git.iko.soy/typeable/oauth2-proxy
on master help sign in
Support only allowed_groups querystring
commit65e15f24c1bf275919e0961b29ca1ac973a63780 authorNick Meves <nick.meves@greenhouse.io> dateFri 27 Nov 2020, 09:07 (6 years ago) parent025056c
3 files changed+22−28
compare with master
unifiedsplit
CHANGELOG.md+4−4 oauthproxy.go+8−14 oauthproxy_test.go+10−10
CHANGELOG.md+4−4
@@ -7,8 +7,7 @@
77- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) `--user-id-claim` option is deprecated and replaced by `--oidc-email-claim`
88- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled
99- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) `/oauth2/auth` `allowed_groups` querystring parameter can be paired with the `allowed-groups` configuration option.
10− - In this scenario, the user's group must be in both lists to not get a 401 response code.
11− - The `allowed_group` querystring parameter can be specified multiple times to support multiple groups.
10+ - In this scenario, the user's group must be in both lists to not get a 401 or 403 response code.
1211 - The `allowed_groups` querystring parameter can specify multiple comma delimited groups.
1312- [#905](https://github.com/oauth2-proxy/oauth2-proxy/pull/905) Existing sessions from v6.0.0 or earlier are no longer valid. They will trigger a reauthentication.
1413- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) `skip-auth-strip-headers` now applies to all requests, not just those where authentication would be skipped.
@@ -23,7 +22,8 @@
2322- [#575](https://github.com/oauth2-proxy/oauth2-proxy/pull/575) Sessions from v5.1.1 or earlier will no longer validate since they were not signed with SHA1.
2423 - Sessions from v6.0.0 or later had a graceful conversion to SHA256 that resulted in no reauthentication
2524 - Upgrading from v5.1.1 or earlier will result in a reauthentication
26−- [#616](https://github.com/oauth2-proxy/oauth2-proxy/pull/616) Ensure you have configured oauth2-proxy to use the `groups` scope. The user may be logged out initially as they may not currently have the `groups` claim however after going back through login process wil be authenticated.
25+- [#616](https://github.com/oauth2-proxy/oauth2-proxy/pull/616) Ensure you have configured oauth2-proxy to use the `groups` scope.
26+ - The user may be logged out initially as they may not currently have the `groups` claim however after going back through login process wil be authenticated.
2727- [#839](https://github.com/oauth2-proxy/oauth2-proxy/pull/839) Enables complex data structures for group claim entries, which are output as Json by default.
2828
2929## Breaking Changes
@@ -55,7 +55,7 @@
5555- [#816](https://github.com/oauth2-proxy/oauth2-proxy/pull/816) (via [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936)) Support non-list group claims (@loafoe)
5656- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) Refactor OIDC Provider and support groups from Profile URL (@NickMeves)
5757- [#869](https://github.com/oauth2-proxy/oauth2-proxy/pull/869) Streamline provider interface method names and signatures (@NickMeves)
58−- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) Support group authorization on `oauth2/auth` endpoint via `allowed_group` & `allowed_groups` querystring parameters (@NickMeves)
58+- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) Support group authorization on `oauth2/auth` endpoint via `allowed_groups` querystring (@NickMeves)
5959- [#925](https://github.com/oauth2-proxy/oauth2-proxy/pull/925) Fix basic auth legacy header conversion (@JoelSpeed)
6060- [#916](https://github.com/oauth2-proxy/oauth2-proxy/pull/916) Add AlphaOptions struct to prepare for alpha config loading (@JoelSpeed)
6161- [#923](https://github.com/oauth2-proxy/oauth2-proxy/pull/923) Support TLS 1.3 (@aajisaka)
oauthproxy.go+8−14
@@ -1027,8 +1027,8 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R
10271027// authOnlyAuthorize handles special authorization logic that is only done
10281028// on the AuthOnly endpoint for use with Nginx subrequest architectures.
10291029func authOnlyAuthorize(req *http.Request, s *sessionsapi.SessionState) bool {
1030− // Allow secondary group restrictions based on the `allowed_group` or
1031− // `allowed_groups` querystring parameter
1030+ // Allow secondary group restrictions based on the `allowed_groups`
1031+ // querystring parameter
10321032 if !checkAllowedGroups(req, s) {
10331033 return false
10341034 }
@@ -1053,19 +1053,13 @@ func checkAllowedGroups(req *http.Request, s *sessionsapi.SessionState) bool {
10531053
10541054func extractAllowedGroups(req *http.Request) map[string]struct{} {
10551055 groups := map[string]struct{}{}
1056− query := req.URL.Query()
1057−
1058− // multi-key singular support
1059− if multiGroups, ok := query["allowed_group"]; ok {
1060− for _, group := range multiGroups {
1061− groups[group] = struct{}{}
1062− }
1063− }
10641056
1065− // single key plural comma delimited support
1066− for _, group := range strings.Split(query.Get("allowed_groups"), ",") {
1067− if group != "" {
1068− groups[group] = struct{}{}
1057+ query := req.URL.Query()
1058+ for _, allowedGroups := range query["allowed_groups"] {
1059+ for _, group := range strings.Split(allowedGroups, ",") {
1060+ if group != "" {
1061+ groups[group] = struct{}{}
1062+ }
10691063 }
10701064 }
10711065
oauthproxy_test.go+10−10
@@ -2732,7 +2732,14 @@ func TestAuthOnlyAllowedGroups(t *testing.T) {
27322732 name: "UserInQuerystringGroup",
27332733 allowedGroups: []string{"a", "b"},
27342734 groups: []string{"a", "c"},
2735− querystring: "?allowed_group=a",
2735+ querystring: "?allowed_groups=a",
2736+ expectedStatusCode: http.StatusAccepted,
2737+ },
2738+ {
2739+ name: "UserInMultiParamQuerystringGroup",
2740+ allowedGroups: []string{"a", "b"},
2741+ groups: []string{"b"},
2742+ querystring: "?allowed_groups=a&allowed_groups=b,d",
27362743 expectedStatusCode: http.StatusAccepted,
27372744 },
27382745 {
@@ -2742,13 +2749,6 @@ func TestAuthOnlyAllowedGroups(t *testing.T) {
27422749 querystring: "?allowed_groups=a,b",
27432750 expectedStatusCode: http.StatusAccepted,
27442751 },
2745− {
2746− name: "UserInMultiParamQuerystringGroup",
2747− allowedGroups: []string{"a", "b"},
2748− groups: []string{"b"},
2749− querystring: "?allowed_group=a&allowed_group=b",
2750− expectedStatusCode: http.StatusAccepted,
2751− },
27522752 {
27532753 name: "UserInDelimitedQuerystringGroup",
27542754 allowedGroups: []string{"a", "b", "c"},
@@ -2760,14 +2760,14 @@ func TestAuthOnlyAllowedGroups(t *testing.T) {
27602760 name: "UserNotInQuerystringGroup",
27612761 allowedGroups: []string{},
27622762 groups: []string{"c"},
2763− querystring: "?allowed_group=a&allowed_group=b",
2763+ querystring: "?allowed_groups=a,b",
27642764 expectedStatusCode: http.StatusForbidden,
27652765 },
27662766 {
27672767 name: "UserInConfigGroupNotInQuerystringGroup",
27682768 allowedGroups: []string{"a", "b", "c"},
27692769 groups: []string{"c"},
2770− querystring: "?allowed_group=a&allowed_group=b",
2770+ querystring: "?allowed_groups=a,b",
27712771 expectedStatusCode: http.StatusForbidden,
27722772 },
27732773 {