4e10cc7 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

Add silence ping logging flag using ExcludePath

4e10cc7Karl Skewes7 years ago

docs/configuration/configuration.md+3−1

compare with master

unifiedsplit

@@ -74,6 +74,7 @@ Usage of oauth2_proxy:

74 -pass-user-headers: pass X-Forwarded-User and X-Forwarded-Email information to upstream (default true)

75 -profile-url string: Profile access endpoint

76 -provider string: OAuth provider (default "google")

77+ -ping-path string: the ping endpoint that can be used for basic health checks (default "/ping")

77 -proxy-prefix string: the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in) (default "/oauth2")

78 -proxy-prefix string: the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in) (default "/oauth2")

78 -proxy-websockets: enables WebSocket proxying (default true)

79 -proxy-websockets: enables WebSocket proxying (default true)

79 -pubjwk-url string: JWK pubkey access endpoint: required by login.gov

80 -pubjwk-url string: JWK pubkey access endpoint: required by login.gov

@@ -91,6 +92,7 @@ Usage of oauth2_proxy:

91 -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)

92 -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)

92 -set-authorization-header: set Authorization Bearer response header (useful in Nginx auth_request mode)

93 -set-authorization-header: set Authorization Bearer response header (useful in Nginx auth_request mode)

93 -signature-key string: GAP-Signature request signature key (algorithm:secretkey)

94 -signature-key string: GAP-Signature request signature key (algorithm:secretkey)

95+ -silence-ping-logging bool: disable logging of requests to ping endpoint (default false)

94 -skip-auth-preflight: will skip authentication for OPTIONS requests

96 -skip-auth-preflight: will skip authentication for OPTIONS requests

95 -skip-auth-regex value: bypass authentication for requests path's that match (may be given multiple times)

97 -skip-auth-regex value: bypass authentication for requests path's that match (may be given multiple times)

96 -skip-jwt-bearer-tokens: will skip requests that have verified JWT bearer tokens

98 -skip-jwt-bearer-tokens: will skip requests that have verified JWT bearer tokens

@@ -140,7 +142,7 @@ There are three different types of logging: standard, authentication, and HTTP r

140

142

141Each type of logging has their own configurable format and variables. By default these formats are similar to the Apache Combined Log.

143Each type of logging has their own configurable format and variables. By default these formats are similar to the Apache Combined Log.

142

144

143−A specific path can be excluded from request logs by setting `-exclude-logging-path`. This is useful for disabling logging of requests to the `/ping` endpoint to reduce log volume when health checking `oauth2_proxy`.

145+Logging of requests to the `/ping` endpoint can be disabled with `-silence-ping-logging` reducing log volume. This flag sets the `-exclude-logging-path` value to the `-ping-path` and takes precedence over any other value `-exclude-logging-path` may have been set to directly.

144

146

145### Auth Log Format

147### Auth Log Format

146Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:

148Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:

main.go+2

@@ -69,6 +69,7 @@ func main() {

69 flagSet.String("banner", "", "custom banner string. Use \"-\" to disable default banner.")

70 flagSet.String("footer", "", "custom footer string. Use \"-\" to disable default footer.")

71 flagSet.String("proxy-prefix", "/oauth2", "the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)")

72+ flagSet.String("ping-path", "/ping", "the ping endpoint that can be used for basic health checks")

72 flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")

73 flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")

74 flagSet.String("cookie-name", "_oauth2_proxy", "the name of the cookie that the oauth_proxy creates")

75 flagSet.String("cookie-name", "_oauth2_proxy", "the name of the cookie that the oauth_proxy creates")

@@ -99,6 +100,7 @@ func main() {

99 flagSet.Bool("request-logging", true, "Log HTTP requests")

100 flagSet.Bool("request-logging", true, "Log HTTP requests")

100 flagSet.String("request-logging-format", logger.DefaultRequestLoggingFormat, "Template for HTTP request log lines")

101 flagSet.String("request-logging-format", logger.DefaultRequestLoggingFormat, "Template for HTTP request log lines")

101 flagSet.String("exclude-logging-path", "", "Exclude logging requests to path (eg: /ping)")

102 flagSet.String("exclude-logging-path", "", "Exclude logging requests to path (eg: /ping)")

103+ flagSet.Bool("silence-ping-logging", false, "Disable logging of requests to ping endpoint")

102

104

103 flagSet.Bool("auth-logging", true, "Log authentication attempts")

105 flagSet.Bool("auth-logging", true, "Log authentication attempts")

104 flagSet.String("auth-logging-format", logger.DefaultAuthLoggingFormat, "Template for authentication log lines")

106 flagSet.String("auth-logging-format", logger.DefaultAuthLoggingFormat, "Template for authentication log lines")

oauthproxy.go+1−1

@@ -254,7 +254,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

254 Validator: validator,

255

256 RobotsPath: "/robots.txt",

257− PingPath: "/ping",

257+ PingPath: opts.PingPath,

258 SignInPath: fmt.Sprintf("%s/sign_in", opts.ProxyPrefix),

259 SignOutPath: fmt.Sprintf("%s/sign_out", opts.ProxyPrefix),

260 OAuthStartPath: fmt.Sprintf("%s/start", opts.ProxyPrefix),

options.go+9−4

@@ -30,6 +30,7 @@ import (

30// or Config File

31type Options struct {

32 ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix" env:"OAUTH2_PROXY_PROXY_PREFIX"`

33+ PingPath string `flag:"ping-path" cfg:"ping-path" env:"OAUTH2_PROXY_PING_PATH"`

33 ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets" env:"OAUTH2_PROXY_PROXY_WEBSOCKETS"`

34 ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets" env:"OAUTH2_PROXY_PROXY_WEBSOCKETS"`

34 HTTPAddress string `flag:"http-address" cfg:"http_address" env:"OAUTH2_PROXY_HTTP_ADDRESS"`

35 HTTPAddress string `flag:"http-address" cfg:"http_address" env:"OAUTH2_PROXY_HTTP_ADDRESS"`

35 HTTPSAddress string `flag:"https-address" cfg:"https_address" env:"OAUTH2_PROXY_HTTPS_ADDRESS"`

36 HTTPSAddress string `flag:"https-address" cfg:"https_address" env:"OAUTH2_PROXY_HTTPS_ADDRESS"`

@@ -103,9 +104,8 @@ type Options struct {

103 StandardLoggingFormat string `flag:"standard-logging-format" cfg:"standard_logging_format" env:"OAUTH2_PROXY_STANDARD_LOGGING_FORMAT"`

104 StandardLoggingFormat string `flag:"standard-logging-format" cfg:"standard_logging_format" env:"OAUTH2_PROXY_STANDARD_LOGGING_FORMAT"`

104 RequestLogging bool `flag:"request-logging" cfg:"request_logging" env:"OAUTH2_PROXY_REQUEST_LOGGING"`

105 RequestLogging bool `flag:"request-logging" cfg:"request_logging" env:"OAUTH2_PROXY_REQUEST_LOGGING"`

105 RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_PROXY_REQUEST_LOGGING_FORMAT"`

106 RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_PROXY_REQUEST_LOGGING_FORMAT"`

106− PingPath string `flag:"ping-path" cfg:"ping_path" env:"OAUTH2_PROXY_PING_PATH"`

107− SilencePingLogging bool `flag:"silence-ping-logging" cfg:"silence_ping_logging" env:"OAUTH2_PROXY_SILENCE_PING_LOGGING"`

108 ExcludeLoggingPath string `flag:"exclude-logging-path" cfg:"exclude_logging_path" env:"OAUTH2_PROXY_EXCLUDE_LOGGING_PATH"`

107 ExcludeLoggingPath string `flag:"exclude-logging-path" cfg:"exclude_logging_path" env:"OAUTH2_PROXY_EXCLUDE_LOGGING_PATH"`

108+ SilencePingLogging bool `flag:"silence-ping-logging" cfg:"silence_ping_logging" env:"OAUTH2_PROXY_SILENCE_PING_LOGGING"`

109 AuthLogging bool `flag:"auth-logging" cfg:"auth_logging" env:"OAUTH2_PROXY_LOGGING_AUTH_LOGGING"`

110 AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format" env:"OAUTH2_PROXY_AUTH_LOGGING_FORMAT"`

111 SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`

@@ -136,6 +136,7 @@ type SignatureData struct {

136func NewOptions() *Options {

137 return &Options{

138 ProxyPrefix: "/oauth2",

139+ PingPath: "/ping",

139 ProxyWebSockets: true,

140 ProxyWebSockets: true,

140 HTTPAddress: "127.0.0.1:4180",

141 HTTPAddress: "127.0.0.1:4180",

141 HTTPSAddress: ":443",

142 HTTPSAddress: ":443",

@@ -168,7 +169,6 @@ func NewOptions() *Options {

168 LoggingLocalTime: true,

169 LoggingLocalTime: true,

169 LoggingCompress: false,

170 LoggingCompress: false,

170 ExcludeLoggingPath: "",

171 ExcludeLoggingPath: "",

171− PingPath: "/ping",

172 SilencePingLogging: false,

173 StandardLogging: true,

174 StandardLoggingFormat: logger.DefaultStandardLoggingFormat,

@@ -572,11 +572,16 @@ func setupLogger(o *Options, msgs []string) []string {

572 logger.SetStandardEnabled(o.StandardLogging)

573 logger.SetAuthEnabled(o.AuthLogging)

574 logger.SetReqEnabled(o.RequestLogging)

575− logger.SetExcludePath(o.ExcludeLoggingPath)

576 logger.SetStandardTemplate(o.StandardLoggingFormat)

575 logger.SetStandardTemplate(o.StandardLoggingFormat)

577 logger.SetAuthTemplate(o.AuthLoggingFormat)

576 logger.SetAuthTemplate(o.AuthLoggingFormat)

578 logger.SetReqTemplate(o.RequestLoggingFormat)

577 logger.SetReqTemplate(o.RequestLoggingFormat)

579

578

579+ if o.SilencePingLogging {

580+ logger.SetExcludePath(o.PingPath)

581+ } else {

582+ logger.SetExcludePath(o.ExcludeLoggingPath)

583+ }

584+

580 if !o.LoggingLocalTime {

585 if !o.LoggingLocalTime {

581 logger.SetFlags(logger.Flags() | logger.LUTC)

586 logger.SetFlags(logger.Flags() | logger.LUTC)

582 }

587 }