git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge branch 'master' into go-mod
commit56f51417ae70cfeb10b161082508a3d3931b8038 authorHenry Jenkins <henry@henryjenkins.name> dateMon 15 Jul 2019, 16:08 (7 years ago) parent179ee6cd7e88a4
40 files changed+125−110
compare with master
unifiedsplit
CHANGELOG.md+23−3 Dockerfile+1−1 Dockerfile.arm64+1−1 Dockerfile.armv6+1−1 docs/configuration/configuration.md+8−11 htpasswd.go+1−1 http.go+1−1 logging_handler.go+1−1 logging_handler_test.go+1−1 main.go+1−1 oauthproxy.go+3−3 oauthproxy_test.go+1−1 options.go+21−21 pkg/apis/options/sessions.go+2−4 pkg/apis/sessions/session_state.go+4−4 pkg/apis/sessions/session_state_test.go+7−7 pkg/cookies/cookies.go+1−1 cookie/cookies.go → pkg/encryption/cipher.go+1−1 cookie/cookies_test.go → pkg/encryption/cipher_test.go+1−1 cookie/nonce.go → pkg/encryption/nonce.go+1−1 logger/logger.go → pkg/logger/logger.go api/api.go → pkg/requests/requests.go+2−2 api/api_test.go → pkg/requests/requests_test.go+1−1 pkg/sessions/cookie/session_store.go+4−4 pkg/sessions/redis/redis_store.go+6−6 pkg/sessions/session_store_test.go+3−3 pkg/sessions/utils/utils.go+3−3 providers/azure.go+3−3 providers/facebook.go+2−2 providers/github.go+1−1 providers/gitlab.go+3−3 providers/google.go+1−1 providers/internal_util.go+3−3 providers/linkedin.go+2−2 providers/provider_default.go+3−3 providers/providers.go+3−3 templates.go+1−1 validator.go+1−1 watcher.go+1−1 watcher_unsupported.go+1−1
CHANGELOG.md+23−3
@@ -2,6 +2,23 @@
22
33## Breaking Changes
44
5+- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent
6+ - This PR changes configuration options so that all flags have a config counterpart
7+ of the same name but with underscores (`_`) in place of hyphens (`-`).
8+ This change affects the following flags:
9+ - The `--tls-key` flag is now `--tls-key-file` to be consistent with existing
10+ file flags and the existing config and environment settings
11+ - The `--tls-cert` flag is now `--tls-cert-file` to be consistent with existing
12+ file flags and the existing config and environment settings
13+ This change affects the following existing configuration options:
14+ - The `proxy-prefix` option is now `proxy_prefix`.
15+ This PR changes environment variables so that all flags have an environment
16+ counterpart of the same name but capitalised, with underscores (`_`) in place
17+ of hyphens (`-`) and with the prefix `OAUTH2_PROXY_`.
18+ This change affects the following existing environment variables:
19+ - The `OAUTH2_SKIP_OIDC_DISCOVERY` environment variable is now `OAUTH2_PROXY_SKIP_OIDC_DISCOVERY`.
20+ - The `OAUTH2_OIDC_JWKS_URL` environment variable is now `OAUTH2_PROXY_OIDC_JWKS_URL`.
21+
522- [#146](https://github.com/pusher/oauth2_proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field (@gargath)
623 - This change modifies the contents of the `X-Forwarded-User` header supplied by the proxy for users where the auth response from the IdP did not contain
724 a username.
@@ -14,9 +31,11 @@
1431
1532## Changes since v3.2.0
1633
34+- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)
35+- [#187](https://github.com/pusher/oauth2_proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)
1736- [#65](https://github.com/pusher/oauth2_proxy/pull/65) Improvements to authenticate requests with a JWT bearer token in the `Authorization` header via
18− the `-skip-jwt-bearer-token` options.
19− - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL
37+ the `-skip-jwt-bearer-token` options.
38+ - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL
2039 (e.g. `https://example.com/.well-known/jwks.json`).
2140- [#180](https://github.com/pusher/outh2_proxy/pull/180) Minor refactor of core proxying path (@aeijdenberg).
2241- [#175](https://github.com/pusher/outh2_proxy/pull/175) Bump go-oidc to v2.0.0 (@aeijdenberg).
@@ -29,7 +48,7 @@
2948 - `-redis-sentinel-master-name` Sets the Sentinel master name, if sentinel is enabled
3049 - `-redis-sentinel-connection-urls` Defines the Redis Sentinel Connection URLs, if sentinel is enabled
3150 - Introduces the concept of a session ticket. Tickets are composed of the cookie name, a session ID, and a secret.
32− - Redis Sessions are stored encrypted with a per-session secret
51+ - Redis Sessions are stored encrypted with a per-session secret
3352 - Added tests for server based session stores
3453- [#168](https://github.com/pusher/outh2_proxy/pull/168) Drop Go 1.11 support in Travis (@JoelSpeed)
3554- [#169](https://github.com/pusher/outh2_proxy/pull/169) Update Alpine to 3.9 (@kskewes)
@@ -65,6 +84,7 @@
6584- [#195](https://github.com/pusher/outh2_proxy/pull/195) Add `-banner` flag for overriding the banner line that is displayed (@steakunderscore)
6685- [#198](https://github.com/pusher/outh2_proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)
6786- [#159](https://github.com/pusher/oauth2_proxy/pull/159) Add option to skip the OIDC provider verified email check: `--insecure-oidc-allow-unverified-email`
87+- [#210](https://github.com/pusher/oauth2_proxy/pull/210) Update base image from Alpine 3.9 to 3.10 (@steakunderscore)
6888- [#211](https://github.com/pusher/oauth2_proxy/pull/211) Switch from dep to go modules (@steakunderscore)
6989
7090# v3.2.0
Dockerfile+1−1
@@ -19,7 +19,7 @@ RUN go mod download
1919RUN ./configure && make build && touch jwt_signing_key.pem
2020
2121# Copy binary to alpine
22−FROM alpine:3.9
22+FROM alpine:3.10
2323COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
2424COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/oauth2_proxy /bin/oauth2_proxy
2525COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
Dockerfile.arm64+1−1
@@ -19,7 +19,7 @@ RUN go mod download
1919RUN ./configure && GOARCH=arm64 make build && touch jwt_signing_key.pem
2020
2121# Copy binary to alpine
22−FROM arm64v8/alpine:3.9
22+FROM arm64v8/alpine:3.10
2323COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
2424COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/oauth2_proxy /bin/oauth2_proxy
2525COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
Dockerfile.armv6+1−1
@@ -19,7 +19,7 @@ RUN go mod download
1919RUN ./configure && GOARCH=arm GOARM=6 make build && touch jwt_signing_key.pem
2020
2121# Copy binary to alpine
22−FROM arm32v6/alpine:3.9
22+FROM arm32v6/alpine:3.10
2323COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
2424COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/oauth2_proxy /bin/oauth2_proxy
2525COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem
docs/configuration/configuration.md+8−11
@@ -120,17 +120,14 @@ Multiple upstreams can either be configured by supplying a comma separated list
120120
121121### Environment variables
122122
123−The following environment variables can be used in place of the corresponding command-line arguments:
124−
125−- `OAUTH2_PROXY_CLIENT_ID`
126−- `OAUTH2_PROXY_CLIENT_SECRET`
127−- `OAUTH2_PROXY_COOKIE_NAME`
128−- `OAUTH2_PROXY_COOKIE_SECRET`
129−- `OAUTH2_PROXY_COOKIE_DOMAIN`
130−- `OAUTH2_PROXY_COOKIE_PATH`
131−- `OAUTH2_PROXY_COOKIE_EXPIRE`
132−- `OAUTH2_PROXY_COOKIE_REFRESH`
133−- `OAUTH2_PROXY_SIGNATURE_KEY`
123+Every command line argument can be specified as an environment variable by
124+prefixing it with `OAUTH2_PROXY_`, capitalising it, and replacing hypens (`-`)
125+with underscores (`_`). This is particularly useful for storing secrets outside
126+of a configuration file or the command line.
127+
128+For example, the `--cookie-secret` flag becomes `OAUTH2_PROXY_COOKIE_SECRET` and
129+the `--set-authorization-header` flag becomes `OAUTH2_PROXY_SET_AUTHORIZATION_HEADER`.
130+
134131
135132## Logging Configuration
136133
htpasswd.go+1−1
@@ -7,7 +7,7 @@ import (
77 "io"
88 "os"
99
10− "github.com/pusher/oauth2_proxy/logger"
10+ "github.com/pusher/oauth2_proxy/pkg/logger"
1111 "golang.org/x/crypto/bcrypt"
1212)
1313
http.go+1−1
@@ -7,7 +7,7 @@ import (
77 "strings"
88 "time"
99
10− "github.com/pusher/oauth2_proxy/logger"
10+ "github.com/pusher/oauth2_proxy/pkg/logger"
1111)
1212
1313// Server represents an HTTP server
logging_handler.go+1−1
@@ -10,7 +10,7 @@ import (
1010 "net/http"
1111 "time"
1212
13− "github.com/pusher/oauth2_proxy/logger"
13+ "github.com/pusher/oauth2_proxy/pkg/logger"
1414)
1515
1616// responseLogger is wrapper of http.ResponseWriter that keeps track of its HTTP status
logging_handler_test.go+1−1
@@ -9,7 +9,7 @@ import (
99 "testing"
1010 "time"
1111
12− "github.com/pusher/oauth2_proxy/logger"
12+ "github.com/pusher/oauth2_proxy/pkg/logger"
1313)
1414
1515func TestLoggingHandler_ServeHTTP(t *testing.T) {
main.go+1−1
@@ -12,7 +12,7 @@ import (
1212
1313 "github.com/BurntSushi/toml"
1414 options "github.com/mreiferson/go-options"
15− "github.com/pusher/oauth2_proxy/logger"
15+ "github.com/pusher/oauth2_proxy/pkg/logger"
1616)
1717
1818func main() {
oauthproxy.go+3−3
@@ -16,9 +16,9 @@ import (
1616
1717 "github.com/coreos/go-oidc"
1818 "github.com/mbland/hmacauth"
19− "github.com/pusher/oauth2_proxy/cookie"
20− "github.com/pusher/oauth2_proxy/logger"
2119 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
20+ "github.com/pusher/oauth2_proxy/pkg/encryption"
21+ "github.com/pusher/oauth2_proxy/pkg/logger"
2222 "github.com/pusher/oauth2_proxy/providers"
2323 "github.com/yhat/wsutil"
2424)
@@ -584,7 +584,7 @@ func (p *OAuthProxy) SignOut(rw http.ResponseWriter, req *http.Request) {
584584
585585// OAuthStart starts the OAuth2 authentication flow
586586func (p *OAuthProxy) OAuthStart(rw http.ResponseWriter, req *http.Request) {
587− nonce, err := cookie.Nonce()
587+ nonce, err := encryption.Nonce()
588588 if err != nil {
589589 logger.Printf("Error obtaining nonce: %s", err.Error())
590590 p.ErrorPage(rw, 500, "Internal Error", err.Error())
oauthproxy_test.go+1−1
@@ -18,8 +18,8 @@ import (
1818
1919 "github.com/coreos/go-oidc"
2020 "github.com/mbland/hmacauth"
21− "github.com/pusher/oauth2_proxy/logger"
2221 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
22+ "github.com/pusher/oauth2_proxy/pkg/logger"
2323 "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"
2424 "github.com/pusher/oauth2_proxy/providers"
2525 "github.com/stretchr/testify/assert"
options.go+21−21
@@ -17,10 +17,10 @@ import (
1717 oidc "github.com/coreos/go-oidc"
1818 "github.com/dgrijalva/jwt-go"
1919 "github.com/mbland/hmacauth"
20− "github.com/pusher/oauth2_proxy/cookie"
21− "github.com/pusher/oauth2_proxy/logger"
2220 "github.com/pusher/oauth2_proxy/pkg/apis/options"
2321 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
22+ "github.com/pusher/oauth2_proxy/pkg/encryption"
23+ "github.com/pusher/oauth2_proxy/pkg/logger"
2424 "github.com/pusher/oauth2_proxy/pkg/sessions"
2525 "github.com/pusher/oauth2_proxy/providers"
2626 "gopkg.in/natefinch/lumberjack.v2"
@@ -29,15 +29,15 @@ import (
2929// Options holds Configuration Options that can be set by Command Line Flag,
3030// or Config File
3131type Options struct {
32− ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy-prefix" env:"OAUTH2_PROXY_PROXY_PREFIX"`
32+ ProxyPrefix string `flag:"proxy-prefix" cfg:"proxy_prefix" env:"OAUTH2_PROXY_PROXY_PREFIX"`
3333 ProxyWebSockets bool `flag:"proxy-websockets" cfg:"proxy_websockets" env:"OAUTH2_PROXY_PROXY_WEBSOCKETS"`
3434 HTTPAddress string `flag:"http-address" cfg:"http_address" env:"OAUTH2_PROXY_HTTP_ADDRESS"`
3535 HTTPSAddress string `flag:"https-address" cfg:"https_address" env:"OAUTH2_PROXY_HTTPS_ADDRESS"`
3636 RedirectURL string `flag:"redirect-url" cfg:"redirect_url" env:"OAUTH2_PROXY_REDIRECT_URL"`
3737 ClientID string `flag:"client-id" cfg:"client_id" env:"OAUTH2_PROXY_CLIENT_ID"`
3838 ClientSecret string `flag:"client-secret" cfg:"client_secret" env:"OAUTH2_PROXY_CLIENT_SECRET"`
39− TLSCertFile string `flag:"tls-cert" cfg:"tls_cert_file" env:"OAUTH2_PROXY_TLS_CERT_FILE"`
40− TLSKeyFile string `flag:"tls-key" cfg:"tls_key_file" env:"OAUTH2_PROXY_TLS_KEY_FILE"`
39+ TLSCertFile string `flag:"tls-cert-file" cfg:"tls_cert_file" env:"OAUTH2_PROXY_TLS_CERT_FILE"`
40+ TLSKeyFile string `flag:"tls-key-file" cfg:"tls_key_file" env:"OAUTH2_PROXY_TLS_KEY_FILE"`
4141
4242 AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file" env:"OAUTH2_PROXY_AUTHENTICATED_EMAILS_FILE"`
4343 AzureTenant string `flag:"azure-tenant" cfg:"azure_tenant" env:"OAUTH2_PROXY_AZURE_TENANT"`
@@ -82,8 +82,8 @@ type Options struct {
8282 Provider string `flag:"provider" cfg:"provider" env:"OAUTH2_PROXY_PROVIDER"`
8383 OIDCIssuerURL string `flag:"oidc-issuer-url" cfg:"oidc_issuer_url" env:"OAUTH2_PROXY_OIDC_ISSUER_URL"`
8484 InsecureOIDCAllowUnverifiedEmail bool `flag:"insecure-oidc-allow-unverified-email" cfg:"insecure_oidc_allow_unverified_email" env:"OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL"`
85− SkipOIDCDiscovery bool `flag:"skip-oidc-discovery" cfg:"skip_oidc_discovery" env:"OAUTH2_SKIP_OIDC_DISCOVERY"`
86− OIDCJwksURL string `flag:"oidc-jwks-url" cfg:"oidc_jwks_url" env:"OAUTH2_OIDC_JWKS_URL"`
85+ SkipOIDCDiscovery bool `flag:"skip-oidc-discovery" cfg:"skip_oidc_discovery" env:"OAUTH2_PROXY_SKIP_OIDC_DISCOVERY"`
86+ OIDCJwksURL string `flag:"oidc-jwks-url" cfg:"oidc_jwks_url" env:"OAUTH2_PROXY_OIDC_JWKS_URL"`
8787 LoginURL string `flag:"login-url" cfg:"login_url" env:"OAUTH2_PROXY_LOGIN_URL"`
8888 RedeemURL string `flag:"redeem-url" cfg:"redeem_url" env:"OAUTH2_PROXY_REDEEM_URL"`
8989 ProfileURL string `flag:"profile-url" cfg:"profile_url" env:"OAUTH2_PROXY_PROFILE_URL"`
@@ -93,18 +93,18 @@ type Options struct {
9393 ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt" env:"OAUTH2_PROXY_APPROVAL_PROMPT"`
9494
9595 // Configuration values for logging
96− LoggingFilename string `flag:"logging-filename" cfg:"logging_filename" env:"OAUTH2_LOGGING_FILENAME"`
97− LoggingMaxSize int `flag:"logging-max-size" cfg:"logging_max_size" env:"OAUTH2_LOGGING_MAX_SIZE"`
98− LoggingMaxAge int `flag:"logging-max-age" cfg:"logging_max_age" env:"OAUTH2_LOGGING_MAX_AGE"`
99− LoggingMaxBackups int `flag:"logging-max-backups" cfg:"logging_max_backups" env:"OAUTH2_LOGGING_MAX_BACKUPS"`
100− LoggingLocalTime bool `flag:"logging-local-time" cfg:"logging_local_time" env:"OAUTH2_LOGGING_LOCAL_TIME"`
101− LoggingCompress bool `flag:"logging-compress" cfg:"logging_compress" env:"OAUTH2_LOGGING_COMPRESS"`
102− StandardLogging bool `flag:"standard-logging" cfg:"standard_logging" env:"OAUTH2_STANDARD_LOGGING"`
103− StandardLoggingFormat string `flag:"standard-logging-format" cfg:"standard_logging_format" env:"OAUTH2_STANDARD_LOGGING_FORMAT"`
104− RequestLogging bool `flag:"request-logging" cfg:"request_logging" env:"OAUTH2_REQUEST_LOGGING"`
105− RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_REQUEST_LOGGING_FORMAT"`
106− AuthLogging bool `flag:"auth-logging" cfg:"auth_logging" env:"OAUTH2_LOGGING_AUTH_LOGGING"`
107− AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format" env:"OAUTH2_AUTH_LOGGING_FORMAT"`
96+ LoggingFilename string `flag:"logging-filename" cfg:"logging_filename" env:"OAUTH2_PROXY_LOGGING_FILENAME"`
97+ LoggingMaxSize int `flag:"logging-max-size" cfg:"logging_max_size" env:"OAUTH2_PROXY_LOGGING_MAX_SIZE"`
98+ LoggingMaxAge int `flag:"logging-max-age" cfg:"logging_max_age" env:"OAUTH2_PROXY_LOGGING_MAX_AGE"`
99+ LoggingMaxBackups int `flag:"logging-max-backups" cfg:"logging_max_backups" env:"OAUTH2_PROXY_LOGGING_MAX_BACKUPS"`
100+ LoggingLocalTime bool `flag:"logging-local-time" cfg:"logging_local_time" env:"OAUTH2_PROXY_LOGGING_LOCAL_TIME"`
101+ LoggingCompress bool `flag:"logging-compress" cfg:"logging_compress" env:"OAUTH2_PROXY_LOGGING_COMPRESS"`
102+ StandardLogging bool `flag:"standard-logging" cfg:"standard_logging" env:"OAUTH2_PROXY_STANDARD_LOGGING"`
103+ StandardLoggingFormat string `flag:"standard-logging-format" cfg:"standard_logging_format" env:"OAUTH2_PROXY_STANDARD_LOGGING_FORMAT"`
104+ RequestLogging bool `flag:"request-logging" cfg:"request_logging" env:"OAUTH2_PROXY_REQUEST_LOGGING"`
105+ RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_PROXY_REQUEST_LOGGING_FORMAT"`
106+ AuthLogging bool `flag:"auth-logging" cfg:"auth_logging" env:"OAUTH2_PROXY_LOGGING_AUTH_LOGGING"`
107+ AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format" env:"OAUTH2_PROXY_AUTH_LOGGING_FORMAT"`
108108
109109 SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`
110110 AcrValues string `flag:"acr-values" cfg:"acr_values" env:"OAUTH2_PROXY_ACR_VALUES"`
@@ -299,7 +299,7 @@ func (o *Options) Validate() error {
299299 }
300300 msgs = parseProviderInfo(o, msgs)
301301
302− var cipher *cookie.Cipher
302+ var cipher *encryption.Cipher
303303 if o.PassAccessToken || o.SetAuthorization || o.PassAuthorization || (o.CookieRefresh != time.Duration(0)) {
304304 validCookieSecretSize := false
305305 for _, i := range []int{16, 24, 32} {
@@ -324,7 +324,7 @@ func (o *Options) Validate() error {
324324 len(secretBytes(o.CookieSecret)), suffix))
325325 } else {
326326 var err error
327− cipher, err = cookie.NewCipher(secretBytes(o.CookieSecret))
327+ cipher, err = encryption.NewCipher(secretBytes(o.CookieSecret))
328328 if err != nil {
329329 msgs = append(msgs, fmt.Sprintf("cookie-secret error: %v", err))
330330 }
pkg/apis/options/sessions.go+2−4
@@ -1,13 +1,11 @@
11package options
22
3−import (
4− "github.com/pusher/oauth2_proxy/cookie"
5−)
3+import "github.com/pusher/oauth2_proxy/pkg/encryption"
64
75// SessionOptions contains configuration options for the SessionStore providers.
86type SessionOptions struct {
97 Type string `flag:"session-store-type" cfg:"session_store_type" env:"OAUTH2_PROXY_SESSION_STORE_TYPE"`
10− Cipher *cookie.Cipher
8+ Cipher *encryption.Cipher
119 CookieStoreOptions
1210 RedisStoreOptions
1311}
pkg/apis/sessions/session_state.go+4−4
@@ -7,7 +7,7 @@ import (
77 "strings"
88 "time"
99
10− "github.com/pusher/oauth2_proxy/cookie"
10+ "github.com/pusher/oauth2_proxy/pkg/encryption"
1111)
1212
1313// SessionState is used to store information about the currently authenticated user session
@@ -66,7 +66,7 @@ func (s *SessionState) String() string {
6666}
6767
6868// EncodeSessionState returns string representation of the current session
69−func (s *SessionState) EncodeSessionState(c *cookie.Cipher) (string, error) {
69+func (s *SessionState) EncodeSessionState(c *encryption.Cipher) (string, error) {
7070 var ss SessionState
7171 if c == nil {
7272 // Store only Email and User when cipher is unavailable
@@ -133,7 +133,7 @@ func legacyDecodeSessionStatePlain(v string) (*SessionState, error) {
133133
134134// legacyDecodeSessionState attempts to decode the session state string
135135// generated by v3.1.0 or older
136−func legacyDecodeSessionState(v string, c *cookie.Cipher) (*SessionState, error) {
136+func legacyDecodeSessionState(v string, c *encryption.Cipher) (*SessionState, error) {
137137 chunks := strings.Split(v, "|")
138138
139139 if c == nil {
@@ -176,7 +176,7 @@ func legacyDecodeSessionState(v string, c *cookie.Cipher) (*SessionState, error)
176176}
177177
178178// DecodeSessionState decodes the session cookie string into a SessionState
179−func DecodeSessionState(v string, c *cookie.Cipher) (*SessionState, error) {
179+func DecodeSessionState(v string, c *encryption.Cipher) (*SessionState, error) {
180180 var ssj SessionStateJSON
181181 var ss *SessionState
182182 err := json.Unmarshal([]byte(v), &ssj)
pkg/apis/sessions/session_state_test.go+7−7
@@ -5,8 +5,8 @@ import (
55 "testing"
66 "time"
77
8− "github.com/pusher/oauth2_proxy/cookie"
98 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
9+ "github.com/pusher/oauth2_proxy/pkg/encryption"
1010 "github.com/stretchr/testify/assert"
1111)
1212
@@ -14,9 +14,9 @@ const secret = "0123456789abcdefghijklmnopqrstuv"
1414const altSecret = "0000000000abcdefghijklmnopqrstuv"
1515
1616func TestSessionStateSerialization(t *testing.T) {
17− c, err := cookie.NewCipher([]byte(secret))
17+ c, err := encryption.NewCipher([]byte(secret))
1818 assert.Equal(t, nil, err)
19− c2, err := cookie.NewCipher([]byte(altSecret))
19+ c2, err := encryption.NewCipher([]byte(altSecret))
2020 assert.Equal(t, nil, err)
2121 s := &sessions.SessionState{
2222 Email: "user@domain.com",
@@ -54,9 +54,9 @@ func TestSessionStateSerialization(t *testing.T) {
5454}
5555
5656func TestSessionStateSerializationWithUser(t *testing.T) {
57− c, err := cookie.NewCipher([]byte(secret))
57+ c, err := encryption.NewCipher([]byte(secret))
5858 assert.Equal(t, nil, err)
59− c2, err := cookie.NewCipher([]byte(altSecret))
59+ c2, err := encryption.NewCipher([]byte(altSecret))
6060 assert.Equal(t, nil, err)
6161 s := &sessions.SessionState{
6262 User: "just-user",
@@ -146,7 +146,7 @@ func TestExpired(t *testing.T) {
146146type testCase struct {
147147 sessions.SessionState
148148 Encoded string
149− Cipher *cookie.Cipher
149+ Cipher *encryption.Cipher
150150 Error bool
151151}
152152
@@ -203,7 +203,7 @@ func TestDecodeSessionState(t *testing.T) {
203203 eString := string(eJSON)
204204 eUnix := e.Unix()
205205
206− c, err := cookie.NewCipher([]byte(secret))
206+ c, err := encryption.NewCipher([]byte(secret))
207207 assert.NoError(t, err)
208208
209209 testCases := []testCase{
pkg/cookies/cookies.go+1−1
@@ -6,8 +6,8 @@ import (
66 "strings"
77 "time"
88
9− "github.com/pusher/oauth2_proxy/logger"
109 "github.com/pusher/oauth2_proxy/pkg/apis/options"
10+ "github.com/pusher/oauth2_proxy/pkg/logger"
1111)
1212
1313// MakeCookie constructs a cookie from the given parameters,
cookie/cookies.go → pkg/encryption/cipher.gorenamed+1−1
@@ -1,4 +1,4 @@
1−package cookie
1+package encryption
22
33import (
44 "crypto/aes"
cookie/cookies_test.go → pkg/encryption/cipher_test.gorenamed+1−1
@@ -1,4 +1,4 @@
1−package cookie
1+package encryption
22
33import (
44 "encoding/base64"
cookie/nonce.go → pkg/encryption/nonce.gorenamed+1−1
@@ -1,4 +1,4 @@
1−package cookie
1+package encryption
22
33import (
44 "crypto/rand"
logger/logger.go → pkg/logger/logger.gorenamed

The content is the same.

api/api.go → pkg/requests/requests.gorenamed+2−2
@@ -1,4 +1,4 @@
1−package api
1+package requests
22
33import (
44 "encoding/json"
@@ -7,7 +7,7 @@ import (
77 "net/http"
88
99 "github.com/bitly/go-simplejson"
10− "github.com/pusher/oauth2_proxy/logger"
10+ "github.com/pusher/oauth2_proxy/pkg/logger"
1111)
1212
1313// Request parses the request body into a simplejson.Json object
api/api_test.go → pkg/requests/requests_test.gorenamed+1−1
@@ -1,4 +1,4 @@
1−package api
1+package requests
22
33import (
44 "io/ioutil"
pkg/sessions/cookie/session_store.go+4−4
@@ -8,10 +8,10 @@ import (
88 "strings"
99 "time"
1010
11− "github.com/pusher/oauth2_proxy/cookie"
1211 "github.com/pusher/oauth2_proxy/pkg/apis/options"
1312 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
1413 "github.com/pusher/oauth2_proxy/pkg/cookies"
14+ "github.com/pusher/oauth2_proxy/pkg/encryption"
1515 "github.com/pusher/oauth2_proxy/pkg/sessions/utils"
1616)
1717
@@ -28,7 +28,7 @@ var _ sessions.SessionStore = &SessionStore{}
2828// interface that stores sessions in client side cookies
2929type SessionStore struct {
3030 CookieOptions *options.CookieOptions
31− CookieCipher *cookie.Cipher
31+ CookieCipher *encryption.Cipher
3232}
3333
3434// Save takes a sessions.SessionState and stores the information from it
@@ -53,7 +53,7 @@ func (s *SessionStore) Load(req *http.Request) (*sessions.SessionState, error) {
5353 // always http.ErrNoCookie
5454 return nil, fmt.Errorf("Cookie %q not present", s.CookieOptions.CookieName)
5555 }
56− val, _, ok := cookie.Validate(c, s.CookieOptions.CookieSecret, s.CookieOptions.CookieExpire)
56+ val, _, ok := encryption.Validate(c, s.CookieOptions.CookieSecret, s.CookieOptions.CookieExpire)
5757 if !ok {
5858 return nil, errors.New("Cookie Signature not valid")
5959 }
@@ -96,7 +96,7 @@ func (s *SessionStore) setSessionCookie(rw http.ResponseWriter, req *http.Reques
9696// authentication details
9797func (s *SessionStore) makeSessionCookie(req *http.Request, value string, now time.Time) []*http.Cookie {
9898 if value != "" {
99− value = cookie.SignedValue(s.CookieOptions.CookieSecret, s.CookieOptions.CookieName, value, now)
99+ value = encryption.SignedValue(s.CookieOptions.CookieSecret, s.CookieOptions.CookieName, value, now)
100100 }
101101 c := s.makeCookie(req, s.CookieOptions.CookieName, value, s.CookieOptions.CookieExpire, now)
102102 if len(c.Value) > 4096-len(s.CookieOptions.CookieName) {
pkg/sessions/redis/redis_store.go+6−6
@@ -13,10 +13,10 @@ import (
1313 "time"
1414
1515 "github.com/go-redis/redis"
16− "github.com/pusher/oauth2_proxy/cookie"
1716 "github.com/pusher/oauth2_proxy/pkg/apis/options"
1817 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
1918 "github.com/pusher/oauth2_proxy/pkg/cookies"
19+ "github.com/pusher/oauth2_proxy/pkg/encryption"
2020)
2121
2222// TicketData is a structure representing the ticket used in server session storage
@@ -28,7 +28,7 @@ type TicketData struct {
2828// SessionStore is an implementation of the sessions.SessionStore
2929// interface that stores sessions in redis
3030type SessionStore struct {
31− CookieCipher *cookie.Cipher
31+ CookieCipher *encryption.Cipher
3232 CookieOptions *options.CookieOptions
3333 Client *redis.Client
3434}
@@ -106,7 +106,7 @@ func (store *SessionStore) Load(req *http.Request) (*sessions.SessionState, erro
106106 return nil, fmt.Errorf("error loading session: %s", err)
107107 }
108108
109− val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)
109+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)
110110 if !ok {
111111 return nil, fmt.Errorf("Cookie Signature not valid")
112112 }
@@ -166,7 +166,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
166166 return fmt.Errorf("error retrieving cookie: %v", err)
167167 }
168168
169− val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)
169+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)
170170 if !ok {
171171 return fmt.Errorf("Cookie Signature not valid")
172172 }
@@ -186,7 +186,7 @@ func (store *SessionStore) Clear(rw http.ResponseWriter, req *http.Request) erro
186186// makeCookie makes a cookie, signing the value if present
187187func (store *SessionStore) makeCookie(req *http.Request, value string, expires time.Duration, now time.Time) *http.Cookie {
188188 if value != "" {
189− value = cookie.SignedValue(store.CookieOptions.CookieSecret, store.CookieOptions.CookieName, value, now)
189+ value = encryption.SignedValue(store.CookieOptions.CookieSecret, store.CookieOptions.CookieName, value, now)
190190 }
191191 return cookies.MakeCookieFromOptions(
192192 req,
@@ -230,7 +230,7 @@ func (store *SessionStore) getTicket(requestCookie *http.Cookie) (*TicketData, e
230230 }
231231
232232 // An existing cookie exists, try to retrieve the ticket
233− val, _, ok := cookie.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)
233+ val, _, ok := encryption.Validate(requestCookie, store.CookieOptions.CookieSecret, store.CookieOptions.CookieExpire)
234234 if !ok {
235235 // Cookie is invalid, create a new ticket
236236 return newTicket()
pkg/sessions/session_store_test.go+3−3
@@ -13,10 +13,10 @@ import (
1313 "github.com/alicebob/miniredis"
1414 . "github.com/onsi/ginkgo"
1515 . "github.com/onsi/gomega"
16− "github.com/pusher/oauth2_proxy/cookie"
1716 "github.com/pusher/oauth2_proxy/pkg/apis/options"
1817 sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
1918 "github.com/pusher/oauth2_proxy/pkg/cookies"
19+ "github.com/pusher/oauth2_proxy/pkg/encryption"
2020 "github.com/pusher/oauth2_proxy/pkg/sessions"
2121 sessionscookie "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"
2222 "github.com/pusher/oauth2_proxy/pkg/sessions/redis"
@@ -158,7 +158,7 @@ var _ = Describe("NewSessionStore", func() {
158158 BeforeEach(func() {
159159 By("Using a valid cookie with a different providers session encoding")
160160 broken := "BrokenSessionFromADifferentSessionImplementation"
161− value := cookie.SignedValue(cookieOpts.CookieSecret, cookieOpts.CookieName, broken, time.Now())
161+ value := encryption.SignedValue(cookieOpts.CookieSecret, cookieOpts.CookieName, broken, time.Now())
162162 cookie := cookies.MakeCookieFromOptions(request, cookieOpts.CookieName, value, cookieOpts, cookieOpts.CookieExpire, time.Now())
163163 request.AddCookie(cookie)
164164
@@ -354,7 +354,7 @@ var _ = Describe("NewSessionStore", func() {
354354 _, err := rand.Read(secret)
355355 Expect(err).ToNot(HaveOccurred())
356356 cookieOpts.CookieSecret = base64.URLEncoding.EncodeToString(secret)
357− cipher, err := cookie.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))
357+ cipher, err := encryption.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))
358358 Expect(err).ToNot(HaveOccurred())
359359 Expect(cipher).ToNot(BeNil())
360360 opts.Cipher = cipher
pkg/sessions/utils/utils.go+3−3
@@ -3,17 +3,17 @@ package utils
33import (
44 "encoding/base64"
55
6− "github.com/pusher/oauth2_proxy/cookie"
76 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
7+ "github.com/pusher/oauth2_proxy/pkg/encryption"
88)
99
1010// CookieForSession serializes a session state for storage in a cookie
11−func CookieForSession(s *sessions.SessionState, c *cookie.Cipher) (string, error) {
11+func CookieForSession(s *sessions.SessionState, c *encryption.Cipher) (string, error) {
1212 return s.EncodeSessionState(c)
1313}
1414
1515// SessionFromCookie deserializes a session from a cookie value
16−func SessionFromCookie(v string, c *cookie.Cipher) (s *sessions.SessionState, err error) {
16+func SessionFromCookie(v string, c *encryption.Cipher) (s *sessions.SessionState, err error) {
1717 return sessions.DecodeSessionState(v, c)
1818}
1919
providers/azure.go+3−3
@@ -7,9 +7,9 @@ import (
77 "net/url"
88
99 "github.com/bitly/go-simplejson"
10− "github.com/pusher/oauth2_proxy/api"
11− "github.com/pusher/oauth2_proxy/logger"
1210 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
11+ "github.com/pusher/oauth2_proxy/pkg/logger"
12+ "github.com/pusher/oauth2_proxy/pkg/requests"
1313)
1414
1515// AzureProvider represents an Azure based Identity Provider
@@ -102,7 +102,7 @@ func (p *AzureProvider) GetEmailAddress(s *sessions.SessionState) (string, error
102102 }
103103 req.Header = getAzureHeader(s.AccessToken)
104104
105− json, err := api.Request(req)
105+ json, err := requests.Request(req)
106106
107107 if err != nil {
108108 return "", err
providers/facebook.go+2−2
@@ -6,8 +6,8 @@ import (
66 "net/http"
77 "net/url"
88
9− "github.com/pusher/oauth2_proxy/api"
109 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
10+ "github.com/pusher/oauth2_proxy/pkg/requests"
1111)
1212
1313// FacebookProvider represents an Facebook based Identity Provider
@@ -69,7 +69,7 @@ func (p *FacebookProvider) GetEmailAddress(s *sessions.SessionState) (string, er
6969 Email string
7070 }
7171 var r result
72− err = api.RequestJSON(req, &r)
72+ err = requests.RequestJSON(req, &r)
7373 if err != nil {
7474 return "", err
7575 }
providers/github.go+1−1
@@ -10,8 +10,8 @@ import (
1010 "strconv"
1111 "strings"
1212
13− "github.com/pusher/oauth2_proxy/logger"
1413 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
14+ "github.com/pusher/oauth2_proxy/pkg/logger"
1515)
1616
1717// GitHubProvider represents an GitHub based Identity Provider
providers/gitlab.go+3−3
@@ -4,9 +4,9 @@ import (
44 "net/http"
55 "net/url"
66
7− "github.com/pusher/oauth2_proxy/api"
8− "github.com/pusher/oauth2_proxy/logger"
97 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
8+ "github.com/pusher/oauth2_proxy/pkg/logger"
9+ "github.com/pusher/oauth2_proxy/pkg/requests"
1010)
1111
1212// GitLabProvider represents an GitLab based Identity Provider
@@ -53,7 +53,7 @@ func (p *GitLabProvider) GetEmailAddress(s *sessions.SessionState) (string, erro
5353 logger.Printf("failed building request %s", err)
5454 return "", err
5555 }
56− json, err := api.Request(req)
56+ json, err := requests.Request(req)
5757 if err != nil {
5858 logger.Printf("failed making request %s", err)
5959 return "", err
providers/google.go+1−1
@@ -13,8 +13,8 @@ import (
1313 "strings"
1414 "time"
1515
16− "github.com/pusher/oauth2_proxy/logger"
1716 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
17+ "github.com/pusher/oauth2_proxy/pkg/logger"
1818 "golang.org/x/oauth2"
1919 "golang.org/x/oauth2/google"
2020 admin "google.golang.org/api/admin/directory/v1"
providers/internal_util.go+3−3
@@ -5,8 +5,8 @@ import (
55 "net/http"
66 "net/url"
77
8− "github.com/pusher/oauth2_proxy/api"
9− "github.com/pusher/oauth2_proxy/logger"
8+ "github.com/pusher/oauth2_proxy/pkg/logger"
9+ "github.com/pusher/oauth2_proxy/pkg/requests"
1010)
1111
1212// stripToken is a helper function to obfuscate "access_token"
@@ -55,7 +55,7 @@ func validateToken(p Provider, accessToken string, header http.Header) bool {
5555 params := url.Values{"access_token": {accessToken}}
5656 endpoint = endpoint + "?" + params.Encode()
5757 }
58− resp, err := api.RequestUnparsedResponse(endpoint, header)
58+ resp, err := requests.RequestUnparsedResponse(endpoint, header)
5959 if err != nil {
6060 logger.Printf("GET %s", stripToken(endpoint))
6161 logger.Printf("token validation request failed: %s", err)
providers/linkedin.go+2−2
@@ -6,8 +6,8 @@ import (
66 "net/http"
77 "net/url"
88
9− "github.com/pusher/oauth2_proxy/api"
109 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
10+ "github.com/pusher/oauth2_proxy/pkg/requests"
1111)
1212
1313// LinkedInProvider represents an LinkedIn based Identity Provider
@@ -61,7 +61,7 @@ func (p *LinkedInProvider) GetEmailAddress(s *sessions.SessionState) (string, er
6161 }
6262 req.Header = getLinkedInHeader(s.AccessToken)
6363
64− json, err := api.Request(req)
64+ json, err := requests.Request(req)
6565 if err != nil {
6666 return "", err
6767 }
providers/provider_default.go+3−3
@@ -10,8 +10,8 @@ import (
1010 "net/url"
1111 "time"
1212
13− "github.com/pusher/oauth2_proxy/cookie"
1413 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
14+ "github.com/pusher/oauth2_proxy/pkg/encryption"
1515)
1616
1717// Redeem provides a default implementation of the OAuth2 token redemption process
@@ -96,12 +96,12 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {
9696}
9797
9898// CookieForSession serializes a session state for storage in a cookie
99−func (p *ProviderData) CookieForSession(s *sessions.SessionState, c *cookie.Cipher) (string, error) {
99+func (p *ProviderData) CookieForSession(s *sessions.SessionState, c *encryption.Cipher) (string, error) {
100100 return s.EncodeSessionState(c)
101101}
102102
103103// SessionFromCookie deserializes a session from a cookie value
104−func (p *ProviderData) SessionFromCookie(v string, c *cookie.Cipher) (s *sessions.SessionState, err error) {
104+func (p *ProviderData) SessionFromCookie(v string, c *encryption.Cipher) (s *sessions.SessionState, err error) {
105105 return sessions.DecodeSessionState(v, c)
106106}
107107
providers/providers.go+3−3
@@ -1,8 +1,8 @@
11package providers
22
33import (
4− "github.com/pusher/oauth2_proxy/cookie"
54 "github.com/pusher/oauth2_proxy/pkg/apis/sessions"
5+ "github.com/pusher/oauth2_proxy/pkg/encryption"
66)
77
88// Provider represents an upstream identity provider implementation
@@ -15,8 +15,8 @@ type Provider interface {
1515 ValidateSessionState(*sessions.SessionState) bool
1616 GetLoginURL(redirectURI, finalRedirect string) string
1717 RefreshSessionIfNeeded(*sessions.SessionState) (bool, error)
18− SessionFromCookie(string, *cookie.Cipher) (*sessions.SessionState, error)
19− CookieForSession(*sessions.SessionState, *cookie.Cipher) (string, error)
18+ SessionFromCookie(string, *encryption.Cipher) (*sessions.SessionState, error)
19+ CookieForSession(*sessions.SessionState, *encryption.Cipher) (string, error)
2020}
2121
2222// New provides a new Provider based on the configured provider string
templates.go+1−1
@@ -4,7 +4,7 @@ import (
44 "html/template"
55 "path"
66
7− "github.com/pusher/oauth2_proxy/logger"
7+ "github.com/pusher/oauth2_proxy/pkg/logger"
88)
99
1010func loadTemplates(dir string) *template.Template {
validator.go+1−1
@@ -8,7 +8,7 @@ import (
88 "sync/atomic"
99 "unsafe"
1010
11− "github.com/pusher/oauth2_proxy/logger"
11+ "github.com/pusher/oauth2_proxy/pkg/logger"
1212)
1313
1414// UserMap holds information from the authenticated emails file
watcher.go+1−1
@@ -7,7 +7,7 @@ import (
77 "path/filepath"
88 "time"
99
10− "github.com/pusher/oauth2_proxy/logger"
10+ "github.com/pusher/oauth2_proxy/pkg/logger"
1111 fsnotify "gopkg.in/fsnotify/fsnotify.v1"
1212)
1313
watcher_unsupported.go+1−1
@@ -2,7 +2,7 @@
22
33package main
44
5−import "github.com/pusher/oauth2_proxy/logger"
5+import "github.com/pusher/oauth2_proxy/pkg/logger"
66
77func WatchForUpdates(filename string, done <-chan bool, action func()) {
88 logger.Printf("file watching not implemented on this platform")