64f0a9f · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Reinstate preferEmailToUser behaviour for basic auth sessions

commit64f0a9f580fcf4c7dcff0b5af5084ad263bedb81 authorJoel Speed <joel.speed@hotmail.co.uk> dateSun 21 Mar 2021, 18:49 (6 years ago) parentb821827

6 files changed+32−6

compare with master

unifiedsplit

CHANGELOG.md+1 oauthproxy.go+1−1 pkg/apis/options/legacy_options.go+2 pkg/apis/options/options.go+3 pkg/middleware/basic_session.go+17−4 pkg/middleware/basic_session_test.go+8−1

CHANGELOG.md+1

@@ -16,6 +16,7 @@

1616

1717## Changes since v7.0.1

1818

19+- [#1116](https://github.com/oauth2-proxy/oauth2-proxy/pull/1116) Reinstate preferEmailToUser behaviour for basic auth sessions (@JoelSpeed)

1920- [#1115](https://github.com/oauth2-proxy/oauth2-proxy/pull/1115) Fix upstream proxy appending ? to requests (@JoelSpeed)

2021- [#1117](https://github.com/oauth2-proxy/oauth2-proxy/pull/1117) Deprecate GCP HealthCheck option (@JoelSpeed)

2122- [#1104](https://github.com/oauth2-proxy/oauth2-proxy/pull/1104) Allow custom robots text pages (@JoelSpeed)

oauthproxy.go+1−1

@@ -343,7 +343,7 @@ func buildSessionChain(opts *options.Options, sessionStore sessionsapi.SessionSt

343343 }

344344

345345 if validator != nil {

346− chain = chain.Append(middleware.NewBasicAuthSessionLoader(validator, opts.HtpasswdUserGroups))

346+ chain = chain.Append(middleware.NewBasicAuthSessionLoader(validator, opts.HtpasswdUserGroups, opts.LegacyPreferEmailToUser))

347347 }

348348

349349 chain = chain.Append(middleware.NewStoredSessionLoader(&middleware.StoredSessionLoaderOptions{

pkg/apis/options/legacy_options.go+2

@@ -67,6 +67,8 @@ func (l *LegacyOptions) ToOptions() (*Options, error) {

6767 l.Options.InjectRequestHeaders, l.Options.InjectResponseHeaders = l.LegacyHeaders.convert()

6868 l.Options.Server, l.Options.MetricsServer = l.LegacyServer.convert()

6969

70+ l.Options.LegacyPreferEmailToUser = l.LegacyHeaders.PreferEmailToUser

71+

7072 return &l.Options, nil

7173}

7274

pkg/apis/options/options.go+3

@@ -104,6 +104,9 @@ type Options struct {

104104 PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url"`

105105 GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks"`

106106

107+ // This is used for backwards compatibility for basic auth users

108+ LegacyPreferEmailToUser bool `cfg:",internal"`

109+

107110 // internal values that are set after config validation

108111 redirectURL *url.URL

109112 provider providers.Provider

pkg/middleware/basic_session.go+17−4

@@ -11,9 +11,9 @@ import (

1111 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

1212)

1313

14−func NewBasicAuthSessionLoader(validator basic.Validator, sessionGroups []string) alice.Constructor {

14+func NewBasicAuthSessionLoader(validator basic.Validator, sessionGroups []string, preferEmail bool) alice.Constructor {

1515 return func(next http.Handler) http.Handler {

16− return loadBasicAuthSession(validator, sessionGroups, next)

16+ return loadBasicAuthSession(validator, sessionGroups, preferEmail, next)

1717 }

1818}

1919

@@ -22,7 +22,20 @@ func NewBasicAuthSessionLoader(validator basic.Validator, sessionGroups []string

2222// If no authorization header is found, or the header is invalid, no session

2323// will be loaded and the request will be passed to the next handler.

2424// If a session was loaded by a previous handler, it will not be replaced.

25−func loadBasicAuthSession(validator basic.Validator, sessionGroups []string, next http.Handler) http.Handler {

25+func loadBasicAuthSession(validator basic.Validator, sessionGroups []string, preferEmail bool, next http.Handler) http.Handler {

26+ // This is a hack to be backwards compatible with the old PreferEmailToUser option.

27+ // Long term we will have a rich static user configuration option and this will

28+ // be removed.

29+ // TODO(JoelSpeed): Remove this hack once rich static user config is implemented.

30+ getSession := getBasicSession

31+ if preferEmail {

32+ getSession = func(validator basic.Validator, sessionGroups []string, req *http.Request) (*sessionsapi.SessionState, error) {

33+ session, err := getBasicSession(validator, sessionGroups, req)

34+ session.Email = session.User

35+ return session, err

36+ }

37+ }

38+

2639 return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {

2740 scope := middlewareapi.GetRequestScope(req)

2841 // If scope is nil, this will panic.

@@ -33,7 +46,7 @@ func loadBasicAuthSession(validator basic.Validator, sessionGroups []string, nex

3346 return

3447 }

3548

36− session, err := getBasicSession(validator, sessionGroups, req)

49+ session, err := getSession(validator, sessionGroups, req)

3750 if err != nil {

3851 logger.Errorf("Error retrieving session from token in Authorization header: %v", err)

3952 }

pkg/middleware/basic_session_test.go+8−1

@@ -26,6 +26,7 @@ var _ = Describe("Basic Auth Session Suite", func() {

2626

2727 type basicAuthSessionLoaderTableInput struct {

2828 authorizationHeader string

29+ preferEmail bool

2930 sessionGroups []string

3031 existingSession *sessionsapi.SessionState

3132 expectedSession *sessionsapi.SessionState

@@ -55,7 +56,7 @@ var _ = Describe("Basic Auth Session Suite", func() {

5556 // Create the handler with a next handler that will capture the session

5657 // from the scope

5758 var gotSession *sessionsapi.SessionState

58− handler := NewBasicAuthSessionLoader(validator, in.sessionGroups)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

59+ handler := NewBasicAuthSessionLoader(validator, in.sessionGroups, in.preferEmail)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

5960 gotSession = middlewareapi.GetRequestScope(r).Session

6061 }))

6162 handler.ServeHTTP(rw, req)

@@ -118,6 +119,12 @@ var _ = Describe("Basic Auth Session Suite", func() {

118119 existingSession: nil,

119120 expectedSession: &sessionsapi.SessionState{User: "admin", Groups: []string{"a", "b"}},

120121 }),

122+ Entry("Basic Base64(user1:<user1Password>) (with PreferEmailToUser)", basicAuthSessionLoaderTableInput{

123+ authorizationHeader: "Basic dXNlcjE6VXNFck9uM1A0NTU=",

124+ preferEmail: true,

125+ existingSession: nil,

126+ expectedSession: &sessionsapi.SessionState{User: "user1", Email: "user1"},

127+ }),

121128 )

122129 })

123130})