24f91a0 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Allow to pass user headers only (issue #205)

* This fixes https://github.com/bitly/oauth2_proxy/issues/205 * Add new boolean option -pass-user-headers to control whether X-Forwarded-User and X-Forwarded-Email headers will be set (as opposed to HTTP BASIC auth) * This is required e.g. for grafana [1] where X-Forwarded-User is needed but HTTP BASIC auth fails (password is not known and must not be known in this scenario) * Keep behaviour of PassBasicAuth unchanged for compatibility [1] http://docs.grafana.org/installation/configuration/#authproxy

commit24f91a0b6039a96270e9f6cd10e03d9ac270d5de authorOmar Elazhary <omar.elazhary@sap.com> dateMon 8 Feb 2016, 15:57 (11 years ago) parent89ba1d8

6 files changed+14

compare with master

unifiedsplit

README.md+1 contrib/oauth2_proxy.cfg.example+1 main.go+1 oauthproxy.go+8 oauthproxy_test.go+1 options.go+2

README.md+1

@@ -187,6 +187,7 @@ Usage of oauth2_proxy:

187187 -login-url="": Authentication endpoint

188188 -pass-access-token=false: pass OAuth access_token to upstream via X-Forwarded-Access-Token header

189189 -pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream

190+ -pass-user-headers=true: pass X-Forwarded-User and X-Forwarded-Email information to upstream

190191 -pass-host-header=true: pass the request Host Header to upstream

191192 -profile-url="": Profile access endpoint

192193 -provider="google": OAuth provider

contrib/oauth2_proxy.cfg.example+1

@@ -23,6 +23,7 @@

2323

2424## pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream

2525# pass_basic_auth = true

26+# pass_user_headers = true

2627## pass the request Host Header to upstream

2728## when disabled the upstream Host is used as the Host Header

2829# pass_host_header = true

main.go+1

@@ -32,6 +32,7 @@ func main() {

3232 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")

3333 flagSet.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path")

3434 flagSet.Bool("pass-basic-auth", true, "pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream")

35+ flagSet.Bool("pass-user-headers", true, "pass X-Forwarded-User and X-Forwarded-Email information to upstream")

3536 flagSet.String("basic-auth-password", "", "the password to set when passing the HTTP Basic Auth header")

3637 flagSet.Bool("pass-access-token", false, "pass OAuth access_token to upstream via X-Forwarded-Access-Token header")

3738 flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")

oauthproxy.go+8

@@ -60,6 +60,7 @@ type OAuthProxy struct {

6060 serveMux http.Handler

6161 PassBasicAuth bool

6262 SkipProviderButton bool

63+ PassUserHeaders bool

6364 BasicAuthPassword string

6465 PassAccessToken bool

6566 CookieCipher *cookie.Cipher

@@ -194,6 +195,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

194195 skipAuthRegex: opts.SkipAuthRegex,

195196 compiledRegex: opts.CompiledRegex,

196197 PassBasicAuth: opts.PassBasicAuth,

198+ PassUserHeaders: opts.PassUserHeaders,

197199 BasicAuthPassword: opts.BasicAuthPassword,

198200 PassAccessToken: opts.PassAccessToken,

199201 SkipProviderButton: opts.SkipProviderButton,

@@ -602,6 +604,12 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int

602604 req.Header["X-Forwarded-Email"] = []string{session.Email}

603605 }

604606 }

607+ if p.PassUserHeaders {

608+ req.Header["X-Forwarded-User"] = []string{session.User}

609+ if session.Email != "" {

610+ req.Header["X-Forwarded-Email"] = []string{session.Email}

611+ }

612+ }

605613 if p.PassAccessToken && session.AccessToken != "" {

606614 req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}

607615 }

oauthproxy_test.go+1

@@ -156,6 +156,7 @@ func TestBasicAuthPassword(t *testing.T) {

156156 opts.ClientSecret = "foobar"

157157 opts.CookieSecure = false

158158 opts.PassBasicAuth = true

159+ opts.PassUserHeaders = true

159160 opts.BasicAuthPassword = "This is a secure password"

160161 opts.Validate()

161162

options.go+2

@@ -54,6 +54,7 @@ type Options struct {

5454 PassAccessToken bool `flag:"pass-access-token" cfg:"pass_access_token"`

5555 PassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header"`

5656 SkipProviderButton bool `flag:"skip-provider-button" cfg:"skip_provider_button"`

57+ PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers"`

5758

5859 // These options allow for other providers besides Google, with

5960 // potential overrides.

@@ -95,6 +96,7 @@ func NewOptions() *Options {

9596 CookieExpire: time.Duration(168) * time.Hour,

9697 CookieRefresh: time.Duration(0),

9798 PassBasicAuth: true,

99+ PassUserHeaders: true,

98100 PassAccessToken: false,

99101 PassHostHeader: true,

100102 SkipProviderButton: false,