git.iko.soy/typeable/oauth2-proxy
on master help sign in
disable email validation; rename email-domain argument

This adds a "*" option to --email-domain to disable email validation, and this renames `--google-apps-domain` to `--email-domain` for clarity across providers

commit56d19b1c8417702184666b8d713ff5a4ec6f207f authorJehiah Czebotar <jehiah@gmail.com> dateSat 6 Jun 2015, 14:37 (11 years ago) parentc5ccd43
6 files changed+25−15
compare with master
unifiedsplit
README.md+3−3 contrib/oauth2_proxy.cfg.example+4−2 main.go+8−8 oauthproxy.go+1−1 options.go+1−1 validator.go+8
README.md+3−3
@@ -55,7 +55,7 @@ For Google, the registration steps are:
55551. Create a new project: https://github.com/settings/developers
56562. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`
5757
58−The GitHub auth provider supports two additional parameters to restrict authentication to Organization or Team level access.
58+The GitHub auth provider supports two additional parameters to restrict authentication to Organization or Team level access. Restricting by org and team is normally accompanied with `--email-domain=*`
5959
6060 -github-org="": restrict logins to members of this organisation
6161 -github-team="": restrict logins to members of this team
@@ -102,9 +102,9 @@ Usage of oauth2_proxy:
102102 -cookie-secure=true: set secure (HTTPS) cookie flag
103103 -custom-templates-dir="": path to custom html templates
104104 -display-htpasswd-form=true: display username / password login form if an htpasswd file is provided
105+ -email-domain=: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email
105106 -github-org="": restrict logins to members of this organisation
106107 -github-team="": restrict logins to members of this team
107− -google-apps-domain=: authenticate against the given Google apps domain (may be given multiple times)
108108 -htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
109109 -http-address="127.0.0.1:4180": [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients
110110 -login-url="": Authentication endpoint
@@ -163,7 +163,7 @@ The command line to run `oauth2_proxy` would look like this:
163163
164164```bash
165165./oauth2_proxy \
166− --google-apps-domain="yourcompany.com" \
166+ --email-domain="yourcompany.com" \
167167 --upstream=http://127.0.0.1:8080/ \
168168 --cookie-secret=... \
169169 --cookie-secure=true \
contrib/oauth2_proxy.cfg.example+4−2
@@ -22,8 +22,10 @@
2222## when disabled the upstream Host is used as the Host Header
2323# pass_host_header = true
2424
25−## Email Domains to allow authentication for (this whitelists any email on this domain)
26−# google_apps_domains = [
25+## Email Domains to allow authentication for (this authorizes any email on this domain)
26+## for more granular authorization use `authenticated_emails_file`
27+## To authorize any email addresses use "*"
28+# email_domains = [
2729# "yourcompany.com"
2830# ]
2931
main.go+8−8
@@ -20,7 +20,7 @@ func main() {
2020 log.SetFlags(log.Ldate | log.Ltime | log.Lshortfile)
2121 flagSet := flag.NewFlagSet("oauth2_proxy", flag.ExitOnError)
2222
23− googleAppsDomains := StringArray{}
23+ emailDomains := StringArray{}
2424 upstreams := StringArray{}
2525 skipAuthRegex := StringArray{}
2626
@@ -35,7 +35,7 @@ func main() {
3535 flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")
3636 flagSet.Var(&skipAuthRegex, "skip-auth-regex", "bypass authentication for requests path's that match (may be given multiple times)")
3737
38− flagSet.Var(&googleAppsDomains, "google-apps-domain", "authenticate against the given Google apps domain (may be given multiple times)")
38+ flagSet.Var(&emailDomains, "email-domain", "authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email")
3939 flagSet.String("github-org", "", "restrict logins to members of this organisation")
4040 flagSet.String("github-team", "", "restrict logins to members of this team")
4141 flagSet.String("client-id", "", "the OAuth Client ID: ie: \"123456.apps.googleusercontent.com\"")
@@ -89,14 +89,14 @@ func main() {
8989 os.Exit(1)
9090 }
9191
92− validator := NewValidator(opts.GoogleAppsDomains, opts.AuthenticatedEmailsFile)
92+ validator := NewValidator(opts.EmailDomains, opts.AuthenticatedEmailsFile)
9393 oauthproxy := NewOauthProxy(opts, validator)
9494
95− if len(opts.GoogleAppsDomains) != 0 && opts.AuthenticatedEmailsFile == "" {
96− if len(opts.GoogleAppsDomains) > 1 {
97− oauthproxy.SignInMessage = fmt.Sprintf("Authenticate using one of the following domains: %v", strings.Join(opts.GoogleAppsDomains, ", "))
98− } else {
99− oauthproxy.SignInMessage = fmt.Sprintf("Authenticate using %v", opts.GoogleAppsDomains[0])
95+ if len(opts.EmailDomains) != 0 && opts.AuthenticatedEmailsFile == "" {
96+ if len(opts.EmailDomains) > 1 {
97+ oauthproxy.SignInMessage = fmt.Sprintf("Authenticate using one of the following domains: %v", strings.Join(opts.EmailDomains, ", "))
98+ } else if opts.EmailDomains[0] != "*" {
99+ oauthproxy.SignInMessage = fmt.Sprintf("Authenticate using %v", opts.EmailDomains[0])
100100 }
101101 }
102102
oauthproxy.go+1−1
@@ -450,7 +450,7 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
450450 value, err := buildCookieValue(
451451 email, p.AesCipher, access_token)
452452 if err != nil {
453− log.Printf(err.Error())
453+ log.Printf("%s", err)
454454 }
455455 p.SetCookie(rw, req, value)
456456 http.Redirect(rw, req, redirect, 302)
options.go+1−1
@@ -19,7 +19,7 @@ type Options struct {
1919 ClientSecret string `flag:"client-secret" cfg:"client_secret" env:"OAUTH2_PROXY_CLIENT_SECRET"`
2020
2121 AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`
22− GoogleAppsDomains []string `flag:"google-apps-domain" cfg:"google_apps_domains"`
22+ EmailDomains []string `flag:"email-domain" cfg:"email_domains"`
2323 GitHubOrg string `flag:"github-org" cfg:"github_org"`
2424 GitHubTeam string `flag:"github-team" cfg:"github_team"`
2525 HtpasswdFile string `flag:"htpasswd-file" cfg:"htpasswd_file"`
validator.go+8
@@ -62,7 +62,12 @@ func newValidatorImpl(domains []string, usersFile string,
6262 done <-chan bool, onUpdate func()) func(string) bool {
6363 validUsers := NewUserMap(usersFile, done, onUpdate)
6464
65+ var allowAll bool
6566 for i, domain := range domains {
67+ if domain == "*" {
68+ allowAll = true
69+ continue
70+ }
6671 domains[i] = fmt.Sprintf("@%s", strings.ToLower(domain))
6772 }
6873
@@ -75,6 +80,9 @@ func newValidatorImpl(domains []string, usersFile string,
7580 if !valid {
7681 valid = validUsers.IsValid(email)
7782 }
83+ if allowAll {
84+ valid = true
85+ }
7886 log.Printf("validating: is %s valid? %v", email, valid)
7987 return valid
8088 }