@@ -412,6 +412,7 @@ func TestBasicAuthPassword(t *testing.T) {
412412 opts.CookieSecure = false
413413 opts.PassBasicAuth = true
414414 opts.PassUserHeaders = true
415+ opts.PreferEmailToUser = true
415416 opts.BasicAuthPassword = "This is a secure password"
416417 opts.Validate()
417418
@@ -466,6 +467,69 @@ func TestBasicAuthPassword(t *testing.T) {
466467 providerServer.Close()
467468}
468469
470+func TestBasicAuthWithEmail(t *testing.T) {
471+ opts := NewOptions()
472+ opts.PassBasicAuth = true
473+ opts.PassUserHeaders = false
474+ opts.PreferEmailToUser = false
475+ opts.BasicAuthPassword = "This is a secure password"
476+ opts.Validate()
477+
478+ const emailAddress = "john.doe@example.com"
479+ const userName = "9fcab5c9b889a557"
480+
481+ // The username in the basic auth credentials is expected to be equal to the email address from the
482+ expectedEmailHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte(emailAddress+":"+opts.BasicAuthPassword))
483+ expectedUserHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte(userName+":"+opts.BasicAuthPassword))
484+
485+ session := &sessions.SessionState{
486+ User: userName,
487+ Email: emailAddress,
488+ AccessToken: "oauth_token",
489+ CreatedAt: time.Now(),
490+ }
491+ {
492+ rw := httptest.NewRecorder()
493+ req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase0", nil)
494+ proxy := NewOAuthProxy(opts, func(email string) bool {
495+ return email == emailAddress
496+ })
497+ proxy.addHeadersForProxying(rw, req, session)
498+ assert.Equal(t, expectedUserHeader, req.Header["Authorization"][0])
499+ assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
500+ }
501+
502+ opts.PreferEmailToUser = true
503+ {
504+ rw := httptest.NewRecorder()
505+ req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase1", nil)
506+
507+ proxy := NewOAuthProxy(opts, func(email string) bool {
508+ return email == emailAddress
509+ })
510+ proxy.addHeadersForProxying(rw, req, session)
511+ assert.Equal(t, expectedEmailHeader, req.Header["Authorization"][0])
512+ assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
513+ }
514+
515+ opts.PassUserHeaders = true
516+ {
517+ // PassUserHeaders takes predecense over the headers added by
518+ // PassBasicAuth, thus we expect them to contain something else.
519+ rw := httptest.NewRecorder()
520+ req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase2", nil)
521+ proxy := NewOAuthProxy(opts, func(email string) bool {
522+ return email == emailAddress
523+ })
524+
525+ proxy.addHeadersForProxying(rw, req, session)
526+ // The user address here should still be an email.
527+ assert.Equal(t, expectedEmailHeader, req.Header["Authorization"][0])
528+ assert.Equal(t, emailAddress, req.Header["X-Forwarded-Email"][0])
529+ assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
530+ }
531+}
532+
469533type PassAccessTokenTest struct {
470534 providerServer *httptest.Server
471535 proxy *OAuthProxy