66f1063 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

feat: add X-Envoy-External-Address as supported header (#2755)

66f1063bjencks2 years ago

CHANGELOG.md+1

compare with master

unifiedsplit

@@ -9,6 +9,7 @@

9## Changes since v7.7.1

11- [#2800](https://github.com/oauth2-proxy/oauth2-proxy/pull/2800) Add some opencontainer labels to docker image (@halkeye)

12+- [#2755](https://github.com/oauth2-proxy/oauth2-proxy/pull/2755) feat: add X-Envoy-External-Address as supported header (@bjencks)

13# V7.7.1

14# V7.7.1

docs/docs/configuration/overview.md+28−24

@@ -15,43 +15,43 @@ import TabItem from '@theme/TabItem';

15<Tabs defaultValue="python">

16 <TabItem value="python" label="Python">

18− ```shell

18+```shell

19− python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'

19+python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'

20− ```

20+```

21−

21+

22 </TabItem>

23 <TabItem value="bash" label="Bash">

25− ```shell

25+```shell

26− dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo

26+dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_' ; echo

27− ```

27+```

28−

28+

29 </TabItem>

30 <TabItem value="openssl" label="OpenSSL">

32− ```shell

32+```shell

33− openssl rand -base64 32 | tr -- '+/' '-_'

33+openssl rand -base64 32 | tr -- '+/' '-_'

34− ```

34+```

36 </TabItem>

37 <TabItem value="powershell" label="PowerShell">

39− ```powershell

39+```powershell

40− # Add System.Web assembly to session, just in case

40+# Add System.Web assembly to session, just in case

41− Add-Type -AssemblyName System.Web

41+Add-Type -AssemblyName System.Web

42− [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")

42+[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")

43− ```

43+```

45 </TabItem>

46 <TabItem value="terraform" label="Terraform">

48− ```hcl

48+```hcl

49− # Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret

49+# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret

50− resource "random_password" "cookie_secret" {

50+resource "random_password" "cookie_secret" {

51− length = 32

51+ length = 32

52− override_special = "-_"

52+ override_special = "-_"

53− }

53+}

54− ```

54+```

56 </TabItem>

57</Tabs>

@@ -199,7 +199,7 @@ Provider specific options can be found on their respective subpages.

199| flag: `--htpasswd-file` toml: `htpasswd_file` | string | additionally authenticate against a htpasswd file. Entries must be created with `htpasswd -B` for bcrypt encryption | |

202−| flag: `--real-client-ip-header` toml: `real_client_ip_header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP) | X-Real-IP |

202+| flag: `--real-client-ip-header` toml: `real_client_ip_header` | string | Header used to determine the real IP of the client, requires `--reverse-proxy` to be set (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, or X-Envoy-External-Address) | X-Real-IP |

205| flag: `--reverse-proxy` toml: `reverse_proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |

@@ -231,6 +231,7 @@ Provider specific options can be found on their respective subpages.

232

233### Session Options

234+

235| ----------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |

236| ----------------------------------------------------------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |

@@ -307,6 +308,7 @@ Each type of logging has its own configurable format and variables. By default,

307Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) and the `/ready` endpoint can be disabled with `--silence-ping-logging` reducing log volume.

308Logging of requests to the `/ping` endpoint (or using `--ping-user-agent`) and the `/ready` endpoint can be disabled with `--silence-ping-logging` reducing log volume.

308

309

309## Auth Log Format

310## Auth Log Format

311+

310Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:

312Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:

311

313

312```

314```

@@ -342,6 +344,7 @@ Available variables for auth logging:

342| Status | AuthSuccess | The status of the auth request. See above for details. |

344| Status | AuthSuccess | The status of the auth request. See above for details. |

343

345

344## Request Log Format

346## Request Log Format

347+

345HTTP request logs will output by default in the below format:

348HTTP request logs will output by default in the below format:

346

349

347```

350```

@@ -374,6 +377,7 @@ Available variables for request logging:

374| Username | username@email.com | The email or username of the auth request. |

377| Username | username@email.com | The email or username of the auth request. |

375

378

376## Standard Log Format

379## Standard Log Format

380+

377All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:

381All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:

378

382

379```

383```

pkg/apis/options/options.go+1−1

@@ -116,7 +116,7 @@ func NewFlagSet() *pflag.FlagSet {

116 flagSet := pflag.NewFlagSet("oauth2-proxy", pflag.ExitOnError)

117

118 flagSet.Bool("reverse-proxy", false, "are we running behind a reverse proxy, controls whether headers like X-Real-Ip are accepted")

119− flagSet.String("real-client-ip-header", "X-Real-IP", "Header used to determine the real IP of the client (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)")

119+ flagSet.String("real-client-ip-header", "X-Real-IP", "Header used to determine the real IP of the client (one of: X-Forwarded-For, X-Real-IP, X-ProxyUser-IP, or X-Envoy-External-Address)")

120 flagSet.StringSlice("trusted-ip", []string{}, "list of IPs or CIDR ranges to allow to bypass authentication. WARNING: trusting by IP has inherent security flaws, read the configuration documentation for more information.")

121 flagSet.Bool("force-https", false, "force HTTPS redirect for HTTP requests")

122 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")

pkg/ip/realclientip.go+4−1

@@ -13,7 +13,10 @@ func GetRealClientIPParser(headerKey string) (ipapi.RealClientIPParser, error) {

13 headerKey = http.CanonicalHeaderKey(headerKey)

15 switch headerKey {

16− case http.CanonicalHeaderKey("X-Forwarded-For"), http.CanonicalHeaderKey("X-Real-IP"), http.CanonicalHeaderKey("X-ProxyUser-IP"):

16+ case http.CanonicalHeaderKey("X-Forwarded-For"),

17+ http.CanonicalHeaderKey("X-Real-IP"),

18+ http.CanonicalHeaderKey("X-ProxyUser-IP"),

19+ http.CanonicalHeaderKey("X-Envoy-External-Address"):

17 return &xForwardedForClientIPParser{header: headerKey}, nil

20 return &xForwardedForClientIPParser{header: headerKey}, nil

18 }

21 }

pkg/ip/realclientip_test.go+1

@@ -21,6 +21,7 @@ func TestGetRealClientIPParser(t *testing.T) {

21 {"X-Forwarded-For", "", forwardedForType},

22 {"X-REAL-IP", "", forwardedForType},

23 {"x-proxyuser-ip", "", forwardedForType},

24+ {"x-envoy-external-address", "", forwardedForType},

24 {"", "the http header key () is either invalid or unsupported", nil},

25 {"", "the http header key () is either invalid or unsupported", nil},

25 {"Forwarded", "the http header key (Forwarded) is either invalid or unsupported", nil},

26 {"Forwarded", "the http header key (Forwarded) is either invalid or unsupported", nil},

26 {"2#* @##$$:kd", "the http header key (2#* @##$$:kd) is either invalid or unsupported", nil},

27 {"2#* @##$$:kd", "the http header key (2#* @##$$:kd) is either invalid or unsupported", nil},