git.iko.soy/typeable/oauth2-proxy
on master help sign in
Add EnrichSessionState as main post-Redeem session updater
commit2b9e1bbba0998095cea6cbb8dd4625d93fc3d6fc authorNick Meves <nick.meves@greenhouse.io> dateSun 27 Sep 2020, 11:46 (6 years ago) parentb6061f0
6 files changed+32−12
compare with master
unifiedsplit
CHANGELOG.md+2 oauthproxy.go+4−3 oauthproxy_test.go+4−4 providers/provider_default.go+13−5 providers/provider_default_test.go+6 providers/providers.go+3
CHANGELOG.md+2
@@ -26,9 +26,11 @@
2626## Changes since v6.1.1
2727
2828- [#825](https://github.com/oauth2-proxy/oauth2-proxy/pull/825) Fix code coverage reporting on GitHub actions(@JoelSpeed)
29+- [#767](https://github.com/oauth2-proxy/oauth2-proxy/pull/796) Deprecate GetUserName & GetEmailAdress for EnrichSessionState (@NickMeves)
2930- [#705](https://github.com/oauth2-proxy/oauth2-proxy/pull/705) Add generic Header injectors for upstream request and response headers (@JoelSpeed)
3031- [#753](https://github.com/oauth2-proxy/oauth2-proxy/pull/753) Pass resource parameter in login url (@codablock)
3132- [#789](https://github.com/oauth2-proxy/oauth2-proxy/pull/789) Add `--skip-auth-route` configuration option for `METHOD=pathRegex` based allowlists (@NickMeves)
33+- [#767](https://github.com/oauth2-proxy/oauth2-proxy/pull/796) Deprecate GetUserName & GetEmailAdress for EnrichSessionState (@NickMeves)
3234- [#575](https://github.com/oauth2-proxy/oauth2-proxy/pull/575) Stop accepting legacy SHA1 signed cookies (@NickMeves)
3335- [#722](https://github.com/oauth2-proxy/oauth2-proxy/pull/722) Validate Redis configuration options at startup (@NickMeves)
3436- [#791](https://github.com/oauth2-proxy/oauth2-proxy/pull/791) Remove GetPreferredUsername method from provider interface (@NickMeves)
oauthproxy.go+4−3
@@ -360,7 +360,7 @@ func (p *OAuthProxy) redeemCode(ctx context.Context, host, code string) (*sessio
360360 return s, nil
361361}
362362
363−func (p *OAuthProxy) enrichSession(ctx context.Context, s *sessionsapi.SessionState) error {
363+func (p *OAuthProxy) enrichSessionState(ctx context.Context, s *sessionsapi.SessionState) error {
364364 var err error
365365 if s.Email == "" {
366366 s.Email, err = p.provider.GetEmailAddress(ctx, s)
@@ -374,7 +374,8 @@ func (p *OAuthProxy) enrichSession(ctx context.Context, s *sessionsapi.SessionSt
374374 return err
375375 }
376376 }
377− return nil
377+
378+ return p.provider.EnrichSessionState(ctx, s)
378379}
379380
380381// MakeCSRFCookie creates a cookie for CSRF
@@ -831,7 +832,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
831832 return
832833 }
833834
834− err = p.enrichSession(req.Context(), session)
835+ err = p.enrichSessionState(req.Context(), session)
835836 if err != nil {
836837 logger.Errorf("Error creating session during OAuth2 callback: %v", err)
837838 p.ErrorPage(rw, http.StatusInternalServerError, "Internal Server Error", "Internal Error")
oauthproxy_test.go+4−4
@@ -396,11 +396,11 @@ func NewTestProvider(providerURL *url.URL, emailAddress string) *TestProvider {
396396 }
397397}
398398
399−func (tp *TestProvider) GetEmailAddress(ctx context.Context, session *sessions.SessionState) (string, error) {
399+func (tp *TestProvider) GetEmailAddress(_ context.Context, _ *sessions.SessionState) (string, error) {
400400 return tp.EmailAddress, nil
401401}
402402
403−func (tp *TestProvider) ValidateSessionState(ctx context.Context, session *sessions.SessionState) bool {
403+func (tp *TestProvider) ValidateSessionState(_ context.Context, _ *sessions.SessionState) bool {
404404 return tp.ValidToken
405405}
406406
@@ -468,7 +468,7 @@ func Test_enrichSession(t *testing.T) {
468468 t.Fatal(err)
469469 }
470470
471− err = proxy.enrichSession(context.Background(), tc.session)
471+ err = proxy.enrichSessionState(context.Background(), tc.session)
472472 assert.NoError(t, err)
473473 assert.Equal(t, tc.expectedUser, tc.session.User)
474474 assert.Equal(t, tc.expectedEmail, tc.session.Email)
@@ -1955,7 +1955,7 @@ func TestClearSingleCookie(t *testing.T) {
19551955type NoOpKeySet struct {
19561956}
19571957
1958−func (NoOpKeySet) VerifySignature(ctx context.Context, jwt string) (payload []byte, err error) {
1958+func (NoOpKeySet) VerifySignature(_ context.Context, jwt string) (payload []byte, err error) {
19591959 splitStrings := strings.Split(jwt, ".")
19601960 payloadString := splitStrings[1]
19611961 return base64.RawURLEncoding.DecodeString(payloadString)
providers/provider_default.go+13−5
@@ -87,21 +87,29 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {
8787}
8888
8989// GetEmailAddress returns the Account email address
90−func (p *ProviderData) GetEmailAddress(ctx context.Context, s *sessions.SessionState) (string, error) {
90+// DEPRECATED: Migrate to EnrichSessionState
91+func (p *ProviderData) GetEmailAddress(_ context.Context, _ *sessions.SessionState) (string, error) {
9192 return "", ErrNotImplemented
9293}
9394
9495// GetUserName returns the Account username
95−func (p *ProviderData) GetUserName(ctx context.Context, s *sessions.SessionState) (string, error) {
96+// DEPRECATED: Migrate to EnrichSessionState
97+func (p *ProviderData) GetUserName(_ context.Context, _ *sessions.SessionState) (string, error) {
9698 return "", ErrNotImplemented
9799}
98100
99101// ValidateGroup validates that the provided email exists in the configured provider
100102// email group(s).
101−func (p *ProviderData) ValidateGroup(email string) bool {
103+func (p *ProviderData) ValidateGroup(_ string) bool {
102104 return true
103105}
104106
107+// EnrichSessionState is called after Redeem to allow providers to enrich session fields
108+// such as User, Email, Groups with provider specific API calls.
109+func (p *ProviderData) EnrichSessionState(_ context.Context, _ *sessions.SessionState) error {
110+ return nil
111+}
112+
105113// ValidateSessionState validates the AccessToken
106114func (p *ProviderData) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
107115 return validateToken(ctx, p, s.AccessToken, nil)
@@ -109,12 +117,12 @@ func (p *ProviderData) ValidateSessionState(ctx context.Context, s *sessions.Ses
109117
110118// RefreshSessionIfNeeded should refresh the user's session if required and
111119// do nothing if a refresh is not required
112−func (p *ProviderData) RefreshSessionIfNeeded(ctx context.Context, s *sessions.SessionState) (bool, error) {
120+func (p *ProviderData) RefreshSessionIfNeeded(_ context.Context, _ *sessions.SessionState) (bool, error) {
113121 return false, nil
114122}
115123
116124// CreateSessionStateFromBearerToken should be implemented to allow providers
117125// to convert ID tokens into sessions
118−func (p *ProviderData) CreateSessionStateFromBearerToken(ctx context.Context, rawIDToken string, idToken *oidc.IDToken) (*sessions.SessionState, error) {
126+func (p *ProviderData) CreateSessionStateFromBearerToken(_ context.Context, _ string, _ *oidc.IDToken) (*sessions.SessionState, error) {
119127 return nil, ErrNotImplemented
120128}
providers/provider_default_test.go+6
@@ -47,3 +47,9 @@ func TestAcrValuesConfigured(t *testing.T) {
4747 result := p.GetLoginURL("https://my.test.app/oauth", "")
4848 assert.Contains(t, result, "acr_values=testValue")
4949}
50+
51+func TestEnrichSessionState(t *testing.T) {
52+ p := &ProviderData{}
53+ s := &sessions.SessionState{}
54+ assert.NoError(t, p.EnrichSessionState(context.Background(), s))
55+}
providers/providers.go+3
@@ -10,10 +10,13 @@ import (
1010// Provider represents an upstream identity provider implementation
1111type Provider interface {
1212 Data() *ProviderData
13+ // DEPRECATED: Migrate to EnrichSessionState
1314 GetEmailAddress(ctx context.Context, s *sessions.SessionState) (string, error)
15+ // DEPRECATED: Migrate to EnrichSessionState
1416 GetUserName(ctx context.Context, s *sessions.SessionState) (string, error)
1517 Redeem(ctx context.Context, redirectURI, code string) (*sessions.SessionState, error)
1618 ValidateGroup(string) bool
19+ EnrichSessionState(ctx context.Context, s *sessions.SessionState) error
1720 ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool
1821 GetLoginURL(redirectURI, finalRedirect string) string
1922 RefreshSessionIfNeeded(ctx context.Context, s *sessions.SessionState) (bool, error)