@@ -61,7 +61,7 @@ var _ = Describe("Legacy Options", func() {
6161 opts.InjectRequestHeaders = []Header{
6262 {
6363 Name: "X-Forwarded-Groups",
64− PreserveRequestValue: true,
64+ PreserveRequestValue: false,
6565 Values: []HeaderValue{
6666 {
6767 ClaimSource: &ClaimSource{
@@ -72,7 +72,7 @@ var _ = Describe("Legacy Options", func() {
7272 },
7373 {
7474 Name: "X-Forwarded-User",
75− PreserveRequestValue: true,
75+ PreserveRequestValue: false,
7676 Values: []HeaderValue{
7777 {
7878 ClaimSource: &ClaimSource{
@@ -83,7 +83,7 @@ var _ = Describe("Legacy Options", func() {
8383 },
8484 {
8585 Name: "X-Forwarded-Email",
86− PreserveRequestValue: true,
86+ PreserveRequestValue: false,
8787 Values: []HeaderValue{
8888 {
8989 ClaimSource: &ClaimSource{
@@ -94,7 +94,7 @@ var _ = Describe("Legacy Options", func() {
9494 },
9595 {
9696 Name: "X-Forwarded-Preferred-Username",
97− PreserveRequestValue: true,
97+ PreserveRequestValue: false,
9898 Values: []HeaderValue{
9999 {
100100 ClaimSource: &ClaimSource{
@@ -277,7 +277,7 @@ var _ = Describe("Legacy Options", func() {
277277
278278 xForwardedUser := Header{
279279 Name: "X-Forwarded-User",
280− PreserveRequestValue: true,
280+ PreserveRequestValue: false,
281281 Values: []HeaderValue{
282282 {
283283 ClaimSource: &ClaimSource{
@@ -289,7 +289,7 @@ var _ = Describe("Legacy Options", func() {
289289
290290 xForwardedEmail := Header{
291291 Name: "X-Forwarded-Email",
292− PreserveRequestValue: true,
292+ PreserveRequestValue: false,
293293 Values: []HeaderValue{
294294 {
295295 ClaimSource: &ClaimSource{
@@ -301,7 +301,7 @@ var _ = Describe("Legacy Options", func() {
301301
302302 xForwardedGroups := Header{
303303 Name: "X-Forwarded-Groups",
304− PreserveRequestValue: true,
304+ PreserveRequestValue: false,
305305 Values: []HeaderValue{
306306 {
307307 ClaimSource: &ClaimSource{
@@ -313,7 +313,7 @@ var _ = Describe("Legacy Options", func() {
313313
314314 xForwardedPreferredUsername := Header{
315315 Name: "X-Forwarded-Preferred-Username",
316− PreserveRequestValue: true,
316+ PreserveRequestValue: false,
317317 Values: []HeaderValue{
318318 {
319319 ClaimSource: &ClaimSource{
@@ -325,7 +325,7 @@ var _ = Describe("Legacy Options", func() {
325325
326326 basicAuthHeader := Header{
327327 Name: "Authorization",
328− PreserveRequestValue: true,
328+ PreserveRequestValue: false,
329329 Values: []HeaderValue{
330330 {
331331 ClaimSource: &ClaimSource{
@@ -340,7 +340,7 @@ var _ = Describe("Legacy Options", func() {
340340
341341 xForwardedUserWithEmail := Header{
342342 Name: "X-Forwarded-User",
343− PreserveRequestValue: true,
343+ PreserveRequestValue: false,
344344 Values: []HeaderValue{
345345 {
346346 ClaimSource: &ClaimSource{
@@ -350,9 +350,21 @@ var _ = Describe("Legacy Options", func() {
350350 },
351351 }
352352
353+ xForwardedAccessToken := Header{
354+ Name: "X-Forwarded-Access-Token",
355+ PreserveRequestValue: false,
356+ Values: []HeaderValue{
357+ {
358+ ClaimSource: &ClaimSource{
359+ Claim: "access_token",
360+ },
361+ },
362+ },
363+ }
364+
353365 basicAuthHeaderWithEmail := Header{
354366 Name: "Authorization",
355− PreserveRequestValue: true,
367+ PreserveRequestValue: false,
356368 Values: []HeaderValue{
357369 {
358370 ClaimSource: &ClaimSource{
@@ -401,13 +413,13 @@ var _ = Describe("Legacy Options", func() {
401413 },
402414 }
403415
404− xForwardedAccessToken := Header{
405− Name: "X-Forwarded-Access-Token",
406− PreserveRequestValue: true,
416+ xAuthRequestPreferredUsername := Header{
417+ Name: "X-Auth-Request-Preferred-Username",
418+ PreserveRequestValue: false,
407419 Values: []HeaderValue{
408420 {
409421 ClaimSource: &ClaimSource{
410− Claim: "access_token",
422+ Claim: "preferred_username",
411423 },
412424 },
413425 },
@@ -427,7 +439,7 @@ var _ = Describe("Legacy Options", func() {
427439
428440 authorizationHeader := Header{
429441 Name: "Authorization",
430− PreserveRequestValue: true,
442+ PreserveRequestValue: false,
431443 Values: []HeaderValue{
432444 {
433445 ClaimSource: &ClaimSource{
@@ -457,7 +469,7 @@ var _ = Describe("Legacy Options", func() {
457469
458470 PreferEmailToUser: false,
459471 BasicAuthPassword: "",
460− SkipAuthStripHeaders: false,
472+ SkipAuthStripHeaders: true,
461473 },
462474 expectedRequestHeaders: []Header{},
463475 expectedResponseHeaders: []Header{},
@@ -475,7 +487,7 @@ var _ = Describe("Legacy Options", func() {
475487
476488 PreferEmailToUser: false,
477489 BasicAuthPassword: basicAuthSecret,
478− SkipAuthStripHeaders: false,
490+ SkipAuthStripHeaders: true,
479491 },
480492 expectedRequestHeaders: []Header{
481493 xForwardedUser,
@@ -485,10 +497,10 @@ var _ = Describe("Legacy Options", func() {
485497 basicAuthHeader,
486498 },
487499 expectedResponseHeaders: []Header{
488− withPreserveRequestValue(basicAuthHeader, false),
500+ basicAuthHeader,
489501 },
490502 }),
491− Entry("with basic auth enabled and skipAuthStripHeaders", legacyHeadersTableInput{
503+ Entry("with basic auth enabled and skipAuthStripHeaders disabled", legacyHeadersTableInput{
492504 legacyHeaders: &LegacyHeaders{
493505 PassBasicAuth: true,
494506 PassAccessToken: false,
@@ -501,17 +513,17 @@ var _ = Describe("Legacy Options", func() {
501513
502514 PreferEmailToUser: false,
503515 BasicAuthPassword: basicAuthSecret,
504− SkipAuthStripHeaders: true,
516+ SkipAuthStripHeaders: false,
505517 },
506518 expectedRequestHeaders: []Header{
507− withPreserveRequestValue(xForwardedUser, false),
508− withPreserveRequestValue(xForwardedEmail, false),
509− withPreserveRequestValue(xForwardedGroups, false),
510− withPreserveRequestValue(xForwardedPreferredUsername, false),
511− withPreserveRequestValue(basicAuthHeader, false),
519+ withPreserveRequestValue(xForwardedUser, true),
520+ withPreserveRequestValue(xForwardedEmail, true),
521+ withPreserveRequestValue(xForwardedGroups, true),
522+ withPreserveRequestValue(xForwardedPreferredUsername, true),
523+ withPreserveRequestValue(basicAuthHeader, true),
512524 },
513525 expectedResponseHeaders: []Header{
514− withPreserveRequestValue(basicAuthHeader, false),
526+ basicAuthHeader,
515527 },
516528 }),
517529 Entry("with basic auth enabled and preferEmailToUser", legacyHeadersTableInput{
@@ -527,7 +539,7 @@ var _ = Describe("Legacy Options", func() {
527539
528540 PreferEmailToUser: true,
529541 BasicAuthPassword: basicAuthSecret,
530− SkipAuthStripHeaders: false,
542+ SkipAuthStripHeaders: true,
531543 },
532544 expectedRequestHeaders: []Header{
533545 xForwardedUserWithEmail,
@@ -536,7 +548,7 @@ var _ = Describe("Legacy Options", func() {
536548 basicAuthHeaderWithEmail,
537549 },
538550 expectedResponseHeaders: []Header{
539− withPreserveRequestValue(basicAuthHeaderWithEmail, false),
551+ basicAuthHeaderWithEmail,
540552 },
541553 }),
542554 Entry("with basic auth enabled and passUserHeaders", legacyHeadersTableInput{
@@ -552,7 +564,7 @@ var _ = Describe("Legacy Options", func() {
552564
553565 PreferEmailToUser: false,
554566 BasicAuthPassword: basicAuthSecret,
555− SkipAuthStripHeaders: false,
567+ SkipAuthStripHeaders: true,
556568 },
557569 expectedRequestHeaders: []Header{
558570 xForwardedUser,
@@ -562,7 +574,7 @@ var _ = Describe("Legacy Options", func() {
562574 basicAuthHeader,
563575 },
564576 expectedResponseHeaders: []Header{
565− withPreserveRequestValue(basicAuthHeader, false),
577+ basicAuthHeader,
566578 },
567579 }),
568580 Entry("with passUserHeaders", legacyHeadersTableInput{
@@ -578,7 +590,7 @@ var _ = Describe("Legacy Options", func() {
578590
579591 PreferEmailToUser: false,
580592 BasicAuthPassword: "",
581− SkipAuthStripHeaders: false,
593+ SkipAuthStripHeaders: true,
582594 },
583595 expectedRequestHeaders: []Header{
584596 xForwardedUser,
@@ -588,6 +600,29 @@ var _ = Describe("Legacy Options", func() {
588600 },
589601 expectedResponseHeaders: []Header{},
590602 }),
603+ Entry("with passUserHeaders and SkipAuthStripHeaders disabled", legacyHeadersTableInput{
604+ legacyHeaders: &LegacyHeaders{
605+ PassBasicAuth: false,
606+ PassAccessToken: false,
607+ PassUserHeaders: true,
608+ PassAuthorization: false,
609+
610+ SetBasicAuth: false,
611+ SetXAuthRequest: false,
612+ SetAuthorization: false,
613+
614+ PreferEmailToUser: false,
615+ BasicAuthPassword: "",
616+ SkipAuthStripHeaders: false,
617+ },
618+ expectedRequestHeaders: []Header{
619+ withPreserveRequestValue(xForwardedUser, true),
620+ withPreserveRequestValue(xForwardedEmail, true),
621+ withPreserveRequestValue(xForwardedGroups, true),
622+ withPreserveRequestValue(xForwardedPreferredUsername, true),
623+ },
624+ expectedResponseHeaders: []Header{},
625+ }),
591626 Entry("with setXAuthRequest", legacyHeadersTableInput{
592627 legacyHeaders: &LegacyHeaders{
593628 PassBasicAuth: false,
@@ -601,14 +636,14 @@ var _ = Describe("Legacy Options", func() {
601636
602637 PreferEmailToUser: false,
603638 BasicAuthPassword: "",
604− SkipAuthStripHeaders: false,
639+ SkipAuthStripHeaders: true,
605640 },
606641 expectedRequestHeaders: []Header{},
607642 expectedResponseHeaders: []Header{
608643 xAuthRequestUser,
609644 xAuthRequestEmail,
610645 xAuthRequestGroups,
611− withPreserveRequestValue(xForwardedPreferredUsername, false),
646+ xAuthRequestPreferredUsername,
612647 },
613648 }),
614649 Entry("with passAccessToken", legacyHeadersTableInput{
@@ -624,7 +659,7 @@ var _ = Describe("Legacy Options", func() {
624659
625660 PreferEmailToUser: false,
626661 BasicAuthPassword: "",
627− SkipAuthStripHeaders: false,
662+ SkipAuthStripHeaders: true,
628663 },
629664 expectedRequestHeaders: []Header{
630665 xForwardedAccessToken,
@@ -644,7 +679,7 @@ var _ = Describe("Legacy Options", func() {
644679
645680 PreferEmailToUser: false,
646681 BasicAuthPassword: "",
647− SkipAuthStripHeaders: false,
682+ SkipAuthStripHeaders: true,
648683 },
649684 expectedRequestHeaders: []Header{
650685 xForwardedAccessToken,
@@ -653,10 +688,30 @@ var _ = Describe("Legacy Options", func() {
653688 xAuthRequestUser,
654689 xAuthRequestEmail,
655690 xAuthRequestGroups,
656− withPreserveRequestValue(xForwardedPreferredUsername, false),
691+ xAuthRequestPreferredUsername,
657692 xAuthRequestAccessToken,
658693 },
659694 }),
695+ Entry("with passAcessToken and SkipAuthStripHeaders disabled", legacyHeadersTableInput{
696+ legacyHeaders: &LegacyHeaders{
697+ PassBasicAuth: false,
698+ PassAccessToken: true,
699+ PassUserHeaders: false,
700+ PassAuthorization: false,
701+
702+ SetBasicAuth: false,
703+ SetXAuthRequest: false,
704+ SetAuthorization: false,
705+
706+ PreferEmailToUser: false,
707+ BasicAuthPassword: "",
708+ SkipAuthStripHeaders: false,
709+ },
710+ expectedRequestHeaders: []Header{
711+ withPreserveRequestValue(xForwardedAccessToken, true),
712+ },
713+ expectedResponseHeaders: []Header{},
714+ }),
660715 Entry("with authorization headers", legacyHeadersTableInput{
661716 legacyHeaders: &LegacyHeaders{
662717 PassBasicAuth: false,
@@ -670,13 +725,35 @@ var _ = Describe("Legacy Options", func() {
670725
671726 PreferEmailToUser: false,
672727 BasicAuthPassword: "",
673− SkipAuthStripHeaders: false,
728+ SkipAuthStripHeaders: true,
674729 },
675730 expectedRequestHeaders: []Header{
676731 authorizationHeader,
677732 },
678733 expectedResponseHeaders: []Header{
679− withPreserveRequestValue(authorizationHeader, false),
734+ authorizationHeader,
735+ },
736+ }),
737+ Entry("with authorization headers and SkipAuthStripHeaders disabled", legacyHeadersTableInput{
738+ legacyHeaders: &LegacyHeaders{
739+ PassBasicAuth: false,
740+ PassAccessToken: false,
741+ PassUserHeaders: false,
742+ PassAuthorization: true,
743+
744+ SetBasicAuth: false,
745+ SetXAuthRequest: false,
746+ SetAuthorization: true,
747+
748+ PreferEmailToUser: false,
749+ BasicAuthPassword: "",
750+ SkipAuthStripHeaders: false,
751+ },
752+ expectedRequestHeaders: []Header{
753+ withPreserveRequestValue(authorizationHeader, true),
754+ },
755+ expectedResponseHeaders: []Header{
756+ authorizationHeader,
680757 },
681758 }),
682759 )