git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #1563 from oauth2-proxy/fix-profile-url

Ensure claim extractor does not attempt profile call when URL is empty

commit1578d90d0b1dc3521e1a59de10b265e47228670a authorJoel Speed <Joel.speed@hotmail.co.uk> dateSat 19 Feb 2022, 15:37 (5 years ago) parent74e2f5025ef843
4 files changed+20−2
CHANGELOG.md+1 go.mod−1 pkg/providers/util/claim_extractor.go+1−1 pkg/providers/util/claim_extractor_test.go+18
CHANGELOG.md+1
@@ -9,6 +9,7 @@
99## Changes since v7.2.1
1010
1111- [#1561](https://github.com/oauth2-proxy/oauth2-proxy/pull/1561) Add ppc64le support (@mgiessing)
12+- [#1563](https://github.com/oauth2-proxy/oauth2-proxy/pull/1563) Ensure claim extractor does not attempt profile call when URL is empty (@JoelSpeed)
1213- [#1560](https://github.com/oauth2-proxy/oauth2-proxy/pull/1560) Fix provider data initialisation (@JoelSpeed)
1314- [#1555](https://github.com/oauth2-proxy/oauth2-proxy/pull/1555) Refactor provider configuration into providers package (@JoelSpeed)
1415- [#1394](https://github.com/oauth2-proxy/oauth2-proxy/pull/1394) Add generic claim extractor to get claims from ID Tokens (@JoelSpeed)
go.mod−1
@@ -61,7 +61,6 @@ require (
6161 github.com/prometheus/common v0.15.0 // indirect
6262 github.com/prometheus/procfs v0.2.0 // indirect
6363 github.com/spf13/afero v1.1.2 // indirect
64− github.com/spf13/cast v1.3.0 // indirect
6564 github.com/spf13/jwalterweatherman v1.0.0 // indirect
6665 github.com/subosito/gotenv v1.2.0 // indirect
6766 github.com/vmihailenco/tagparser v0.1.1 // indirect
pkg/providers/util/claim_extractor.go+1−1
@@ -86,7 +86,7 @@ func (c *claimExtractor) GetClaim(claim string) (interface{}, bool, error) {
8686// loadProfileClaims will fetch the profileURL using the provided headers as
8787// authentication.
8888func (c *claimExtractor) loadProfileClaims() (*simplejson.Json, error) {
89− if c.profileURL == nil || c.requestHeaders == nil {
89+ if c.profileURL == nil || c.profileURL.String() == "" || c.requestHeaders == nil {
9090 // When no profileURL is set, we return a non-empty map so that
9191 // we don't attempt to populate the profile claims again.
9292 // If there are no headers, the request would be unauthorized so we also skip
pkg/providers/util/claim_extractor_test.go+18
@@ -259,6 +259,24 @@ var _ = Describe("Claim Extractor Suite", func() {
259259 Expect(counter).To(BeEquivalentTo(1))
260260 })
261261
262+ It("GetClaim should not return an error with a non-nil empty ProfileURL", func() {
263+ claims, serverClose, err := newTestClaimExtractor(testClaimExtractorOpts{
264+ idTokenPayload: "{}",
265+ profileRequestHeaders: newAuthorizedHeader(),
266+ })
267+ Expect(err).ToNot(HaveOccurred())
268+ if serverClose != nil {
269+ defer serverClose()
270+ }
271+ // Set the ProfileURL to be empty, but not nil
272+ claims.(*claimExtractor).profileURL = &url.URL{}
273+
274+ value, exists, err := claims.GetClaim("user")
275+ Expect(err).ToNot(HaveOccurred())
276+ Expect(exists).To(BeFalse())
277+ Expect(value).To(BeNil())
278+ })
279+
262280 type getClaimIntoTableInput struct {
263281 testClaimExtractorOpts
264282 into interface{}