git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix merge problems and test cases

Signed-off-by: Jan Larwig <jan@larwig.com>

commit48bd2d7d3824682ce94b1aabb16f8e7e149c1961 authorJan Larwig <jan@larwig.com> dateFri 25 Jul 2025, 15:08 (1 year ago) parent810f629
9 files changed+56−25
compare with master
unifiedsplit
main.go+1−1 main_test.go+8−8 pkg/apis/options/header.go+1−1 pkg/apis/options/duration.go → pkg/apis/options/hooks.go+14 pkg/apis/options/duration_test.go → pkg/apis/options/hooks_test.go+15−1 pkg/apis/options/load.go+4−1 pkg/apis/options/load_test.go+2−2 pkg/apis/options/providers.go+6−6 pkg/apis/options/upstreams.go+5−5
main.go+1−1
@@ -70,7 +70,7 @@ func main() {
7070func loadConfiguration(config, yamlConfig string, extraFlags *pflag.FlagSet, args []string) (*options.Options, error) {
7171 opts, err := loadLegacyOptions(config, extraFlags, args)
7272 if err != nil {
73− return nil, fmt.Errorf("couldn't load legacy options: %w", err)
73+ return nil, fmt.Errorf("failed to load legacy options: %w", err)
7474 }
7575
7676 if yamlConfig != "" {
main_test.go+8−8
@@ -22,7 +22,7 @@ var _ = Describe("Configuration Loading Suite", func() {
2222http_address="127.0.0.1:4180"
2323upstreams="http://httpbin"
2424set_basic_auth="true"
25−basic_auth_password="super-secret-password"
25+basic_auth_password="c3VwZXItc2VjcmV0LXBhc3N3b3Jk"
2626client_id="oauth2-proxy"
2727client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
2828`
@@ -45,7 +45,7 @@ injectRequestHeaders:
4545 claim: user
4646 prefix: "Basic "
4747 basicAuthPassword:
48− value: super-secret-password
48+ value: c3VwZXItc2VjcmV0LXBhc3N3b3Jk
4949- name: X-Forwarded-Groups
5050 values:
5151 - claimSource:
@@ -69,12 +69,12 @@ injectResponseHeaders:
6969 claim: user
7070 prefix: "Basic "
7171 basicAuthPassword:
72− value: super-secret-password
72+ value: c3VwZXItc2VjcmV0LXBhc3N3b3Jk
7373server:
7474 bindAddress: "127.0.0.1:4180"
7575providers:
76−- provider: google
77− ID: google=oauth2-proxy
76+- id: google=oauth2-proxy
77+ provider: google
7878 clientSecret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK
7979 clientID: oauth2-proxy
8080 azureConfig:
@@ -139,7 +139,7 @@ redirect_url="http://localhost:4180/oauth2/callback"
139139 Claim: "user",
140140 Prefix: "Basic ",
141141 BasicAuthPassword: &options.SecretSource{
142− Value: []byte("super-secret-password"),
142+ Value: []byte("c3VwZXItc2VjcmV0LXBhc3N3b3Jk"),
143143 },
144144 },
145145 },
@@ -248,7 +248,7 @@ redirect_url="http://localhost:4180/oauth2/callback"
248248 Entry("with bad legacy configuration", loadConfigurationTableInput{
249249 configContent: testCoreConfig + "unknown_field=\"something\"",
250250 expectedOptions: func() *options.Options { return nil },
251− expectedErr: errors.New("failed to load config: error unmarshalling config: decoding failed due to the following error(s):\n\n'' has invalid keys: unknown_field"),
251+ expectedErr: errors.New("failed to load legacy options: failed to load config: error unmarshalling config: decoding failed due to the following error(s):\n\n'' has invalid keys: unknown_field"),
252252 }),
253253 Entry("with bad alpha configuration", loadConfigurationTableInput{
254254 configContent: testCoreConfig,
@@ -260,7 +260,7 @@ redirect_url="http://localhost:4180/oauth2/callback"
260260 configContent: testCoreConfig + "unknown_field=\"something\"",
261261 alphaConfigContent: testAlphaConfig,
262262 expectedOptions: func() *options.Options { return nil },
263− expectedErr: errors.New("failed to load core options: failed to load config: error unmarshalling config: decoding failed due to the following error(s):\n\n'' has invalid keys: unknown_field"),
263+ expectedErr: errors.New("failed to load legacy options: failed to load config: error unmarshalling config: decoding failed due to the following error(s):\n\n'' has invalid keys: unknown_field"),
264264 }),
265265 )
266266})
pkg/apis/options/header.go+1−1
@@ -11,7 +11,7 @@ type Header struct {
1111 // should be preserved for the request to the upstream server.
1212 // This option only applies to injected request headers.
1313 // Defaults to false (headers that match this header will be stripped).
14− PreserveRequestValue bool `yaml:"preserveRequestValue,omitempty"`
14+ PreserveRequestValue bool `yaml:"preserveRequestValue"`
1515
1616 // InsecureSkipHeaderNormalization disables normalizing the header name
1717 // According to RFC 7230 Section 3.2 there aren't any rules about
pkg/apis/options/duration.go → pkg/apis/options/hooks.gorenamed+14
@@ -41,3 +41,17 @@ func toDurationHookFunc() mapstructure.DecodeHookFunc {
4141 }
4242 }
4343}
44+
45+// StringToBytesHookFunc returns a DecodeHookFunc that converts string to []byte.
46+func stringToBytesHookFunc() mapstructure.DecodeHookFunc {
47+ return func(
48+ f reflect.Type,
49+ t reflect.Type,
50+ data interface{},
51+ ) (interface{}, error) {
52+ if f.Kind() == reflect.String && t == reflect.TypeOf([]byte{}) {
53+ return []byte(data.(string)), nil
54+ }
55+ return data, nil
56+ }
57+}
pkg/apis/options/duration_test.go → pkg/apis/options/hooks_test.gorenamed+15−1
@@ -5,7 +5,7 @@ import (
55 "time"
66)
77
8−func TestDecode(t *testing.T) {
8+func TestToDurationHook(t *testing.T) {
99 type result struct {
1010 Duration time.Duration `yaml:"duration"`
1111 }
@@ -80,3 +80,17 @@ func TestDecode(t *testing.T) {
8080 })
8181 }
8282}
83+
84+func TestStringToBytesHook(t *testing.T) {
85+ var result struct {
86+ Value []byte `yaml:"value"`
87+ }
88+
89+ if err := Decode(map[string]interface{}{"value": "hello-world"}, &result); err != nil {
90+ t.Fatal(err)
91+ }
92+
93+ if string(result.Value) != "hello-world" {
94+ t.Errorf("expected %q, got %q", "hello-world", string(result.Value))
95+ }
96+}
pkg/apis/options/load.go+4−1
@@ -89,7 +89,10 @@ func LoadYAML(configFileName string, opts interface{}) error {
8989// - An error if decoding fails or if there are unmapped keys.
9090func Decode(input interface{}, result interface{}) error {
9191 decoder, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
92− DecodeHook: mapstructure.ComposeDecodeHookFunc(toDurationHookFunc()),
92+ DecodeHook: mapstructure.ComposeDecodeHookFunc(
93+ toDurationHookFunc(),
94+ stringToBytesHookFunc(),
95+ ),
9396 Metadata: nil, // Don't track any metadata
9497 Result: result, // Decode the result into the prefilled options
9598 TagName: "yaml", // Parse all fields that use the json tag
pkg/apis/options/load_test.go+2−2
@@ -155,7 +155,7 @@ var _ = Describe("Load", func() {
155155 }
156156 err := Load(configFileName, flagSet, input)
157157 if o.expectedErr != nil {
158− Expect(err).To(MatchError(o.expectedErr.Error()))
158+ Expect(err).To(MatchError(ContainSubstring(o.expectedErr.Error())))
159159 } else {
160160 Expect(err).ToNot(HaveOccurred())
161161 }
@@ -471,7 +471,7 @@ sub:
471471 configFile: []byte(`stringSliceOption: "a"`),
472472 input: &TestOptions{},
473473 expectedOutput: &TestOptions{},
474− expectedErr: errors.New("error unmarshalling config: error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string into Go struct field TestOptions.TestOptionSubStruct.StringSliceOption of type []string"),
474+ expectedErr: errors.New("error decoding config: decoding failed due to the following error(s):\n\n'stringSliceOption' source data must be an array or slice, got string"),
475475 }),
476476 Entry("with a config file containing environment variable references", loadYAMLTableInput{
477477 configFile: []byte("stringOption: ${TESTUSER}"),
pkg/apis/options/providers.go+6−6
@@ -67,7 +67,7 @@ type Provider struct {
6767 CAFiles []string `yaml:"caFiles,omitempty"`
6868 // UseSystemTrustStore determines if your custom CA files and the system trust store are used
6969 // If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files.
70− UseSystemTrustStore bool `yaml:"useSystemTrustStore,omitempty"`
70+ UseSystemTrustStore bool `yaml:"useSystemTrustStore"`
7171 // LoginURL is the authentication endpoint
7272 LoginURL string `yaml:"loginURL,omitempty"`
7373 // LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL
@@ -80,7 +80,7 @@ type Provider struct {
8080 ProfileURL string `yaml:"profileURL,omitempty"`
8181 // SkipClaimsFromProfileURL allows to skip request to Profile URL for resolving claims not present in id_token
8282 // default set to 'false'
83− SkipClaimsFromProfileURL bool `yaml:"skipClaimsFromProfileURL,omitempty"`
83+ SkipClaimsFromProfileURL bool `yaml:"skipClaimsFromProfileURL"`
8484 // ProtectedResource is the resource that is protected (Azure AD and ADFS only)
8585 ProtectedResource string `yaml:"resource,omitempty"`
8686 // ValidateURL is the access token validation endpoint
@@ -181,13 +181,13 @@ type MicrosoftEntraIDOptions struct {
181181
182182 // FederatedTokenAuth enable oAuth2 client authentication with federated token projected
183183 // by Entra Workload Identity plugin, instead of client secret.
184− FederatedTokenAuth bool `yaml:"federatedTokenAuth,omitempty"`
184+ FederatedTokenAuth bool `yaml:"federatedTokenAuth"`
185185}
186186
187187type ADFSOptions struct {
188188 // Skip adding the scope parameter in login request
189189 // Default value is 'false'
190− SkipScope bool `yaml:"skipScope,omitempty"`
190+ SkipScope bool `yaml:"skipScope"`
191191}
192192
193193type BitbucketOptions struct {
@@ -227,7 +227,7 @@ type GoogleOptions struct {
227227 // ServiceAccountJSON is the path to the service account json credentials
228228 ServiceAccountJSON string `yaml:"serviceAccountJson,omitempty"`
229229 // UseApplicationDefaultCredentials is a boolean whether to use Application Default Credentials instead of a ServiceAccountJSON
230− UseApplicationDefaultCredentials bool `yaml:"useApplicationDefaultCredentials,omitempty"`
230+ UseApplicationDefaultCredentials bool `yaml:"useApplicationDefaultCredentials"`
231231 // TargetPrincipal is the Google Service Account used for Application Default Credentials
232232 TargetPrincipal string `yaml:"targetPrincipal,omitempty"`
233233 // UseOrganizationId indicates whether to use the organization ID as the UserName claim
@@ -254,7 +254,7 @@ type OIDCOptions struct {
254254 InsecureSkipNonce bool `yaml:"insecureSkipNonce"`
255255 // SkipDiscovery allows to skip OIDC discovery and use manually supplied Endpoints
256256 // default set to 'false'
257− SkipDiscovery bool `yaml:"skipDiscovery,omitempty"`
257+ SkipDiscovery bool `yaml:"skipDiscovery"`
258258 // JwksURL is the OpenID Connect JWKS URL
259259 // eg: https://www.googleapis.com/oauth2/v3/certs
260260 JwksURL string `yaml:"jwksURL,omitempty"`
pkg/apis/options/upstreams.go+5−5
@@ -14,7 +14,7 @@ const (
1414type UpstreamConfig struct {
1515 // ProxyRawPath will pass the raw url path to upstream allowing for urls
1616 // like: "/%2F/" which would otherwise be redirected to "/"
17− ProxyRawPath bool `yaml:"proxyRawPath,omitempty"`
17+ ProxyRawPath bool `yaml:"proxyRawPath"`
1818
1919 // Upstreams represents the configuration for the upstream servers.
2020 // Requests will be proxied to this upstream if the path matches the request path.
@@ -64,13 +64,13 @@ type Upstream struct {
6464 // This option is insecure and will allow potential Man-In-The-Middle attacks
6565 // between OAuth2 Proxy and the upstream server.
6666 // Defaults to false.
67− InsecureSkipTLSVerify bool `yaml:"insecureSkipTLSVerify,omitempty"`
67+ InsecureSkipTLSVerify bool `yaml:"insecureSkipTLSVerify"`
6868
6969 // Static will make all requests to this upstream have a static response.
7070 // The response will have a body of "Authenticated" and a response code
7171 // matching StaticCode.
7272 // If StaticCode is not set, the response will return a 200 response.
73− Static bool `yaml:"static,omitempty"`
73+ Static bool `yaml:"static"`
7474
7575 // StaticCode determines the response code for the Static response.
7676 // This option can only be used with Static enabled.
@@ -84,11 +84,11 @@ type Upstream struct {
8484 // PassHostHeader determines whether the request host header should be proxied
8585 // to the upstream server.
8686 // Defaults to true.
87− PassHostHeader *bool `yaml:"passHostHeader,omitempty"`
87+ PassHostHeader *bool `yaml:"passHostHeader"`
8888
8989 // ProxyWebSockets enables proxying of websockets to upstream servers
9090 // Defaults to true.
91− ProxyWebSockets *bool `yaml:"proxyWebSockets,omitempty"`
91+ ProxyWebSockets *bool `yaml:"proxyWebSockets"`
9292
9393 // Timeout is the maximum duration the server will wait for a response from the upstream server.
9494 // Defaults to 30 seconds.