49e124e · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge branch 'master' into typo-fix

49e124eDan Bond7 years ago

CHANGELOG.md+1

@@ -96,6 +96,7 @@

96- [#159](https://github.com/pusher/oauth2_proxy/pull/159) Add option to skip the OIDC provider verified email check: `--insecure-oidc-allow-unverified-email`

97- [#210](https://github.com/pusher/oauth2_proxy/pull/210) Update base image from Alpine 3.9 to 3.10 (@steakunderscore)

98- [#211](https://github.com/pusher/oauth2_proxy/pull/211) Switch from dep to go modules (@steakunderscore)

99+- [#145](https://github.com/pusher/oauth2_proxy/pull/145) Add support for OIDC UserInfo endpoint email verification (@rtluckie)

100

100# v3.2.0

101# v3.2.0

101

102

providers/oidc.go+35−2

@@ -3,10 +3,13 @@ package providers

3import (

4 "context"

5 "fmt"

6+ "net/http"

6 "time"

7 "time"

8 oidc "github.com/coreos/go-oidc"

9 oidc "github.com/coreos/go-oidc"

9 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

10 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

11+ "github.com/pusher/oauth2_proxy/pkg/requests"

12+

10 "golang.org/x/oauth2"

13 "golang.org/x/oauth2"

11)

14)

@@ -117,8 +120,31 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok

117 }

120 }

118

121

119 if claims.Email == "" {

122 if claims.Email == "" {

120− // TODO: Try getting email from /userinfo before falling back to Subject

123+ if p.ProfileURL.String() == "" {

124+ return nil, fmt.Errorf("id_token did not contain an email")

125+ }

126+

127+ // If the userinfo endpoint profileURL is defined, then there is a chance the userinfo

128+ // contents at the profileURL contains the email.

129+ // Make a query to the userinfo endpoint, and attempt to locate the email from there.

130+

131+ req, err := http.NewRequest("GET", p.ProfileURL.String(), nil)

132+ if err != nil {

133+ return nil, err

134+ }

135+ req.Header = getOIDCHeader(token.AccessToken)

136+

137+ respJSON, err := requests.Request(req)

138+ if err != nil {

139+ return nil, err

140+ }

141+

142+ email, err := respJSON.Get("email").String()

143+ if err != nil {

144+ return nil, fmt.Errorf("Neither id_token nor userinfo endpoint contained an email")

145+ }

146+

121− claims.Email = claims.Subject

147+ claims.Email = email

122 }

148 }

123 if !p.AllowUnverifiedEmail && claims.Verified != nil && !*claims.Verified {

149 if !p.AllowUnverifiedEmail && claims.Verified != nil && !*claims.Verified {

124 return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)

150 return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)

@@ -145,3 +171,10 @@ func (p *OIDCProvider) ValidateSessionState(s *sessions.SessionState) bool {

145

171

146 return true

172 return true

147}

173}

174+

175+func getOIDCHeader(accessToken string) http.Header {

176+ header := make(http.Header)

177+ header.Set("Accept", "application/json")

178+ header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))

179+ return header

180+}