64f0a9f · typeable/oauth2-proxy

CHANGELOG.md+1

compare with master

unifiedsplit

@@ -16,6 +16,7 @@

16

17## Changes since v7.0.1

18

19+- [#1116](https://github.com/oauth2-proxy/oauth2-proxy/pull/1116) Reinstate preferEmailToUser behaviour for basic auth sessions (@JoelSpeed)

19- [#1115](https://github.com/oauth2-proxy/oauth2-proxy/pull/1115) Fix upstream proxy appending ? to requests (@JoelSpeed)

20- [#1115](https://github.com/oauth2-proxy/oauth2-proxy/pull/1115) Fix upstream proxy appending ? to requests (@JoelSpeed)

20- [#1117](https://github.com/oauth2-proxy/oauth2-proxy/pull/1117) Deprecate GCP HealthCheck option (@JoelSpeed)

21- [#1117](https://github.com/oauth2-proxy/oauth2-proxy/pull/1117) Deprecate GCP HealthCheck option (@JoelSpeed)

21- [#1104](https://github.com/oauth2-proxy/oauth2-proxy/pull/1104) Allow custom robots text pages (@JoelSpeed)

22- [#1104](https://github.com/oauth2-proxy/oauth2-proxy/pull/1104) Allow custom robots text pages (@JoelSpeed)

oauthproxy.go+1−1

@@ -343,7 +343,7 @@ func buildSessionChain(opts *options.Options, sessionStore sessionsapi.SessionSt

343 }

344

345 if validator != nil {

346− chain = chain.Append(middleware.NewBasicAuthSessionLoader(validator, opts.HtpasswdUserGroups))

346+ chain = chain.Append(middleware.NewBasicAuthSessionLoader(validator, opts.HtpasswdUserGroups, opts.LegacyPreferEmailToUser))

347 }

348

349 chain = chain.Append(middleware.NewStoredSessionLoader(&middleware.StoredSessionLoaderOptions{

pkg/apis/options/legacy_options.go+2

@@ -67,6 +67,8 @@ func (l *LegacyOptions) ToOptions() (*Options, error) {

67 l.Options.InjectRequestHeaders, l.Options.InjectResponseHeaders = l.LegacyHeaders.convert()

68 l.Options.Server, l.Options.MetricsServer = l.LegacyServer.convert()

69

70+ l.Options.LegacyPreferEmailToUser = l.LegacyHeaders.PreferEmailToUser

71+

70 return &l.Options, nil

72 return &l.Options, nil

71}

73}

72

74

pkg/apis/options/options.go+3

@@ -104,6 +104,9 @@ type Options struct {

104 PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url"`

105 GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks"`

106

107+ // This is used for backwards compatibility for basic auth users

108+ LegacyPreferEmailToUser bool `cfg:",internal"`

109+

107 // internal values that are set after config validation

110 // internal values that are set after config validation

108 redirectURL *url.URL

111 redirectURL *url.URL

109 provider providers.Provider

112 provider providers.Provider

pkg/middleware/basic_session.go+17−4

@@ -11,9 +11,9 @@ import (

11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

12)

13

14−func NewBasicAuthSessionLoader(validator basic.Validator, sessionGroups []string) alice.Constructor {

14+func NewBasicAuthSessionLoader(validator basic.Validator, sessionGroups []string, preferEmail bool) alice.Constructor {

15 return func(next http.Handler) http.Handler {

16− return loadBasicAuthSession(validator, sessionGroups, next)

16+ return loadBasicAuthSession(validator, sessionGroups, preferEmail, next)

17 }

18}

19

@@ -22,7 +22,20 @@ func NewBasicAuthSessionLoader(validator basic.Validator, sessionGroups []string

22// If no authorization header is found, or the header is invalid, no session

23// will be loaded and the request will be passed to the next handler.

24// If a session was loaded by a previous handler, it will not be replaced.

25−func loadBasicAuthSession(validator basic.Validator, sessionGroups []string, next http.Handler) http.Handler {

25+func loadBasicAuthSession(validator basic.Validator, sessionGroups []string, preferEmail bool, next http.Handler) http.Handler {

26+ // This is a hack to be backwards compatible with the old PreferEmailToUser option.

27+ // Long term we will have a rich static user configuration option and this will

28+ // be removed.

29+ // TODO(JoelSpeed): Remove this hack once rich static user config is implemented.

30+ getSession := getBasicSession

31+ if preferEmail {

32+ getSession = func(validator basic.Validator, sessionGroups []string, req *http.Request) (*sessionsapi.SessionState, error) {

33+ session, err := getBasicSession(validator, sessionGroups, req)

34+ session.Email = session.User

35+ return session, err

36+ }

37+ }

38+

26 return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {

39 return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {

27 scope := middlewareapi.GetRequestScope(req)

40 scope := middlewareapi.GetRequestScope(req)

28 // If scope is nil, this will panic.

41 // If scope is nil, this will panic.

@@ -33,7 +46,7 @@ func loadBasicAuthSession(validator basic.Validator, sessionGroups []string, nex

33 return

46 return

34 }

47 }

35

48

36− session, err := getBasicSession(validator, sessionGroups, req)

49+ session, err := getSession(validator, sessionGroups, req)

37 if err != nil {

50 if err != nil {

38 logger.Errorf("Error retrieving session from token in Authorization header: %v", err)

51 logger.Errorf("Error retrieving session from token in Authorization header: %v", err)

39 }

52 }

pkg/middleware/basic_session_test.go+8−1

@@ -26,6 +26,7 @@ var _ = Describe("Basic Auth Session Suite", func() {

26

27 type basicAuthSessionLoaderTableInput struct {

28 authorizationHeader string

29+ preferEmail bool

29 sessionGroups []string

30 sessionGroups []string

30 existingSession *sessionsapi.SessionState

31 existingSession *sessionsapi.SessionState

31 expectedSession *sessionsapi.SessionState

32 expectedSession *sessionsapi.SessionState

@@ -55,7 +56,7 @@ var _ = Describe("Basic Auth Session Suite", func() {

55 // Create the handler with a next handler that will capture the session

56 // Create the handler with a next handler that will capture the session

56 // from the scope

57 // from the scope

57 var gotSession *sessionsapi.SessionState

58 var gotSession *sessionsapi.SessionState

58− handler := NewBasicAuthSessionLoader(validator, in.sessionGroups)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

59+ handler := NewBasicAuthSessionLoader(validator, in.sessionGroups, in.preferEmail)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

59 gotSession = middlewareapi.GetRequestScope(r).Session

60 gotSession = middlewareapi.GetRequestScope(r).Session

60 }))

61 }))

61 handler.ServeHTTP(rw, req)

62 handler.ServeHTTP(rw, req)

@@ -118,6 +119,12 @@ var _ = Describe("Basic Auth Session Suite", func() {

118 existingSession: nil,

119 existingSession: nil,

119 expectedSession: &sessionsapi.SessionState{User: "admin", Groups: []string{"a", "b"}},

120 expectedSession: &sessionsapi.SessionState{User: "admin", Groups: []string{"a", "b"}},

120 }),

121 }),

122+ Entry("Basic Base64(user1:<user1Password>) (with PreferEmailToUser)", basicAuthSessionLoaderTableInput{

123+ authorizationHeader: "Basic dXNlcjE6VXNFck9uM1A0NTU=",

124+ preferEmail: true,

125+ existingSession: nil,

126+ expectedSession: &sessionsapi.SessionState{User: "user1", Email: "user1"},

127+ }),

121 )

128 )

122 })

129 })

123})

130})