git.iko.soy/typeable/oauth2-proxy
on master help sign in
Self code review changes
37c415bMisterWil
main.go+2−2
compare with master
unifiedsplit
@@ -20,7 +20,7 @@ func main() {
20 flagSet := flag.NewFlagSet("oauth2_proxy", flag.ExitOnError)
20 flagSet := flag.NewFlagSet("oauth2_proxy", flag.ExitOnError)
21
21
22 emailDomains := StringArray{}
22 emailDomains := StringArray{}
23− whitelistandardomains := StringArray{}
23+ whitelistDomains := StringArray{}
24 upstreams := StringArray{}
24 upstreams := StringArray{}
25 skipAuthRegex := StringArray{}
25 skipAuthRegex := StringArray{}
26 googleGroups := StringArray{}
26 googleGroups := StringArray{}
@@ -49,7 +49,7 @@ func main() {
49 flagSet.Duration("flush-interval", time.Duration(1)*time.Second, "period between response flushing when streaming responses")
49 flagSet.Duration("flush-interval", time.Duration(1)*time.Second, "period between response flushing when streaming responses")
50
50
51 flagSet.Var(&emailDomains, "email-domain", "authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email")
51 flagSet.Var(&emailDomains, "email-domain", "authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email")
52− flagSet.Var(&whitelistandardomains, "whitelist-domain", "allowed domains for redirection after authentication. Prefix domain with a . to allow subdomains (eg .example.com)")
52+ flagSet.Var(&whitelistDomains, "whitelist-domain", "allowed domains for redirection after authentication. Prefix domain with a . to allow subdomains (eg .example.com)")
53 flagSet.String("azure-tenant", "common", "go to a tenant-specific or common (tenant-independent) endpoint.")
53 flagSet.String("azure-tenant", "common", "go to a tenant-specific or common (tenant-independent) endpoint.")
54 flagSet.String("github-org", "", "restrict logins to members of this organisation")
54 flagSet.String("github-org", "", "restrict logins to members of this organisation")
55 flagSet.String("github-team", "", "restrict logins to members of this team")
55 flagSet.String("github-team", "", "restrict logins to members of this team")
oauthproxy.go+13−13
@@ -604,10 +604,10 @@ func (p *OAuthProxy) ManualSignIn(rw http.ResponseWriter, req *http.Request) (st
604 }
604 }
605 // check auth
605 // check auth
606 if p.HtpasswdFile.Validate(user, passwd) {
606 if p.HtpasswdFile.Validate(user, passwd) {
607− logger.PrintAuthf(user, req, logger.AuthSuccess, "Successful authentication via HtpasswdFile")
607+ logger.PrintAuthf(user, req, logger.AuthSuccess, "Authenticated via HtpasswdFile")
608 return user, true
608 return user, true
609 }
609 }
610− logger.PrintAuthf(user, req, logger.AuthFailure, "Failed authentication via HtpasswdFile; unauthorized")
610+ logger.PrintAuthf(user, req, logger.AuthFailure, "Invalid authentication via HtpasswdFile")
611 return "", false
611 return "", false
612}
612}
613
613
@@ -755,27 +755,27 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
755 // finish the oauth cycle
755 // finish the oauth cycle
756 err := req.ParseForm()
756 err := req.ParseForm()
757 if err != nil {
757 if err != nil {
758− logger.Printf("Error while parsing OAuth callback: %s" + err.Error())
758+ logger.Printf("Error while parsing OAuth2 callback: %s" + err.Error())
759 p.ErrorPage(rw, 500, "Internal Error", err.Error())
759 p.ErrorPage(rw, 500, "Internal Error", err.Error())
760 return
760 return
761 }
761 }
762 errorString := req.Form.Get("error")
762 errorString := req.Form.Get("error")
763 if errorString != "" {
763 if errorString != "" {
764− logger.Printf("Error while parsing OAuth callback: %s ", errorString)
764+ logger.Printf("Error while parsing OAuth2 callback: %s ", errorString)
765 p.ErrorPage(rw, 403, "Permission Denied", errorString)
765 p.ErrorPage(rw, 403, "Permission Denied", errorString)
766 return
766 return
767 }
767 }
768
768
769 session, err := p.redeemCode(req.Host, req.Form.Get("code"))
769 session, err := p.redeemCode(req.Host, req.Form.Get("code"))
770 if err != nil {
770 if err != nil {
771− logger.Printf("Error while parsing OAuth callback: %s ", errorString)
771+ logger.Printf("Error redeeming code during OAuth2 callback: %s ", errorString)
772 p.ErrorPage(rw, 500, "Internal Error", "Internal Error")
772 p.ErrorPage(rw, 500, "Internal Error", "Internal Error")
773 return
773 return
774 }
774 }
775
775
776 s := strings.SplitN(req.Form.Get("state"), ":", 2)
776 s := strings.SplitN(req.Form.Get("state"), ":", 2)
777 if len(s) != 2 {
777 if len(s) != 2 {
778− logger.Printf("Error while parsing OAuth state; invalid length")
778+ logger.Printf("Error while parsing OAuth2 state; invalid length")
779 p.ErrorPage(rw, 500, "Internal Error", "Invalid State")
779 p.ErrorPage(rw, 500, "Internal Error", "Invalid State")
780 return
780 return
781 }
781 }
@@ -783,13 +783,13 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
783 redirect := s[1]
783 redirect := s[1]
784 c, err := req.Cookie(p.CSRFCookieName)
784 c, err := req.Cookie(p.CSRFCookieName)
785 if err != nil {
785 if err != nil {
786− logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Failed authentication via oauth2; unable too obtain CSRF cookie")
786+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2; unable too obtain CSRF cookie")
787 p.ErrorPage(rw, 403, "Permission Denied", err.Error())
787 p.ErrorPage(rw, 403, "Permission Denied", err.Error())
788 return
788 return
789 }
789 }
790 p.ClearCSRFCookie(rw, req)
790 p.ClearCSRFCookie(rw, req)
791 if c.Value != nonce {
791 if c.Value != nonce {
792− logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Failed authentication via oauth2; csrf token mismatch, potential attack")
792+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Invalid authentication via OAuth2; csrf token mismatch, potential attack")
793 p.ErrorPage(rw, 403, "Permission Denied", "csrf failed")
793 p.ErrorPage(rw, 403, "Permission Denied", "csrf failed")
794 return
794 return
795 }
795 }
@@ -800,7 +800,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
800
800
801 // set cookie, or deny
801 // set cookie, or deny
802 if p.Validator(session.Email) && p.provider.ValidateGroup(session.Email) {
802 if p.Validator(session.Email) && p.provider.ValidateGroup(session.Email) {
803− logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Successful authentication via oauth2; %s", session)
803+ logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Authenticated via OAuth2; %s", session)
804 err := p.SaveSession(rw, req, session)
804 err := p.SaveSession(rw, req, session)
805 if err != nil {
805 if err != nil {
806 logger.Printf("%s %s", remoteAddr, err)
806 logger.Printf("%s %s", remoteAddr, err)
@@ -809,7 +809,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
809 }
809 }
810 http.Redirect(rw, req, redirect, 302)
810 http.Redirect(rw, req, redirect, 302)
811 } else {
811 } else {
812− logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Failed authentication via oauth2; unauthorized")
812+ logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Invalid authentication via OAuth2; unauthorized")
813 p.ErrorPage(rw, 403, "Permission Denied", "Invalid Account")
813 p.ErrorPage(rw, 403, "Permission Denied", "Invalid Account")
814 }
814 }
815}
815}
@@ -885,7 +885,7 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int
885 }
885 }
886
886
887 if session != nil && session.Email != "" && !p.Validator(session.Email) {
887 if session != nil && session.Email != "" && !p.Validator(session.Email) {
888− logger.Printf(session.Email, req, logger.AuthFailure, "Failed authentication via session; removing session %s", session)
888+ logger.Printf(session.Email, req, logger.AuthFailure, "Invalid authentication via session; removing session %s", session)
889 session = nil
889 session = nil
890 saveSession = false
890 saveSession = false
891 clearSession = true
891 clearSession = true
@@ -979,10 +979,10 @@ func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*providers.SessionState,
979 return nil, fmt.Errorf("invalid format %s", b)
979 return nil, fmt.Errorf("invalid format %s", b)
980 }
980 }
981 if p.HtpasswdFile.Validate(pair[0], pair[1]) {
981 if p.HtpasswdFile.Validate(pair[0], pair[1]) {
982− logger.PrintAuthf(pair[0], req, logger.AuthSuccess, "Successful authentication via basic auth")
982+ logger.PrintAuthf(pair[0], req, logger.AuthSuccess, "Authenticated via basic auth and HTpasswd File")
983 return &providers.SessionState{User: pair[0]}, nil
983 return &providers.SessionState{User: pair[0]}, nil
984 }
984 }
985− logger.PrintAuthf(pair[0], req, logger.AuthFailure, "Failed authentication via basic auth; not in Htpasswd file")
985+ logger.PrintAuthf(pair[0], req, logger.AuthFailure, "Invalid authentication via basic auth; not in Htpasswd File")
986 return nil, fmt.Errorf("%s not in HtpasswdFile", pair[0])
986 return nil, fmt.Errorf("%s not in HtpasswdFile", pair[0])
987}
987}
988
988