@@ -88,35 +88,36 @@ type OAuthProxy struct {
8888 AuthOnlyPath string
8989 UserInfoPath string
9090
91− redirectURL *url.URL // the url to receive requests at
92− whitelistDomains []string
93− provider providers.Provider
94− providerNameOverride string
95− sessionStore sessionsapi.SessionStore
96− ProxyPrefix string
97− SignInMessage string
98− HtpasswdFile *HtpasswdFile
99− DisplayHtpasswdForm bool
100− serveMux http.Handler
101− SetXAuthRequest bool
102− PassBasicAuth bool
103− SetBasicAuth bool
104− SkipProviderButton bool
105− PassUserHeaders bool
106− BasicAuthPassword string
107− PassAccessToken bool
108− SetAuthorization bool
109− PassAuthorization bool
110− PreferEmailToUser bool
111− skipAuthRegex []string
112− skipAuthPreflight bool
113− skipJwtBearerTokens bool
114− jwtBearerVerifiers []*oidc.IDTokenVerifier
115− compiledRegex []*regexp.Regexp
116− templates *template.Template
117− realClientIPParser ipapi.RealClientIPParser
118− Banner string
119− Footer string
91+ redirectURL *url.URL // the url to receive requests at
92+ whitelistDomains []string
93+ provider providers.Provider
94+ providerNameOverride string
95+ sessionStore sessionsapi.SessionStore
96+ ProxyPrefix string
97+ SignInMessage string
98+ HtpasswdFile *HtpasswdFile
99+ DisplayHtpasswdForm bool
100+ serveMux http.Handler
101+ SetXAuthRequest bool
102+ PassBasicAuth bool
103+ SetBasicAuth bool
104+ SkipProviderButton bool
105+ PassUserHeaders bool
106+ BasicAuthPassword string
107+ PassAccessToken bool
108+ SetAuthorization bool
109+ PassAuthorization bool
110+ PreferEmailToUser bool
111+ skipAuthRegex []string
112+ skipAuthPreflight bool
113+ skipJwtBearerTokens bool
114+ mainJwtBearerVerifier *oidc.IDTokenVerifier
115+ extraJwtBearerVerifiers []*oidc.IDTokenVerifier
116+ compiledRegex []*regexp.Regexp
117+ templates *template.Template
118+ realClientIPParser ipapi.RealClientIPParser
119+ Banner string
120+ Footer string
120121}
121122
122123// UpstreamProxy represents an upstream server to proxy to
@@ -317,32 +318,33 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) *OAuthPro
317318 AuthOnlyPath: fmt.Sprintf("%s/auth", opts.ProxyPrefix),
318319 UserInfoPath: fmt.Sprintf("%s/userinfo", opts.ProxyPrefix),
319320
320− ProxyPrefix: opts.ProxyPrefix,
321− provider: opts.GetProvider(),
322− providerNameOverride: opts.ProviderName,
323− sessionStore: opts.GetSessionStore(),
324− serveMux: serveMux,
325− redirectURL: redirectURL,
326− whitelistDomains: opts.WhitelistDomains,
327− skipAuthRegex: opts.SkipAuthRegex,
328− skipAuthPreflight: opts.SkipAuthPreflight,
329− skipJwtBearerTokens: opts.SkipJwtBearerTokens,
330− jwtBearerVerifiers: opts.GetJWTBearerVerifiers(),
331− compiledRegex: opts.GetCompiledRegex(),
332− realClientIPParser: opts.GetRealClientIPParser(),
333− SetXAuthRequest: opts.SetXAuthRequest,
334− PassBasicAuth: opts.PassBasicAuth,
335− SetBasicAuth: opts.SetBasicAuth,
336− PassUserHeaders: opts.PassUserHeaders,
337− BasicAuthPassword: opts.BasicAuthPassword,
338− PassAccessToken: opts.PassAccessToken,
339− SetAuthorization: opts.SetAuthorization,
340− PassAuthorization: opts.PassAuthorization,
341− PreferEmailToUser: opts.PreferEmailToUser,
342− SkipProviderButton: opts.SkipProviderButton,
343− templates: loadTemplates(opts.CustomTemplatesDir),
344− Banner: opts.Banner,
345− Footer: opts.Footer,
321+ ProxyPrefix: opts.ProxyPrefix,
322+ provider: opts.GetProvider(),
323+ providerNameOverride: opts.ProviderName,
324+ sessionStore: opts.GetSessionStore(),
325+ serveMux: serveMux,
326+ redirectURL: redirectURL,
327+ whitelistDomains: opts.WhitelistDomains,
328+ skipAuthRegex: opts.SkipAuthRegex,
329+ skipAuthPreflight: opts.SkipAuthPreflight,
330+ skipJwtBearerTokens: opts.SkipJwtBearerTokens,
331+ mainJwtBearerVerifier: opts.GetOIDCVerifier(),
332+ extraJwtBearerVerifiers: opts.GetJWTBearerVerifiers(),
333+ compiledRegex: opts.GetCompiledRegex(),
334+ realClientIPParser: opts.GetRealClientIPParser(),
335+ SetXAuthRequest: opts.SetXAuthRequest,
336+ PassBasicAuth: opts.PassBasicAuth,
337+ SetBasicAuth: opts.SetBasicAuth,
338+ PassUserHeaders: opts.PassUserHeaders,
339+ BasicAuthPassword: opts.BasicAuthPassword,
340+ PassAccessToken: opts.PassAccessToken,
341+ SetAuthorization: opts.SetAuthorization,
342+ PassAuthorization: opts.PassAuthorization,
343+ PreferEmailToUser: opts.PreferEmailToUser,
344+ SkipProviderButton: opts.SkipProviderButton,
345+ templates: loadTemplates(opts.CustomTemplatesDir),
346+ Banner: opts.Banner,
347+ Footer: opts.Footer,
346348 }
347349}
348350
@@ -1139,15 +1141,24 @@ func (p *OAuthProxy) GetJwtSession(req *http.Request) (*sessionsapi.SessionState
11391141 return nil, err
11401142 }
11411143
1142− for _, verifier := range p.jwtBearerVerifiers {
1143− bearerToken, err := verifier.Verify(req.Context(), rawBearerToken)
1144+ // If we are using an oidc provider, go ahead and try that provider first with its Verifier
1145+ // and Bearer Token -> Session converter
1146+ if p.mainJwtBearerVerifier != nil {
1147+ bearerToken, err := p.mainJwtBearerVerifier.Verify(req.Context(), rawBearerToken)
1148+ if err == nil {
1149+ return p.provider.CreateSessionStateFromBearerToken(req.Context(), rawBearerToken, bearerToken)
1150+ }
1151+ }
11441152
1153+ // Otherwise, attempt to verify against the extra JWT issuers and use a more generic
1154+ // Bearer Token -> Session converter
1155+ for _, verifier := range p.extraJwtBearerVerifiers {
1156+ bearerToken, err := verifier.Verify(req.Context(), rawBearerToken)
11451157 if err != nil {
1146− logger.Printf("failed to verify bearer token: %v", err)
11471158 continue
11481159 }
11491160
1150− return p.provider.CreateSessionStateFromBearerToken(req.Context(), rawBearerToken, bearerToken)
1161+ return (*providers.ProviderData)(nil).CreateSessionStateFromBearerToken(req.Context(), rawBearerToken, bearerToken)
11511162 }
11521163 return nil, fmt.Errorf("unable to verify jwt token %s", req.Header.Get("Authorization"))
11531164}