3108f76 · typeable/oauth2-proxy

CHANGELOG.md+1

compare with master

unifiedsplit

@@ -9,6 +9,7 @@

9

10## Changes since v5.0.0

11

12+- [#445](https://github.com/pusher/oauth2_proxy/pull/445) Expose `acr_values` to all providers (@holyjak)

12- [#419](https://github.com/pusher/oauth2_proxy/pull/419) Support Go 1.14, upgrade dependencies, upgrade golangci-lint to 1.23.6 (@johejo)

13- [#419](https://github.com/pusher/oauth2_proxy/pull/419) Support Go 1.14, upgrade dependencies, upgrade golangci-lint to 1.23.6 (@johejo)

13- [#444](https://github.com/pusher/oauth2_proxy/pull/444) Support prompt in addition to approval-prompt (@holyjak)

14- [#444](https://github.com/pusher/oauth2_proxy/pull/444) Support prompt in addition to approval-prompt (@holyjak)

14- [#435](https://github.com/pusher/oauth2_proxy/pull/435) Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)

15- [#435](https://github.com/pusher/oauth2_proxy/pull/435) Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)

docs/configuration/configuration.md+1−1

@@ -22,7 +22,7 @@ An example [oauth2_proxy.cfg]({{ site.gitweb }}/contrib/oauth2_proxy.cfg.example

22

24| ------ | ---- | ----------- | ------- |

main.go+1−1

@@ -136,7 +136,7 @@ func main() {

136 flagSet.String("approval-prompt", "force", "OAuth approval_prompt")

137

138 flagSet.String("signature-key", "", "GAP-Signature request signature key (algorithm:secretkey)")

139− flagSet.String("acr-values", "http://idmanagement.gov/ns/assurance/loa/1", "acr values string: optional, used by login.gov")

139+ flagSet.String("acr-values", "", "acr values string: optional")

140 flagSet.String("jwt-key", "", "private key in PEM format used to sign JWT, so that you can say something like -jwt-key=\"${OAUTH2_PROXY_JWT_KEY}\": required by login.gov")

141 flagSet.String("jwt-key-file", "", "path to the private key file in PEM format used to sign the JWT so that you can say something like -jwt-key-file=/etc/ssl/private/jwt_signing_key.pem: required by login.gov")

142 flagSet.String("pubjwk-url", "", "JWK pubkey access endpoint: required by login.gov")

options.go+1−1

@@ -415,6 +415,7 @@ func parseProviderInfo(o *Options, msgs []string) []string {

415 ClientSecretFile: o.ClientSecretFile,

416 Prompt: o.Prompt,

417 ApprovalPrompt: o.ApprovalPrompt,

418+ AcrValues: o.AcrValues,

418 }

419 }

419 p.LoginURL, msgs = parseURL(o.LoginURL, "login", msgs)

420 p.LoginURL, msgs = parseURL(o.LoginURL, "login", msgs)

420 p.RedeemURL, msgs = parseURL(o.RedeemURL, "redeem", msgs)

421 p.RedeemURL, msgs = parseURL(o.RedeemURL, "redeem", msgs)

@@ -473,7 +474,6 @@ func parseProviderInfo(o *Options, msgs []string) []string {

473 }

474 }

475 }

475 case *providers.LoginGovProvider:

476 case *providers.LoginGovProvider:

476− p.AcrValues = o.AcrValues

477 p.PubJWKURL, msgs = parseURL(o.PubJWKURL, "pubjwk", msgs)

478

479 // JWT key can be supplied via env variable or file in the filesystem, but not both.

providers/logingov.go+5−2

@@ -24,7 +24,6 @@ type LoginGovProvider struct {

24 // TODO (@timothy-spencer): Ideally, the nonce would be in the session state, but the session state

25 // is created only upon code redemption, not during the auth, when this must be supplied.

26 Nonce string

27− AcrValues string

28 JWTKey *rsa.PrivateKey

27 JWTKey *rsa.PrivateKey

29 PubJWKURL *url.URL

28 PubJWKURL *url.URL

30}

29}

@@ -270,7 +269,11 @@ func (p *LoginGovProvider) GetLoginURL(redirectURI, state string) string {

270 params.Set("client_id", p.ClientID)

269 params.Set("client_id", p.ClientID)

271 params.Set("response_type", "code")

270 params.Set("response_type", "code")

272 params.Add("state", state)

271 params.Add("state", state)

272+ acr := p.AcrValues

273+ if acr == "" {

274+ acr = "http://idmanagement.gov/ns/assurance/loa/1"

275+ }

273− params.Add("acr_values", p.AcrValues)

276+ params.Add("acr_values", acr)

274 params.Add("nonce", p.Nonce)

277 params.Add("nonce", p.Nonce)

275 a.RawQuery = params.Encode()

278 a.RawQuery = params.Encode()

276 return a.String()

279 return a.String()

providers/provider_data.go+9−6

@@ -12,17 +12,20 @@ import (

12// of OAuth2 providers

13type ProviderData struct {

14 ProviderName string

15− ClientID string

16− ClientSecret string

17− ClientSecretFile string

18 LoginURL *url.URL

15 LoginURL *url.URL

19 RedeemURL *url.URL

16 RedeemURL *url.URL

20 ProfileURL *url.URL

17 ProfileURL *url.URL

21 ProtectedResource *url.URL

18 ProtectedResource *url.URL

22 ValidateURL *url.URL

19 ValidateURL *url.URL

20+ // Auth request params & related, see

21+ //https://openid.net/specs/openid-connect-basic-1_0.html#rfc.section.2.1.1.1

22+ AcrValues string

23+ ApprovalPrompt string // NOTE: Renamed to "prompt" in OAuth2

24+ ClientID string

25+ ClientSecret string

26+ ClientSecretFile string

23− Scope string

27+ Scope string

24− Prompt string

28+ Prompt string

25− ApprovalPrompt string

26}

29}

27

30

28// Data returns the ProviderData

31// Data returns the ProviderData

providers/provider_default.go+1

@@ -90,6 +90,7 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {

90 a = *p.LoginURL

91 params, _ := url.ParseQuery(a.RawQuery)

92 params.Set("redirect_uri", redirectURI)

93+ params.Add("acr_values", p.AcrValues)

93 if p.Prompt != "" {

94 if p.Prompt != "" {

94 params.Set("prompt", p.Prompt)

95 params.Set("prompt", p.Prompt)

95 } else { // Legacy variant of the prompt param:

96 } else { // Legacy variant of the prompt param: