git.iko.soy/typeable/oauth2-proxy
on master help sign in
feat: migrate google used organization id and header normalization booleans to pointers

Signed-off-by: Jan Larwig <jan@larwig.com>

commit15041dd116456b2d66440f4f96991aa226f8b4f1 authorJan Larwig <jan@larwig.com> dateSun 16 Nov 2025, 22:36 (1 year ago) parent0eec65e
8 files changed+19−8
compare with master
unifiedsplit
main_test.go+2−1 pkg/apis/options/header.go+3−1 pkg/apis/options/legacy_options.go+1−1 pkg/apis/options/legacy_options_test.go+2 pkg/apis/options/providers.go+7−1 pkg/middleware/headers.go+1−1 pkg/middleware/headers_test.go+1−1 providers/google.go+2−2
main_test.go+2−1
@@ -169,8 +169,9 @@ redirect_url="http://localhost:4180/oauth2/callback"
169169 SkipClaimsFromProfileURL: ptr.To(false),
170170 GoogleConfig: options.GoogleOptions{
171171 AdminEmail: "admin@example.com",
172− UseApplicationDefaultCredentials: ptr.To(false),
173172 TargetPrincipal: "principal",
173+ UseOrganizationID: ptr.To(false),
174+ UseApplicationDefaultCredentials: ptr.To(false),
174175 },
175176 AzureConfig: options.AzureOptions{
176177 Tenant: "common",
pkg/apis/options/header.go+3−1
@@ -5,6 +5,8 @@ import "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
55const (
66 // DefaultHeaderPreserveRequestValue is the default value for Header.PreserveRequestValue
77 DefaultHeaderPreserveRequestValue bool = false
8+ // DefaultInsecureSkipHeaderNormalization is the default value for Header.InsecureSkipHeaderNormalization
9+ DefaultInsecureSkipHeaderNormalization bool = false
810)
911
1012// Header represents an individual header that will be added to a request or
@@ -28,7 +30,7 @@ type Header struct {
2830 // treated as the same header. Additionally underscores (_) in header names
2931 // will be converted to dashes (-) when normalizing.
3032 // Defaults to false (header names will be normalized).
31− InsecureSkipHeaderNormalization bool `json:"InsecureSkipHeaderNormalization,omitempty"`
33+ InsecureSkipHeaderNormalization *bool `yaml:"InsecureSkipHeaderNormalization,omitempty"`
3234
3335 // Values contains the desired values for this header
3436 Values []HeaderValue `yaml:"values,omitempty"`
pkg/apis/options/legacy_options.go+1−1
@@ -789,7 +789,7 @@ func (l *LegacyProvider) convert() (Providers, error) {
789789 ServiceAccountJSON: l.GoogleServiceAccountJSON,
790790 UseApplicationDefaultCredentials: &l.GoogleUseApplicationDefaultCredentials,
791791 TargetPrincipal: l.GoogleTargetPrincipal,
792− UseOrganizationID: l.GoogleUseOrganizationID,
792+ UseOrganizationID: &l.GoogleUseOrganizationID,
793793 AdminAPIUserScope: l.GoogleAdminAPIUserScope,
794794 }
795795 case "entra-id":
pkg/apis/options/legacy_options_test.go+2
@@ -955,6 +955,7 @@ var _ = Describe("Legacy Options", func() {
955955 }
956956
957957 defaultGoogleOptions := GoogleOptions{
958+ UseOrganizationID: ptr.To(false),
958959 UseApplicationDefaultCredentials: ptr.To(false),
959960 }
960961
@@ -1020,6 +1021,7 @@ var _ = Describe("Legacy Options", func() {
10201021 AdminEmail: "email@email.com",
10211022 ServiceAccountJSON: "test.json",
10221023 Groups: []string{"1", "2"},
1024+ UseOrganizationID: ptr.To(false),
10231025 UseApplicationDefaultCredentials: ptr.To(false),
10241026 },
10251027 LoginURLParameters: defaultURLParams,
pkg/apis/options/providers.go+7−1
@@ -37,6 +37,10 @@ const (
3737 // for MicrosoftEntraIDOptions.FederatedTokenAuth
3838 DefaultMicrosoftEntraIDUseFederatedToken bool = false
3939
40+ // DefaultGoogleUseOrganizationID is the default value
41+ // for GoogleOptions.UseOrganizationID
42+ DefaultGoogleUseOrganizationID bool = false
43+
4044 // DefaultGoogleUseApplicationDefaultCredentials is the default values
4145 // for GoogleOptions.UseApplicationDefaultCredentials
4246 DefaultUseApplicationDefaultCredentials bool = false
@@ -269,7 +273,7 @@ type GoogleOptions struct {
269273 // TargetPrincipal is the Google Service Account used for Application Default Credentials
270274 TargetPrincipal string `yaml:"targetPrincipal,omitempty"`
271275 // UseOrganizationId indicates whether to use the organization ID as the UserName claim
272− UseOrganizationID bool `yaml:"useOrganizationID,omitempty"`
276+ UseOrganizationID *bool `yaml:"useOrganizationID,omitempty"`
273277 // admin scope needed for fetching user organization information from admin api, can be one of cloud, user or defaults to readonly
274278 AdminAPIUserScope string `yaml:"adminAPIUserScope,omitempty"`
275279}
@@ -412,6 +416,8 @@ func (a *ADFSOptions) EnsureDefaults() {
412416
413417// EnsureDefaults sets any default values for GoogleOptions fields.
414418func (g *GoogleOptions) EnsureDefaults() {
419+ g.UseOrganizationID = ptr.To(DefaultGoogleUseOrganizationID)
420+
415421 if g.UseApplicationDefaultCredentials == nil {
416422 g.UseApplicationDefaultCredentials = ptr.To(DefaultUseApplicationDefaultCredentials)
417423 }
pkg/middleware/headers.go+1−1
@@ -54,7 +54,7 @@ func flattenHeaders(headers http.Header) {
5454func stripHeaders(headers []options.Header, next http.Handler) http.Handler {
5555 return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
5656 for _, header := range headers {
57− if header.InsecureSkipHeaderNormalization {
57+ if ptr.Deref(header.InsecureSkipHeaderNormalization, options.DefaultInsecureSkipHeaderNormalization) {
5858 req.Header.Del(header.Name)
5959 continue
6060 }
pkg/middleware/headers_test.go+1−1
@@ -231,7 +231,7 @@ var _ = Describe("Headers Suite", func() {
231231 headers: []options.Header{
232232 {
233233 Name: "X-Auth-Request-User",
234− InsecureSkipHeaderNormalization: true,
234+ InsecureSkipHeaderNormalization: ptr.To(true),
235235 Values: []options.HeaderValue{
236236 {
237237 ClaimSource: &options.ClaimSource{Claim: "user"},
providers/google.go+2−2
@@ -109,11 +109,11 @@ func NewGoogleProvider(p *ProviderData, opts options.GoogleOptions) (*GoogleProv
109109 },
110110 }
111111
112− if opts.UseOrganizationID || opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, options.DefaultUseApplicationDefaultCredentials) {
112+ if ptr.Deref(opts.UseOrganizationID, options.DefaultGoogleUseOrganizationID) || opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, options.DefaultUseApplicationDefaultCredentials) {
113113 // reuse admin service to avoid multiple calls for token
114114 var adminService *admin.Service
115115
116− if opts.UseOrganizationID {
116+ if ptr.Deref(opts.UseOrganizationID, options.DefaultGoogleUseOrganizationID) {
117117 // add user scopes to admin api
118118 userScope := getAdminAPIUserScope(opts.AdminAPIUserScope)
119119 for index, scope := range possibleScopesList {