git.iko.soy/typeable/oauth2-proxy
on master help sign in
Add Authorization header flags
commit68d416489760788db84e1dd315d54101f2fcb2dd authorJoel Speed <Joel.speed@hotmail.co.uk> dateSat 27 Jan 2018, 10:14 (9 years ago) parentc8ca0c8
6 files changed+20−1
compare with master
unifiedsplit
main.go+2 oauthproxy.go+11−1 options.go+4 providers/google.go+1 providers/oidc.go+1 providers/session_state.go+1
main.go+2
@@ -37,6 +37,8 @@ func main() {
3737 flagSet.String("basic-auth-password", "", "the password to set when passing the HTTP Basic Auth header")
3838 flagSet.Bool("pass-access-token", false, "pass OAuth access_token to upstream via X-Forwarded-Access-Token header")
3939 flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")
40+ flagSet.Bool("pass-authorization-header", false, "pass the Authorization Header to upstream")
41+ flagSet.Bool("set-authorization-header", false, "set Authorization response headers (useful in Nginx auth_request mode)")
4042 flagSet.Var(&skipAuthRegex, "skip-auth-regex", "bypass authentication for requests path's that match (may be given multiple times)")
4143 flagSet.Bool("skip-provider-button", false, "will skip sign-in-page to directly reach the next step: oauth/start")
4244 flagSet.Bool("skip-auth-preflight", false, "will skip authentication for OPTIONS requests")
oauthproxy.go+11−1
@@ -76,6 +76,8 @@ type OAuthProxy struct {
7676 PassUserHeaders bool
7777 BasicAuthPassword string
7878 PassAccessToken bool
79+ SetAuthorization bool
80+ PassAuthorization bool
7981 CookieCipher *cookie.Cipher
8082 skipAuthRegex []string
8183 skipAuthPreflight bool
@@ -183,7 +185,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {
183185 log.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domain:%s refresh:%s", opts.CookieName, opts.CookieSecure, opts.CookieHTTPOnly, opts.CookieExpire, opts.CookieDomain, refresh)
184186
185187 var cipher *cookie.Cipher
186− if opts.PassAccessToken || (opts.CookieRefresh != time.Duration(0)) {
188+ if opts.PassAccessToken || opts.SetAuthorization || opts.PassAuthorization || (opts.CookieRefresh != time.Duration(0)) {
187189 var err error
188190 cipher, err = cookie.NewCipher(secretBytes(opts.CookieSecret))
189191 if err != nil {
@@ -222,6 +224,8 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {
222224 PassUserHeaders: opts.PassUserHeaders,
223225 BasicAuthPassword: opts.BasicAuthPassword,
224226 PassAccessToken: opts.PassAccessToken,
227+ SetAuthorization: opts.SetAuthorization,
228+ PassAuthorization: opts.PassAuthorization,
225229 SkipProviderButton: opts.SkipProviderButton,
226230 CookieCipher: cipher,
227231 templates: loadTemplates(opts.CustomTemplatesDir),
@@ -750,6 +754,12 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int
750754 if p.PassAccessToken && session.AccessToken != "" {
751755 req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}
752756 }
757+ if p.PassAuthorization && session.IDToken != "" {
758+ req.Header["Authorization"] = []string{fmt.Sprintf("Bearer %s", session.IDToken)}
759+ }
760+ if p.SetAuthorization && session.IDToken != "" {
761+ rw.Header().Set("Authorization", fmt.Sprintf("Bearer %s", session.IDToken))
762+ }
753763 if session.Email == "" {
754764 rw.Header().Set("GAP-Auth", session.User)
755765 } else {
options.go+4
@@ -61,6 +61,8 @@ type Options struct {
6161 PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers"`
6262 SSLInsecureSkipVerify bool `flag:"ssl-insecure-skip-verify" cfg:"ssl_insecure_skip_verify"`
6363 SetXAuthRequest bool `flag:"set-xauthrequest" cfg:"set_xauthrequest"`
64+ SetAuthorization bool `flag:"set-authorization-header" cfg:"set_authorization_header"`
65+ PassAuthorization bool `flag:"pass-authorization-header" cfg:"pass_authorization_header"`
6466 SkipAuthPreflight bool `flag:"skip-auth-preflight" cfg:"skip_auth_preflight"`
6567
6668 // These options allow for other providers besides Google, with
@@ -113,6 +115,8 @@ func NewOptions() *Options {
113115 PassUserHeaders: true,
114116 PassAccessToken: false,
115117 PassHostHeader: true,
118+ SetAuthorization: false,
119+ PassAuthorization: false,
116120 ApprovalPrompt: "force",
117121 RequestLogging: true,
118122 RequestLoggingFormat: defaultRequestLoggingFormat,
providers/google.go+1
@@ -145,6 +145,7 @@ func (p *GoogleProvider) Redeem(redirectURL, code string) (s *SessionState, err
145145 }
146146 s = &SessionState{
147147 AccessToken: jsonResponse.AccessToken,
148+ IDToken: jsonResponse.IDToken,
148149 ExpiresOn: time.Now().Add(time.Duration(jsonResponse.ExpiresIn) * time.Second).Truncate(time.Second),
149150 RefreshToken: jsonResponse.RefreshToken,
150151 Email: email,
providers/oidc.go+1
@@ -68,6 +68,7 @@ func (p *OIDCProvider) Redeem(redirectURL, code string) (s *SessionState, err er
6868
6969 s = &SessionState{
7070 AccessToken: token.AccessToken,
71+ IDToken: rawIDToken,
7172 RefreshToken: token.RefreshToken,
7273 ExpiresOn: token.Expiry,
7374 Email: claims.Email,
providers/session_state.go+1
@@ -12,6 +12,7 @@ import (
1212// SessionState is used to store information about the currently authenticated user session
1313type SessionState struct {
1414 AccessToken string
15+ IDToken string
1516 ExpiresOn time.Time
1617 RefreshToken string
1718 Email string