git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix: unable to use hyphen in JSON path for oidc-groups-claim option (#2619)
commit642ba174d42cc8d1385185007ae8c597f1f4d54d authorrd-danny-fleer <167874449+rd-danny-fleer@users.noreply.github.com> dateMon 7 Oct 2024, 20:08 (2 years ago) parentd68336d
3 files changed+22−5
compare with master
unifiedsplit
CHANGELOG.md+1 pkg/providers/util/claim_extractor.go+3−5 pkg/providers/util/claim_extractor_test.go+18
CHANGELOG.md+1
@@ -9,6 +9,7 @@
99## Changes since v7.7.0
1010
1111- [#2803](https://github.com/oauth2-proxy/oauth2-proxy/pull/2803) fix: self signed certificate handling in v7.7.0 (@tuunit)
12+- [#2619](https://github.com/oauth2-proxy/oauth2-proxy/pull/2619) fix: unable to use hyphen in JSON path for oidc-groups-claim option (@rd-danny-fleer)
1213
1314# V7.7.0
1415
pkg/providers/util/claim_extractor.go+3−5
@@ -11,7 +11,6 @@ import (
1111
1212 "github.com/bitly/go-simplejson"
1313 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
14− "github.com/ohler55/ojg/jp"
1514 "github.com/spf13/cast"
1615)
1716
@@ -140,12 +139,11 @@ func parseJWT(p string) ([]byte, error) {
140139}
141140
142141// getClaimFrom gets a claim from a Json object.
143−// It can accept either a single claim name or a json path if the path is a valid json path.
142+// It can accept either a single claim name or a json path. The claim is always evaluated first as a single claim name.
144143// Paths with indexes are not supported.
145144func getClaimFrom(claim string, src *simplejson.Json) interface{} {
146− _, err := jp.ParseString(claim)
147− if err != nil {
148− return src.Get(claim).Interface()
145+ if value, ok := src.CheckGet(claim); ok {
146+ return value.Interface()
149147 }
150148 claimParts := strings.Split(claim, ".")
151149 return src.GetPath(claimParts...).Interface()
pkg/providers/util/claim_extractor_test.go+18
@@ -25,6 +25,12 @@ const (
2525 "idTokenGroup1",
2626 "idTokenGroup2"
2727 ],
28+ "nested-groups-claim-containing-hyphen": {
29+ "groups": [
30+ "nestedClaimContainingHypenGroup1",
31+ "nestedClaimContainingHypenGroup2"
32+ ]
33+ },
2834 "https://groups.test": [
2935 "fqdnGroup1",
3036 "fqdnGroup2"
@@ -239,6 +245,18 @@ var _ = Describe("Claim Extractor Suite", func() {
239245 expectedValue: []interface{}{"fqdnGroup1", "fqdnGroup2"},
240246 expectedError: nil,
241247 }),
248+ Entry("retrieves claim with nested groups claim containing hyphen", getClaimTableInput{
249+ testClaimExtractorOpts: testClaimExtractorOpts{
250+ idTokenPayload: basicIDTokenPayload,
251+ setProfileURL: true,
252+ profileRequestHeaders: newAuthorizedHeader(),
253+ profileRequestHandler: shouldNotBeRequestedProfileHandler,
254+ },
255+ claim: "nested-groups-claim-containing-hyphen.groups",
256+ expectExists: true,
257+ expectedValue: []interface{}{"nestedClaimContainingHypenGroup1", "nestedClaimContainingHypenGroup2"},
258+ expectedError: nil,
259+ }),
242260 )
243261 })
244262