git.iko.soy/typeable/oauth2-proxy
on master help sign in
ACR values should not be automatically added when blank (#598)

* ACR values should not be automatically added when blank * Added changelog

commit3aeca4368c3c9f4d1f02af8c662c39c679a7fc96 authorScott Guymer <scott@scottguymer.co.uk> dateTue 2 Jun 2020, 19:17 (6 years ago) parentd8d43bb
3 files changed+32−1
CHANGELOG.md+1 providers/provider_default.go+3−1 providers/provider_default_test.go+28
CHANGELOG.md+1
@@ -55,6 +55,7 @@
5555
5656## Changes since v5.1.1
5757
58+- [#598](https://github.com/oauth2-proxy/oauth2-proxy/pull/598) acr_values no longer sent to IdP when empty (@ScottGuymer)
5859- [#548](https://github.com/oauth2-proxy/oauth2-proxy/pull/548) Separate logging options out of main options structure (@JoelSpeed)
5960- [#536](https://github.com/oauth2-proxy/oauth2-proxy/pull/536) Improvements to Session State code (@JoelSpeed)
6061- [#573](https://github.com/oauth2-proxy/oauth2-proxy/pull/573) Properly parse redis urls for cluster and sentinel connections (@amnay-mo)
providers/provider_default.go+3−1
@@ -94,7 +94,9 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {
9494 a := *p.LoginURL
9595 params, _ := url.ParseQuery(a.RawQuery)
9696 params.Set("redirect_uri", redirectURI)
97− params.Add("acr_values", p.AcrValues)
97+ if p.AcrValues != "" {
98+ params.Add("acr_values", p.AcrValues)
99+ }
98100 if p.Prompt != "" {
99101 params.Set("prompt", p.Prompt)
100102 } else { // Legacy variant of the prompt param:
providers/provider_default_test.go+28
@@ -2,6 +2,7 @@ package providers
22
33import (
44 "context"
5+ "net/url"
56 "testing"
67 "time"
78
@@ -19,3 +20,30 @@ func TestRefresh(t *testing.T) {
1920 assert.Equal(t, false, refreshed)
2021 assert.Equal(t, nil, err)
2122}
23+
24+func TestAcrValuesNotConfigured(t *testing.T) {
25+ p := &ProviderData{
26+ LoginURL: &url.URL{
27+ Scheme: "http",
28+ Host: "my.test.idp",
29+ Path: "/oauth/authorize",
30+ },
31+ }
32+
33+ result := p.GetLoginURL("https://my.test.app/oauth", "")
34+ assert.NotContains(t, result, "acr_values")
35+}
36+
37+func TestAcrValuesConfigured(t *testing.T) {
38+ p := &ProviderData{
39+ LoginURL: &url.URL{
40+ Scheme: "http",
41+ Host: "my.test.idp",
42+ Path: "/oauth/authorize",
43+ },
44+ AcrValues: "testValue",
45+ }
46+
47+ result := p.GetLoginURL("https://my.test.app/oauth", "")
48+ assert.Contains(t, result, "acr_values=testValue")
49+}