +354,7 @@ func TestProviderData_buildSessionFromClaims(t *testing.T) {
332354 ),
333355 }
334356 provider.AllowUnverifiedEmail = tc.AllowUnverified
357+ provider.UserClaim = tc.UserClaim
335358 provider.EmailClaim = tc.EmailClaim
336359 provider.GroupsClaim = tc.GroupsClaim
337360