4eefc01 · typeable/oauth2-proxy

CHANGELOG.md+1

@@ -62,6 +62,7 @@

62- [#185](https://github.com/pusher/oauth2_proxy/pull/185) Fix an unsupported protocol scheme error during token validation when using the Azure provider (@jonas)

63- [#141](https://github.com/pusher/oauth2_proxy/pull/141) Check google group membership based on email address (@bchess)

64 - Google Group membership is additionally checked via email address, allowing users outside a GSuite domain to be authorized.

65+- [#195](https://github.com/pusher/outh2_proxy/pull/195) Add `-banner` flag for overriding the banner line that is displayed (@steakunderscore)

65- [#198](https://github.com/pusher/outh2_proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)

66- [#198](https://github.com/pusher/outh2_proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)

66

67

67# v3.2.0

68# v3.2.0

docs/configuration/configuration.md+1

@@ -43,6 +43,7 @@ Usage of oauth2_proxy:

43 -email-domain value: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email

44 -extra-jwt-issuers: if -skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)

45 -flush-interval: period between flushing response buffers when streaming responses (default "1s")

46+ -banner string: custom banner string. Use "-" to disable default banner.

46 -footer string: custom footer string. Use "-" to disable default footer.

47 -footer string: custom footer string. Use "-" to disable default footer.

47 -gcp-healthchecks: will enable /liveness_check, /readiness_check, and / (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses (default false)

48 -gcp-healthchecks: will enable /liveness_check, /readiness_check, and / (with the proper user-agent) endpoints that will make it work well with GCP App Engine and GKE Ingresses (default false)

48 -github-org string: restrict logins to members of this organisation

49 -github-org string: restrict logins to members of this organisation

main.go+8−1

@@ -66,6 +66,7 @@ func main() {

66 flagSet.String("htpasswd-file", "", "additionally authenticate against a htpasswd file. Entries must be created with \"htpasswd -s\" for SHA encryption or \"htpasswd -B\" for bcrypt encryption")

67 flagSet.Bool("display-htpasswd-form", true, "display username / password login form if an htpasswd file is provided")

68 flagSet.String("custom-templates-dir", "", "path to custom html templates")

69+ flagSet.String("banner", "", "custom banner string. Use \"-\" to disable default banner.")

69 flagSet.String("footer", "", "custom footer string. Use \"-\" to disable default footer.")

70 flagSet.String("footer", "", "custom footer string. Use \"-\" to disable default footer.")

70 flagSet.String("proxy-prefix", "/oauth2", "the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)")

71 flagSet.String("proxy-prefix", "/oauth2", "the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)")

71 flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")

72 flagSet.Bool("proxy-websockets", true, "enables WebSocket proxying")

@@ -148,7 +149,13 @@ func main() {

148 validator := NewValidator(opts.EmailDomains, opts.AuthenticatedEmailsFile)

149 validator := NewValidator(opts.EmailDomains, opts.AuthenticatedEmailsFile)

149 oauthproxy := NewOAuthProxy(opts, validator)

150 oauthproxy := NewOAuthProxy(opts, validator)

150

151

152+ if len(opts.Banner) >= 1 {

153+ if opts.Banner == "-" {

154+ oauthproxy.SignInMessage = ""

155+ } else {

156+ oauthproxy.SignInMessage = opts.Banner

157+ }

151− if len(opts.EmailDomains) != 0 && opts.AuthenticatedEmailsFile == "" {

158+ } else if len(opts.EmailDomains) != 0 && opts.AuthenticatedEmailsFile == "" {

152 if len(opts.EmailDomains) > 1 {

159 if len(opts.EmailDomains) > 1 {

153 oauthproxy.SignInMessage = fmt.Sprintf("Authenticate using one of the following domains: %v", strings.Join(opts.EmailDomains, ", "))

160 oauthproxy.SignInMessage = fmt.Sprintf("Authenticate using one of the following domains: %v", strings.Join(opts.EmailDomains, ", "))

154 } else if opts.EmailDomains[0] != "*" {

161 } else if opts.EmailDomains[0] != "*" {

oauthproxy.go+2

@@ -98,6 +98,7 @@ type OAuthProxy struct {

98 jwtBearerVerifiers []*oidc.IDTokenVerifier

99 compiledRegex []*regexp.Regexp

100 templates *template.Template

101+ Banner string

101 Footer string

102 Footer string

102}

103}

103

104

@@ -280,6 +281,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

280 PassAuthorization: opts.PassAuthorization,

281 PassAuthorization: opts.PassAuthorization,

281 SkipProviderButton: opts.SkipProviderButton,

282 SkipProviderButton: opts.SkipProviderButton,

282 templates: loadTemplates(opts.CustomTemplatesDir),

283 templates: loadTemplates(opts.CustomTemplatesDir),

284+ Banner: opts.Banner,

283 Footer: opts.Footer,

285 Footer: opts.Footer,

284 }

286 }

285}

287}

options.go+1

@@ -51,6 +51,7 @@ type Options struct {

51 HtpasswdFile string `flag:"htpasswd-file" cfg:"htpasswd_file" env:"OAUTH2_PROXY_HTPASSWD_FILE"`

52 DisplayHtpasswdForm bool `flag:"display-htpasswd-form" cfg:"display_htpasswd_form" env:"OAUTH2_PROXY_DISPLAY_HTPASSWD_FORM"`

53 CustomTemplatesDir string `flag:"custom-templates-dir" cfg:"custom_templates_dir" env:"OAUTH2_PROXY_CUSTOM_TEMPLATES_DIR"`

54+ Banner string `flag:"banner" cfg:"banner" env:"OAUTH2_PROXY_BANNER"`

54 Footer string `flag:"footer" cfg:"footer" env:"OAUTH2_PROXY_FOOTER"`

55 Footer string `flag:"footer" cfg:"footer" env:"OAUTH2_PROXY_FOOTER"`

55

56

56 // Embed CookieOptions

57 // Embed CookieOptions