git.iko.soy/typeable/oauth2-proxy
on master help sign in
Add keycloak-oidc provider based on OIDCProvider
commit4c0beb373f0dfe9ddc428b98cd5bad2513983654 authorNick Meves <nick.meves@greenhouse.io> dateSun 14 Mar 2021, 10:20 (6 years ago) parent8967873
4 files changed+89
compare with master
unifiedsplit
pkg/validation/options.go+4 providers/keycloak_oidc.go+41 providers/keycloak_oidc_test.go+42 providers/providers.go+2
pkg/validation/options.go+4
@@ -247,6 +247,10 @@ func parseProviderInfo(o *options.Options, msgs []string) []string {
247247 if len(o.Providers[0].KeycloakConfig.Groups) > 0 {
248248 p.SetAllowedGroups(o.Providers[0].KeycloakConfig.Groups)
249249 }
250+ case *providers.KeycloakOIDCProvider:
251+ if p.Verifier == nil {
252+ msgs = append(msgs, "keycloak-oidc provider requires an oidc issuer URL")
253+ }
250254 case *providers.GoogleProvider:
251255 if o.Providers[0].GoogleConfig.ServiceAccountJSON != "" {
252256 file, err := os.Open(o.Providers[0].GoogleConfig.ServiceAccountJSON)
providers/keycloak_oidc.gonew file+41
@@ -0,0 +1,41 @@
1+package providers
2+
3+import (
4+ "context"
5+
6+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
7+)
8+
9+const keycloakOIDCProviderName = "Keycloak OIDC"
10+
11+// KeycloakOIDCProvider creates a Keycloak provider based on OIDCProvider
12+type KeycloakOIDCProvider struct {
13+ *OIDCProvider
14+}
15+
16+// NewKeycloakOIDCProvider makes a KeycloakOIDCProvider using the ProviderData
17+func NewKeycloakOIDCProvider(p *ProviderData) *KeycloakOIDCProvider {
18+ p.ProviderName = keycloakOIDCProviderName
19+ return &KeycloakOIDCProvider{
20+ OIDCProvider: &OIDCProvider{
21+ ProviderData: p,
22+ },
23+ }
24+}
25+
26+var _ Provider = (*KeycloakOIDCProvider)(nil)
27+
28+// EnrichSession is called after Redeem to allow providers to enrich session fields
29+// such as User, Email, Groups with provider specific API calls.
30+func (p *KeycloakOIDCProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
31+ err := p.OIDCProvider.EnrichSession(ctx, s)
32+ if err != nil {
33+ return err
34+ }
35+ return p.extractRoles(ctx, s)
36+}
37+
38+func (p *KeycloakOIDCProvider) extractRoles(ctx context.Context, s *sessions.SessionState) error {
39+ // TODO: Implement me with Access Token Role claim extraction logic
40+ return ErrNotImplemented
41+}
providers/keycloak_oidc_test.gonew file+42
@@ -0,0 +1,42 @@
1+package providers
2+
3+import (
4+ "net/url"
5+
6+ . "github.com/onsi/ginkgo"
7+ . "github.com/onsi/gomega"
8+)
9+
10+var _ = Describe("Keycloak OIDC Provider Tests", func() {
11+ Context("New Provider Init", func() {
12+ It("uses the passed ProviderData", func() {
13+ p := NewKeycloakOIDCProvider(
14+ &ProviderData{
15+ LoginURL: &url.URL{
16+ Scheme: "https",
17+ Host: "keycloak-oidc.com",
18+ Path: "/oauth/auth"},
19+ RedeemURL: &url.URL{
20+ Scheme: "https",
21+ Host: "keycloak-oidc.com",
22+ Path: "/oauth/token"},
23+ ProfileURL: &url.URL{
24+ Scheme: "https",
25+ Host: "keycloak-oidc.com",
26+ Path: "/api/v3/user"},
27+ ValidateURL: &url.URL{
28+ Scheme: "https",
29+ Host: "keycloak-oidc.com",
30+ Path: "/api/v3/user"},
31+ Scope: "openid email profile"})
32+ providerData := p.Data()
33+
34+ Expect(providerData.ProviderName).To(Equal(keycloakOIDCProviderName))
35+ Expect(providerData.LoginURL.String()).To(Equal("https://keycloak-oidc.com/oauth/auth"))
36+ Expect(providerData.RedeemURL.String()).To(Equal("https://keycloak-oidc.com/oauth/token"))
37+ Expect(providerData.ProfileURL.String()).To(Equal("https://keycloak-oidc.com/api/v3/user"))
38+ Expect(providerData.ValidateURL.String()).To(Equal("https://keycloak-oidc.com/api/v3/user"))
39+ Expect(providerData.Scope).To(Equal("openid email profile"))
40+ })
41+ })
42+})
providers/providers.go+2
@@ -31,6 +31,8 @@ func New(provider string, p *ProviderData) Provider {
3131 return NewGitHubProvider(p)
3232 case "keycloak":
3333 return NewKeycloakProvider(p)
34+ case "keycloak-oidc":
35+ return NewKeycloakOIDCProvider(p)
3436 case "azure":
3537 return NewAzureProvider(p)
3638 case "adfs":