@@ -1,12 +1,26 @@
1# Vx.x.x (Pre-release)
1# Vx.x.x (Pre-release)
3+## Changes since v4.0.0
8+- Documentation is now on a [microsite](https://pusher.github.io/oauth2_proxy/)
9+- Health check logging can now be disabled for quieter logs
10+- Authorization Header JWTs can now be verified by the proxy to skip authentication for machine users
11+- Sessions can now be stored in Redis. This reduces refresh failures and uses smaller cookies (Recommended for those using OIDC refreshing)
12+- Logging overhaul allows customisable logging formats
15+- This release includes a number of breaking changes that will require users to
16+reconfigure their proxies. Please read the Breaking Changes below thoroughly.
3## Breaking Changes
18## Breaking Changes
5−- [#231](https://github.com/pusher/oauth2_proxy/pull/231) Rework GitLab provider (@Overv)
20+- [#231](https://github.com/pusher/oauth2_proxy/pull/231) Rework GitLab provider
6 - This PR changes the configuration options for the GitLab provider to use
21 - This PR changes the configuration options for the GitLab provider to use
7 a self-hosted instance. You now need to specify a `-oidc-issuer-url` rather than
22 a self-hosted instance. You now need to specify a `-oidc-issuer-url` rather than
8 explicit `-login-url`, `-redeem-url` and `-validate-url` parameters.
23 explicit `-login-url`, `-redeem-url` and `-validate-url` parameters.
10- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent
24- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent
11 - This PR changes configuration options so that all flags have a config counterpart
25 - This PR changes configuration options so that all flags have a config counterpart
12 of the same name but with underscores (`_`) in place of hyphens (`-`).
26 of the same name but with underscores (`_`) in place of hyphens (`-`).
@@ -23,8 +37,7 @@
23 This change affects the following existing environment variables:
37 This change affects the following existing environment variables:
24 - The `OAUTH2_SKIP_OIDC_DISCOVERY` environment variable is now `OAUTH2_PROXY_SKIP_OIDC_DISCOVERY`.
38 - The `OAUTH2_SKIP_OIDC_DISCOVERY` environment variable is now `OAUTH2_PROXY_SKIP_OIDC_DISCOVERY`.
25 - The `OAUTH2_OIDC_JWKS_URL` environment variable is now `OAUTH2_PROXY_OIDC_JWKS_URL`.
39 - The `OAUTH2_OIDC_JWKS_URL` environment variable is now `OAUTH2_PROXY_OIDC_JWKS_URL`.
27−- [#146](https://github.com/pusher/oauth2_proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field (@gargath)
40+- [#146](https://github.com/pusher/oauth2_proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field
28 - This change modifies the contents of the `X-Forwarded-User` header supplied by the proxy for users where the auth response from the IdP did not contain
41 - This change modifies the contents of the `X-Forwarded-User` header supplied by the proxy for users where the auth response from the IdP did not contain
29 a username.
42 a username.
30 In that case, this header used to only contain the local part of the user's email address (e.g. `john.doe` for `john.doe@example.com`) but now contains
43 In that case, this header used to only contain the local part of the user's email address (e.g. `john.doe` for `john.doe@example.com`) but now contains
@@ -45,7 +58,7 @@
45- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)
58- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)
46- [#187](https://github.com/pusher/oauth2_proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)
59- [#187](https://github.com/pusher/oauth2_proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)
47- [#65](https://github.com/pusher/oauth2_proxy/pull/65) Improvements to authenticate requests with a JWT bearer token in the `Authorization` header via
60- [#65](https://github.com/pusher/oauth2_proxy/pull/65) Improvements to authenticate requests with a JWT bearer token in the `Authorization` header via
48− the `-skip-jwt-bearer-token` options.
61+ the `-skip-jwt-bearer-token` options. (@brianv0)
49 - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL
62 - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL
50 (e.g. `https://example.com/.well-known/jwks.json`).
63 (e.g. `https://example.com/.well-known/jwks.json`).
51- [#180](https://github.com/pusher/oauth2_proxy/pull/180) Minor refactor of core proxying path (@aeijdenberg).
64- [#180](https://github.com/pusher/oauth2_proxy/pull/180) Minor refactor of core proxying path (@aeijdenberg).
@@ -86,7 +99,6 @@
86 - Implement two new flags to customize the logging format
99 - Implement two new flags to customize the logging format
87 - `-standard-logging-format` Sets the format for standard logging
100 - `-standard-logging-format` Sets the format for standard logging
88 - `-auth-logging-format` Sets the format for auth logging
101 - `-auth-logging-format` Sets the format for auth logging
90- [#111](https://github.com/pusher/oauth2_proxy/pull/111) Add option for telling where to find a login.gov JWT key file (@timothy-spencer)
102- [#111](https://github.com/pusher/oauth2_proxy/pull/111) Add option for telling where to find a login.gov JWT key file (@timothy-spencer)
91- [#170](https://github.com/pusher/oauth2_proxy/pull/170) Restore binary tarball contents to be compatible with bitlys original tarballs (@zeha)
103- [#170](https://github.com/pusher/oauth2_proxy/pull/170) Restore binary tarball contents to be compatible with bitlys original tarballs (@zeha)
92- [#185](https://github.com/pusher/oauth2_proxy/pull/185) Fix an unsupported protocol scheme error during token validation when using the Azure provider (@jonas)
104- [#185](https://github.com/pusher/oauth2_proxy/pull/185) Fix an unsupported protocol scheme error during token validation when using the Azure provider (@jonas)
@@ -94,7 +106,7 @@
94 - Google Group membership is additionally checked via email address, allowing users outside a GSuite domain to be authorized.
106 - Google Group membership is additionally checked via email address, allowing users outside a GSuite domain to be authorized.
95- [#195](https://github.com/pusher/oauth2_proxy/pull/195) Add `-banner` flag for overriding the banner line that is displayed (@steakunderscore)
107- [#195](https://github.com/pusher/oauth2_proxy/pull/195) Add `-banner` flag for overriding the banner line that is displayed (@steakunderscore)
96- [#198](https://github.com/pusher/oauth2_proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)
108- [#198](https://github.com/pusher/oauth2_proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)
97−- [#159](https://github.com/pusher/oauth2_proxy/pull/159) Add option to skip the OIDC provider verified email check: `--insecure-oidc-allow-unverified-email`
109+- [#159](https://github.com/pusher/oauth2_proxy/pull/159) Add option to skip the OIDC provider verified email check: `--insecure-oidc-allow-unverified-email` (@djfinlay)
98- [#210](https://github.com/pusher/oauth2_proxy/pull/210) Update base image from Alpine 3.9 to 3.10 (@steakunderscore)
110- [#210](https://github.com/pusher/oauth2_proxy/pull/210) Update base image from Alpine 3.9 to 3.10 (@steakunderscore)
99- [#201](https://github.com/pusher/oauth2_proxy/pull/201) Add Bitbucket as new OAuth2 provider, accepts email, team and repository permissions to determine authorization (@aledeganopix4d)
111- [#201](https://github.com/pusher/oauth2_proxy/pull/201) Add Bitbucket as new OAuth2 provider, accepts email, team and repository permissions to determine authorization (@aledeganopix4d)
100 - Implement flags to enable Bitbucket authentication:
112 - Implement flags to enable Bitbucket authentication: