3108f76 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Fix #381, expose acr_values to all providers (#445)

commit3108f765a5ecec95a4278f89023ac63850920101 authorJakub Holy <jakub.holy@telia.no> dateTue 17 Mar 2020, 18:57 (7 years ago) parent4eef21c

7 files changed+19−11

compare with master

unifiedsplit

CHANGELOG.md+1 docs/configuration/configuration.md+1−1 main.go+1−1 options.go+1−1 providers/logingov.go+5−2 providers/provider_data.go+9−6 providers/provider_default.go+1

CHANGELOG.md+1

@@ -9,6 +9,7 @@

1010## Changes since v5.0.0

1111

12+- [#445](https://github.com/pusher/oauth2_proxy/pull/445) Expose `acr_values` to all providers (@holyjak)

1213- [#419](https://github.com/pusher/oauth2_proxy/pull/419) Support Go 1.14, upgrade dependencies, upgrade golangci-lint to 1.23.6 (@johejo)

1314- [#444](https://github.com/pusher/oauth2_proxy/pull/444) Support prompt in addition to approval-prompt (@holyjak)

1415- [#435](https://github.com/pusher/oauth2_proxy/pull/435) Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)

docs/configuration/configuration.md+1−1

@@ -22,7 +22,7 @@ An example [oauth2_proxy.cfg]({{ site.gitweb }}/contrib/oauth2_proxy.cfg.example

2222

2424| ------ | ---- | ----------- | ------- |

main.go+1−1

@@ -136,7 +136,7 @@ func main() {

136136 flagSet.String("approval-prompt", "force", "OAuth approval_prompt")

137137

138138 flagSet.String("signature-key", "", "GAP-Signature request signature key (algorithm:secretkey)")

139− flagSet.String("acr-values", "http://idmanagement.gov/ns/assurance/loa/1", "acr values string: optional, used by login.gov")

139+ flagSet.String("acr-values", "", "acr values string: optional")

140140 flagSet.String("jwt-key", "", "private key in PEM format used to sign JWT, so that you can say something like -jwt-key=\"${OAUTH2_PROXY_JWT_KEY}\": required by login.gov")

141141 flagSet.String("jwt-key-file", "", "path to the private key file in PEM format used to sign the JWT so that you can say something like -jwt-key-file=/etc/ssl/private/jwt_signing_key.pem: required by login.gov")

142142 flagSet.String("pubjwk-url", "", "JWK pubkey access endpoint: required by login.gov")

options.go+1−1

@@ -415,6 +415,7 @@ func parseProviderInfo(o *Options, msgs []string) []string {

415415 ClientSecretFile: o.ClientSecretFile,

416416 Prompt: o.Prompt,

417417 ApprovalPrompt: o.ApprovalPrompt,

418+ AcrValues: o.AcrValues,

418419 }

419420 p.LoginURL, msgs = parseURL(o.LoginURL, "login", msgs)

420421 p.RedeemURL, msgs = parseURL(o.RedeemURL, "redeem", msgs)

@@ -473,7 +474,6 @@ func parseProviderInfo(o *Options, msgs []string) []string {

473474 }

474475 }

475476 case *providers.LoginGovProvider:

476− p.AcrValues = o.AcrValues

477477 p.PubJWKURL, msgs = parseURL(o.PubJWKURL, "pubjwk", msgs)

478478

479479 // JWT key can be supplied via env variable or file in the filesystem, but not both.

providers/logingov.go+5−2

@@ -24,7 +24,6 @@ type LoginGovProvider struct {

2424 // TODO (@timothy-spencer): Ideally, the nonce would be in the session state, but the session state

2525 // is created only upon code redemption, not during the auth, when this must be supplied.

2626 Nonce string

27− AcrValues string

2827 JWTKey *rsa.PrivateKey

2928 PubJWKURL *url.URL

3029}

@@ -270,7 +269,11 @@ func (p *LoginGovProvider) GetLoginURL(redirectURI, state string) string {

270269 params.Set("client_id", p.ClientID)

271270 params.Set("response_type", "code")

272271 params.Add("state", state)

273− params.Add("acr_values", p.AcrValues)

272+ acr := p.AcrValues

273+ if acr == "" {

274+ acr = "http://idmanagement.gov/ns/assurance/loa/1"

275+ }

276+ params.Add("acr_values", acr)

274277 params.Add("nonce", p.Nonce)

275278 a.RawQuery = params.Encode()

276279 return a.String()

providers/provider_data.go+9−6

@@ -12,17 +12,20 @@ import (

1212// of OAuth2 providers

1313type ProviderData struct {

1414 ProviderName string

15− ClientID string

16− ClientSecret string

17− ClientSecretFile string

1815 LoginURL *url.URL

1916 RedeemURL *url.URL

2017 ProfileURL *url.URL

2118 ProtectedResource *url.URL

2219 ValidateURL *url.URL

23− Scope string

24− Prompt string

25− ApprovalPrompt string

20+ // Auth request params & related, see

21+ //https://openid.net/specs/openid-connect-basic-1_0.html#rfc.section.2.1.1.1

22+ AcrValues string

23+ ApprovalPrompt string // NOTE: Renamed to "prompt" in OAuth2

24+ ClientID string

25+ ClientSecret string

26+ ClientSecretFile string

27+ Scope string

28+ Prompt string

2629}

2730

2831// Data returns the ProviderData

providers/provider_default.go+1

@@ -90,6 +90,7 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {

9090 a = *p.LoginURL

9191 params, _ := url.ParseQuery(a.RawQuery)

9292 params.Set("redirect_uri", redirectURI)

93+ params.Add("acr_values", p.AcrValues)

9394 if p.Prompt != "" {

9495 params.Set("prompt", p.Prompt)

9596 } else { // Legacy variant of the prompt param: