638fba4 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

deref everything but now with default constants

Signed-off-by: Jan Larwig <jan@larwig.com>

commit638fba417f25c4c9fd09fc0de6a4fa44b2555b95 authorJan Larwig <jan@larwig.com> dateFri 7 Nov 2025, 22:31 (1 year ago) parentceb9a38

16 files changed+116−52

compare with master

unifiedsplit

pkg/apis/options/header.go+6−1 pkg/apis/options/providers.go+49−13 pkg/apis/options/upstreams.go+30−8 pkg/middleware/headers.go+1−1 pkg/upstream/http.go+4−4 pkg/upstream/proxy.go+3−3 pkg/upstream/static.go+2−1 pkg/validation/options.go+1−1 pkg/validation/providers.go+3−3 pkg/validation/upstreams.go+7−7 providers/adfs.go+1−1 providers/adfs_test.go providers/google.go+3−3 providers/ms_entra_id.go+1−1 providers/oidc.go+1−1 providers/providers.go+4−4

pkg/apis/options/header.go+6−1

@@ -2,6 +2,11 @@ package options

33import "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

5+const (

6+ // DefaultHeaderPreserveRequestValue is the default value for Header.PreserveRequestValue

7+ DefaultHeaderPreserveRequestValue bool = false

8+)

510// Header represents an individual header that will be added to a request or

611// response header.

712type Header struct {

@@ -59,7 +64,7 @@ type ClaimSource struct {

5964// EnsureDefaults sets any default values for Header fields.

6065func (h *Header) EnsureDefaults() {

6166 if h.PreserveRequestValue == nil {

62− h.PreserveRequestValue = ptr.Ptr(false)

67+ h.PreserveRequestValue = ptr.Ptr(DefaultHeaderPreserveRequestValue)

6368 }

6469 for i := range h.Values {

6570 h.Values[i].EnsureDefaults()

pkg/apis/options/providers.go+49−13

@@ -4,10 +4,46 @@ import "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

55const (

66 // OIDCEmailClaim is the generic email claim used by the OIDC provider.

7− OIDCEmailClaim = "email"

7+ OIDCEmailClaim string = "email"

99 // OIDCGroupsClaim is the generic groups claim used by the OIDC provider.

10− OIDCGroupsClaim = "groups"

10+ OIDCGroupsClaim string = "groups"

11+

12+ // DefaultSkipDiscovery is the default value

13+ // for OIDCOptions.SkipDiscovery

14+ DefaultSkipDiscovery bool = false

15+

16+ // DefaultInsecureSkipNonce is the default value

17+ // for OIDCOptions.InsecureSkipNonce

18+ DefaultInsecureSkipNonce bool = true

19+

20+ // DefaultInsecureAllowUnverifiedEmail is the default value

21+ // for OIDCOptions.InsecureAllowUnverifiedEmail

22+ DefaultInsecureAllowUnverifiedEmail bool = false

23+

24+ // DefaultInsecureSkipIssuerVerification is the default value

25+ // for OIDCOptions.InsecureSkipIssuerVerification

26+ DefaultInsecureSkipIssuerVerification bool = false

27+

28+ // DefaultSkipClaimsFromProfileURL is the default value

29+ // for Provider.SkipClaimsFromProfileURL

30+ DefaultSkipClaimsFromProfileURL bool = false

31+

32+ // DefaultADFSSkipScope is the default value

33+ // for ADFSOptions.SkipScope

34+ DefaultADFSSkipScope bool = false

35+

36+ // DefaultMicrosoftEntraIDUseFederatedToken is the default value

37+ // for MicrosoftEntraIDOptions.FederatedTokenAuth

38+ DefaultMicrosoftEntraIDUseFederatedToken bool = false

39+

40+ // DefaultGoogleUseApplicationDefaultCredentials is the default values

41+ // for GoogleOptions.UseApplicationDefaultCredentials

42+ DefaultUseApplicationDefaultCredentials bool = false

43+

44+ // DefaultUseSystemTrustStore is the default value

45+ // for Provider.UseSystemTrustStore

46+ DefaultUseSystemTrustStore bool = true

1147)

1248

1349// OIDCAudienceClaims is the generic audience claim list used by the OIDC provider.

@@ -298,9 +334,9 @@ func providerDefaults() Providers {

298334 Tenant: "common",

299335 },

300336 OIDCConfig: OIDCOptions{

301− InsecureAllowUnverifiedEmail: ptr.Ptr(false),

302− InsecureSkipNonce: ptr.Ptr(true),

303− SkipDiscovery: ptr.Ptr(false),

337+ InsecureAllowUnverifiedEmail: ptr.Ptr(DefaultInsecureAllowUnverifiedEmail),

338+ InsecureSkipNonce: ptr.Ptr(DefaultInsecureSkipNonce),

339+ SkipDiscovery: ptr.Ptr(DefaultSkipDiscovery),

304340 UserIDClaim: OIDCEmailClaim, // Deprecated: Use OIDCEmailClaim

305341 EmailClaim: OIDCEmailClaim,

306342 GroupsClaim: OIDCGroupsClaim,

@@ -322,10 +358,10 @@ func (p Providers) EnsureDefaults() {

322358// EnsureDefaults sets any default values for Provider fields.

323359func (p *Provider) EnsureDefaults() {

324360 if p.SkipClaimsFromProfileURL == nil {

325− p.SkipClaimsFromProfileURL = ptr.Ptr(false)

361+ p.SkipClaimsFromProfileURL = ptr.Ptr(DefaultSkipClaimsFromProfileURL)

326362 }

327363 if p.UseSystemTrustStore == nil {

328− p.UseSystemTrustStore = ptr.Ptr(true)

364+ p.UseSystemTrustStore = ptr.Ptr(DefaultUseSystemTrustStore)

329365 }

330366

331367 p.OIDCConfig.EnsureDefaults()

@@ -338,13 +374,13 @@ func (p *Provider) EnsureDefaults() {

338374func (o *OIDCOptions) EnsureDefaults() {

339375 // Ensure OIDC defaults

340376 if o.InsecureAllowUnverifiedEmail == nil {

341− o.InsecureAllowUnverifiedEmail = ptr.Ptr(false)

377+ o.InsecureAllowUnverifiedEmail = ptr.Ptr(DefaultInsecureAllowUnverifiedEmail)

342378 }

343379 if o.InsecureSkipNonce == nil {

344− o.InsecureSkipNonce = ptr.Ptr(true)

380+ o.InsecureSkipNonce = ptr.Ptr(DefaultInsecureSkipNonce)

345381 }

346382 if o.SkipDiscovery == nil {

347− o.SkipDiscovery = ptr.Ptr(false)

383+ o.SkipDiscovery = ptr.Ptr(DefaultSkipDiscovery)

348384 }

349385 if o.UserIDClaim == "" {

350386 o.UserIDClaim = OIDCEmailClaim

@@ -363,20 +399,20 @@ func (o *OIDCOptions) EnsureDefaults() {

363399// EnsureDefaults sets any default values for MicrosoftEntraIDOptions fields.

364400func (me *MicrosoftEntraIDOptions) EnsureDefaults() {

365401 if me.FederatedTokenAuth == nil {

366− me.FederatedTokenAuth = ptr.Ptr(false)

402+ me.FederatedTokenAuth = ptr.Ptr(DefaultMicrosoftEntraIDUseFederatedToken)

367403 }

368404}

369405

370406// EnsureDefaults sets any default values for ADFSOptions fields.

371407func (a *ADFSOptions) EnsureDefaults() {

372408 if a.SkipScope == nil {

373− a.SkipScope = ptr.Ptr(false)

409+ a.SkipScope = ptr.Ptr(DefaultADFSSkipScope)

374410 }

375411}

376412

377413// EnsureDefaults sets any default values for GoogleOptions fields.

378414func (g *GoogleOptions) EnsureDefaults() {

379415 if g.UseApplicationDefaultCredentials == nil {

380− g.UseApplicationDefaultCredentials = ptr.Ptr(false)

416+ g.UseApplicationDefaultCredentials = ptr.Ptr(DefaultUseApplicationDefaultCredentials)

381417 }

382418}

pkg/apis/options/upstreams.go+30−8

@@ -1,6 +1,7 @@

11package options

33import (

4+ "net/http"

45 "time"

67 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

@@ -8,10 +9,31 @@ import (

910const (

1011 // DefaultUpstreamFlushInterval is the default value for the Upstream FlushInterval.

11− DefaultUpstreamFlushInterval = 1 * time.Second

12+ DefaultUpstreamFlushInterval time.Duration = 1 * time.Second

1213

1314 // DefaultUpstreamTimeout is the maximum duration a network dial to a upstream server for a response.

14− DefaultUpstreamTimeout = 30 * time.Second

15+ DefaultUpstreamTimeout time.Duration = 30 * time.Second

16+

17+ // DefaultUpstreamStatic determines if upstreams are static by default.

18+ DefaultUpstreamStatic bool = false

19+

20+ // DefaultUpstreamStaticCode is the default response code for static upstreams.

21+ DefaultUpstreamStaticCode int = http.StatusOK // 200

22+

23+ // DefaultUpstreamProxyRawPath determines if upstreams will proxy the raw url path by default.

24+ DefaultUpstreamProxyRawPath bool = false

25+

26+ // DefaultUpstreamInsecureSkipTLSVerify determines if upstreams will skip TLS verification by default.

27+ DefaultUpsteamInsecureSkipTLSVerify bool = false

28+

29+ // DefaultUpstreamPassHostHeader determines if upstreams will pass the host header by default.

30+ DefaultUpstreamPassHostHeader bool = true

31+

32+ // DefaultUpstreamProxyWebSockets determines if upstreams will proxy websockets by default.

33+ DefaultUpstreamProxyWebSockets bool = true

34+

35+ // DefaultUpstreamDisableKeepAlives determines if upstreams will disable keep-alives by default.

36+ DefaultUpstreamDisableKeepAlives bool = false

1537)

1638

1739// UpstreamConfig is a collection of definitions for upstream servers.

@@ -106,7 +128,7 @@ type Upstream struct {

106128// EnsureDefaults sets any default values for UpstreamConfig fields.

107129func (uc *UpstreamConfig) EnsureDefaults() {

108130 if uc.ProxyRawPath == nil {

109− uc.ProxyRawPath = ptr.Ptr(false)

131+ uc.ProxyRawPath = ptr.Ptr(DefaultUpstreamProxyRawPath)

110132 }

111133 for i := range uc.Upstreams {

112134 uc.Upstreams[i].EnsureDefaults()

@@ -116,24 +138,24 @@ func (uc *UpstreamConfig) EnsureDefaults() {

116138// EnsureDefaults sets any default values for Upstream fields.

117139func (u *Upstream) EnsureDefaults() {

118140 if u.InsecureSkipTLSVerify == nil {

119− u.InsecureSkipTLSVerify = ptr.Ptr(false)

141+ u.InsecureSkipTLSVerify = ptr.Ptr(DefaultUpsteamInsecureSkipTLSVerify)

120142 }

121143 if u.Static == nil {

122− u.Static = ptr.Ptr(false)

144+ u.Static = ptr.Ptr(DefaultUpstreamStatic)

123145 }

124146 if u.FlushInterval == nil {

125147 u.FlushInterval = ptr.Ptr(DefaultUpstreamFlushInterval)

126148 }

127149 if u.PassHostHeader == nil {

128− u.PassHostHeader = ptr.Ptr(true)

150+ u.PassHostHeader = ptr.Ptr(DefaultUpstreamPassHostHeader)

129151 }

130152 if u.ProxyWebSockets == nil {

131− u.ProxyWebSockets = ptr.Ptr(true)

153+ u.ProxyWebSockets = ptr.Ptr(DefaultUpstreamProxyWebSockets)

132154 }

133155 if u.Timeout == nil {

134156 u.Timeout = ptr.Ptr(DefaultUpstreamTimeout)

135157 }

136158 if u.DisableKeepAlives == nil {

137− u.DisableKeepAlives = ptr.Ptr(false)

159+ u.DisableKeepAlives = ptr.Ptr(DefaultUpstreamDisableKeepAlives)

138160 }

139161}

pkg/middleware/headers.go+1−1

@@ -28,7 +28,7 @@ func NewRequestHeaderInjector(headers []options.Header) (alice.Constructor, erro

2828func newStripHeaders(headers []options.Header) alice.Constructor {

2929 headersToStrip := []options.Header{}

3030 for _, header := range headers {

31− if !ptr.Deref(header.PreserveRequestValue, false) {

31+ if !ptr.Deref(header.PreserveRequestValue, options.DefaultHeaderPreserveRequestValue) {

3232 headersToStrip = append(headersToStrip, header)

3333 }

3434 }

pkg/upstream/http.go+4−4

@@ -54,7 +54,7 @@ func newHTTPUpstreamProxy(upstream options.Upstream, u *url.URL, sigData *option

5454

5555 // Set up a WebSocket proxy if required

5656 var wsProxy http.Handler

57− if ptr.Deref(upstream.ProxyWebSockets, false) {

57+ if ptr.Deref(upstream.ProxyWebSockets, options.DefaultUpstreamProxyWebSockets) {

5858 wsProxy = newWebSocketReverseProxy(u, upstream.InsecureSkipTLSVerify)

5959 }

6060

@@ -150,14 +150,14 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr

150150

151151 // InsecureSkipVerify is a configurable option we allow

152152 /* #nosec G402 */

153− if ptr.Deref(upstream.InsecureSkipTLSVerify, false) {

153+ if ptr.Deref(upstream.InsecureSkipTLSVerify, options.DefaultUpsteamInsecureSkipTLSVerify) {

154154 transport.TLSClientConfig.InsecureSkipVerify = true

155155 }

156156

157157 // Ensure we always pass the original request path

158158 setProxyDirector(proxy)

159159

160− if !ptr.Deref(upstream.PassHostHeader, false) {

160+ if !ptr.Deref(upstream.PassHostHeader, options.DefaultUpstreamPassHostHeader) {

161161 setProxyUpstreamHostHeader(proxy, target)

162162 }

163163

@@ -169,7 +169,7 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr

169169

170170 // Pass on DisableKeepAlives to the transport settings

171171 // to allow for disabling HTTP keep-alive connections

172− transport.DisableKeepAlives = ptr.Deref(upstream.DisableKeepAlives, false)

172+ transport.DisableKeepAlives = ptr.Deref(upstream.DisableKeepAlives, options.DefaultUpstreamDisableKeepAlives)

173173

174174 // Apply the customized transport to our proxy before returning it

175175 proxy.Transport = transport

pkg/upstream/proxy.go+3−3

@@ -28,12 +28,12 @@ func NewProxy(upstreams options.UpstreamConfig, sigData *options.SignatureData,

2828 serveMux: mux.NewRouter(),

2929 }

3030

31− if ptr.Deref(upstreams.ProxyRawPath, false) {

31+ if ptr.Deref(upstreams.ProxyRawPath, options.DefaultUpstreamProxyRawPath) {

3232 m.serveMux.UseEncodedPath()

3333 }

3434

3535 for _, upstream := range sortByPathLongest(upstreams.Upstreams) {

36− if ptr.Deref(upstream.Static, false) {

36+ if ptr.Deref(upstream.Static, options.DefaultUpstreamStatic) {

3737 if err := m.registerStaticResponseHandler(upstream, writer); err != nil {

3838 return nil, fmt.Errorf("could not register static upstream %q: %v", upstream.ID, err)

3939 }

@@ -75,7 +75,7 @@ func (m *multiUpstreamProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request

7575

7676// registerStaticResponseHandler registers a static response handler with at the given path.

7777func (m *multiUpstreamProxy) registerStaticResponseHandler(upstream options.Upstream, writer pagewriter.Writer) error {

78− logger.Printf("mapping path %q => static response %d", upstream.Path, ptr.Deref(upstream.StaticCode, 200))

78+ logger.Printf("mapping path %q => static response %d", upstream.Path, ptr.Deref(upstream.StaticCode, options.DefaultUpstreamStaticCode))

7979 return m.registerHandler(upstream, newStaticResponseHandler(upstream.ID, upstream.StaticCode), writer)

8080}

8181

pkg/upstream/static.go+2−1

@@ -5,6 +5,7 @@ import (

55 "net/http"

77 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"

8+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

89 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

910 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

1011)

@@ -13,7 +14,7 @@ import (

1314// a static response code.

1415func newStaticResponseHandler(upstream string, code *int) http.Handler {

1516 return &staticResponseHandler{

16− code: ptr.Deref(code, 200),

17+ code: ptr.Deref(code, options.DefaultUpstreamStaticCode),

1718 upstream: upstream,

1819 }

1920}

pkg/validation/options.go+1−1

@@ -35,7 +35,7 @@ func Validate(o *options.Options) error {

3535 transport := requests.DefaultTransport.(*http.Transport)

3636 transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow

3737 } else if len(o.Providers[0].CAFiles) > 0 {

38− pool, err := util.GetCertPool(o.Providers[0].CAFiles, ptr.Deref(o.Providers[0].UseSystemTrustStore, false))

38+ pool, err := util.GetCertPool(o.Providers[0].CAFiles, ptr.Deref(o.Providers[0].UseSystemTrustStore, options.DefaultUseSystemTrustStore))

3939 if err == nil {

4040 transport := requests.DefaultTransport.(*http.Transport)

4141 transport.TLSClientConfig = &tls.Config{

pkg/validation/providers.go+3−3

@@ -65,7 +65,7 @@ func validateProvider(provider options.Provider, providerIDs map[string]struct{}

6565// providerRequiresClientSecret checks if provider requires client secret to be set

6666// or it can be omitted in favor of JWT token to authenticate oAuth client

6767func providerRequiresClientSecret(provider options.Provider) bool {

68− if provider.Type == "entra-id" && ptr.Deref(provider.MicrosoftEntraIDConfig.FederatedTokenAuth, false) {

68+ if provider.Type == "entra-id" && ptr.Deref(provider.MicrosoftEntraIDConfig.FederatedTokenAuth, options.DefaultMicrosoftEntraIDUseFederatedToken) {

6969 return false

7070 }

7171

@@ -97,7 +97,7 @@ func validateGoogleConfig(provider options.Provider) []string {

9797

9898 hasAdminEmail := provider.GoogleConfig.AdminEmail != ""

9999 hasSAJSON := provider.GoogleConfig.ServiceAccountJSON != ""

100− useADC := ptr.Deref(provider.GoogleConfig.UseApplicationDefaultCredentials, false)

100+ useADC := ptr.Deref(provider.GoogleConfig.UseApplicationDefaultCredentials, options.DefaultUseApplicationDefaultCredentials)

101101

102102 if !hasAdminEmail && !hasSAJSON && !useADC {

103103 return msgs

@@ -124,7 +124,7 @@ func validateGoogleConfig(provider options.Provider) []string {

124124func validateEntraConfig(provider options.Provider) []string {

125125 msgs := []string{}

126126

127− if ptr.Deref(provider.MicrosoftEntraIDConfig.FederatedTokenAuth, false) {

127+ if ptr.Deref(provider.MicrosoftEntraIDConfig.FederatedTokenAuth, options.DefaultMicrosoftEntraIDUseFederatedToken) {

128128 federatedTokenPath := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")

129129

130130 if federatedTokenPath == "" {

pkg/validation/upstreams.go+7−7

@@ -55,28 +55,28 @@ func validateUpstream(upstream options.Upstream, ids, paths map[string]struct{})

5555func validateStaticUpstream(upstream options.Upstream) []string {

5656 msgs := []string{}

5757

58− if !ptr.Deref(upstream.Static, false) && upstream.StaticCode != nil {

58+ if !ptr.Deref(upstream.Static, options.DefaultUpstreamStatic) && upstream.StaticCode != nil {

5959 msgs = append(msgs, fmt.Sprintf("upstream %q has staticCode (%d), but is not a static upstream, set 'static' for a static response", upstream.ID, *upstream.StaticCode))

6060 }

6161

6262 // Checks after this only make sense when the upstream is static

63− if !ptr.Deref(upstream.Static, false) {

63+ if !ptr.Deref(upstream.Static, options.DefaultUpstreamStatic) {

6464 return msgs

6565 }

6666

6767 if upstream.URI != "" {

6868 msgs = append(msgs, fmt.Sprintf("upstream %q has uri, but is a static upstream, this will have no effect.", upstream.ID))

6969 }

70− if ptr.Deref(upstream.InsecureSkipTLSVerify, false) {

70+ if ptr.Deref(upstream.InsecureSkipTLSVerify, options.DefaultUpsteamInsecureSkipTLSVerify) {

7171 msgs = append(msgs, fmt.Sprintf("upstream %q has insecureSkipTLSVerify, but is a static upstream, this will have no effect.", upstream.ID))

7272 }

7373 if ptr.Deref(upstream.FlushInterval, options.DefaultUpstreamFlushInterval) != options.DefaultUpstreamFlushInterval {

7474 msgs = append(msgs, fmt.Sprintf("upstream %q has flushInterval, but is a static upstream, this will have no effect.", upstream.ID))

7575 }

76− if ptr.Deref(upstream.PassHostHeader, false) {

76+ if ptr.Deref(upstream.PassHostHeader, options.DefaultUpstreamPassHostHeader) {

7777 msgs = append(msgs, fmt.Sprintf("upstream %q has passHostHeader, but is a static upstream, this will have no effect.", upstream.ID))

7878 }

79− if ptr.Deref(upstream.ProxyWebSockets, false) {

79+ if ptr.Deref(upstream.ProxyWebSockets, options.DefaultUpstreamProxyWebSockets) {

8080 msgs = append(msgs, fmt.Sprintf("upstream %q has proxyWebSockets, but is a static upstream, this will have no effect.", upstream.ID))

8181 }

8282

@@ -86,13 +86,13 @@ func validateStaticUpstream(upstream options.Upstream) []string {

8686func validateUpstreamURI(upstream options.Upstream) []string {

8787 msgs := []string{}

8888

89− if !ptr.Deref(upstream.Static, false) && upstream.URI == "" {

89+ if !ptr.Deref(upstream.Static, options.DefaultUpstreamStatic) && upstream.URI == "" {

9090 msgs = append(msgs, fmt.Sprintf("upstream %q has empty uri: uris are required for all non-static upstreams", upstream.ID))

9191 return msgs

9292 }

9393

9494 // Checks after this only make sense the upstream is not static

95− if !ptr.Deref(upstream.Static, false) {

95+ if !ptr.Deref(upstream.Static, options.DefaultUpstreamStatic) {

9696 return msgs

9797 }

9898

providers/adfs.go+1−1

@@ -51,7 +51,7 @@ func NewADFSProvider(p *ProviderData, opts options.Provider) *ADFSProvider {

5151

5252 return &ADFSProvider{

5353 OIDCProvider: oidcProvider,

54− skipScope: ptr.Deref(opts.ADFSConfig.SkipScope, false),

54+ skipScope: ptr.Deref(opts.ADFSConfig.SkipScope, options.DefaultADFSSkipScope),

5555 oidcEnrichFunc: oidcProvider.EnrichSession,

5656 oidcRefreshFunc: oidcProvider.RefreshSession,

5757 }

providers/adfs_test.gomode 100755 → 100644

Only the mode changed.

providers/google.go+3−3

@@ -109,7 +109,7 @@ func NewGoogleProvider(p *ProviderData, opts options.GoogleOptions) (*GoogleProv

109109 },

110110 }

111111

112− if opts.UseOrganizationID || opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, false) {

112+ if opts.UseOrganizationID || opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, options.DefaultUseApplicationDefaultCredentials) {

113113 // reuse admin service to avoid multiple calls for token

114114 var adminService *admin.Service

115115

@@ -132,7 +132,7 @@ func NewGoogleProvider(p *ProviderData, opts options.GoogleOptions) (*GoogleProv

132132 }

133133 }

134134

135− if opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, false) {

135+ if opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, options.DefaultUseApplicationDefaultCredentials) {

136136 if adminService == nil {

137137 adminService = getAdminService(opts)

138138 }

@@ -304,7 +304,7 @@ var possibleScopesList = [...]string{

304304}

305305

306306func getOauth2TokenSource(ctx context.Context, opts options.GoogleOptions, scope string) oauth2.TokenSource {

307− if ptr.Deref(opts.UseApplicationDefaultCredentials, false) {

307+ if ptr.Deref(opts.UseApplicationDefaultCredentials, options.DefaultUseApplicationDefaultCredentials) {

308308 ts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{

309309 TargetPrincipal: getTargetPrincipal(ctx, opts),

310310 Scopes: strings.Split(scope, " "),

providers/ms_entra_id.go+1−1

@@ -52,7 +52,7 @@ func NewMicrosoftEntraIDProvider(p *ProviderData, opts options.Provider) *Micros

5252 OIDCProvider: NewOIDCProvider(p, opts.OIDCConfig),

5353

5454 multiTenantAllowedTenants: opts.MicrosoftEntraIDConfig.AllowedTenants,

55− federatedTokenAuth: ptr.Deref(opts.MicrosoftEntraIDConfig.FederatedTokenAuth, false),

55+ federatedTokenAuth: ptr.Deref(opts.MicrosoftEntraIDConfig.FederatedTokenAuth, options.DefaultMicrosoftEntraIDUseFederatedToken),

5656 microsoftGraphURL: microsoftGraphURL,

5757 }

5858}

providers/oidc.go+1−1

@@ -51,7 +51,7 @@ func NewOIDCProvider(p *ProviderData, opts options.OIDCOptions) *OIDCProvider {

5151

5252 return &OIDCProvider{

5353 ProviderData: p,

54− SkipNonce: ptr.Deref(opts.InsecureSkipNonce, false),

54+ SkipNonce: ptr.Deref(opts.InsecureSkipNonce, options.DefaultInsecureSkipNonce),

5555 }

5656}

5757

providers/providers.go+4−4

@@ -99,8 +99,8 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,

9999 IssuerURL: providerConfig.OIDCConfig.IssuerURL,

100100 JWKsURL: providerConfig.OIDCConfig.JwksURL,

101101 PublicKeyFiles: providerConfig.OIDCConfig.PublicKeyFiles,

102− SkipDiscovery: ptr.Deref(providerConfig.OIDCConfig.SkipDiscovery, false),

103− SkipIssuerVerification: ptr.Deref(providerConfig.OIDCConfig.InsecureSkipIssuerVerification, false),

102+ SkipDiscovery: ptr.Deref(providerConfig.OIDCConfig.SkipDiscovery, options.DefaultSkipDiscovery),

103+ SkipIssuerVerification: ptr.Deref(providerConfig.OIDCConfig.InsecureSkipIssuerVerification, options.DefaultInsecureSkipIssuerVerification),

104104 })

105105 if err != nil {

106106 return nil, fmt.Errorf("error building OIDC ProviderVerifier: %v", err)

@@ -144,10 +144,10 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,

144144 }

145145

146146 // Make the OIDC options available to all providers that support it

147− p.AllowUnverifiedEmail = ptr.Deref(providerConfig.OIDCConfig.InsecureAllowUnverifiedEmail, false)

147+ p.AllowUnverifiedEmail = ptr.Deref(providerConfig.OIDCConfig.InsecureAllowUnverifiedEmail, options.DefaultInsecureAllowUnverifiedEmail)

148148 p.EmailClaim = providerConfig.OIDCConfig.EmailClaim

149149 p.GroupsClaim = providerConfig.OIDCConfig.GroupsClaim

150− p.SkipClaimsFromProfileURL = ptr.Deref(providerConfig.SkipClaimsFromProfileURL, false)

150+ p.SkipClaimsFromProfileURL = ptr.Deref(providerConfig.SkipClaimsFromProfileURL, options.DefaultSkipClaimsFromProfileURL)

151151

152152 // Set PKCE enabled or disabled based on discovery and force options

153153 p.CodeChallengeMethod = parseCodeChallengeMethod(providerConfig)