6c690b6 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge pull request #339 from omazhary/issue-205

Allow to pass user headers only

commit6c690b699b7b982cfa16f0d0a087b7c6bca2c911 authorJehiah Czebotar <jehiah@gmail.com> dateTue 28 Mar 2017, 21:42 (10 years ago) parent107b481 24f91a0

6 files changed+14

compare with master

unifiedsplit

README.md+1 contrib/oauth2_proxy.cfg.example+1 main.go+1 oauthproxy.go+8 oauthproxy_test.go+1 options.go+2

README.md+1

@@ -187,6 +187,7 @@ Usage of oauth2_proxy:

187187 -login-url="": Authentication endpoint

188188 -pass-access-token=false: pass OAuth access_token to upstream via X-Forwarded-Access-Token header

189189 -pass-basic-auth=true: pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream

190+ -pass-user-headers=true: pass X-Forwarded-User and X-Forwarded-Email information to upstream

190191 -pass-host-header=true: pass the request Host Header to upstream

191192 -profile-url="": Profile access endpoint

192193 -provider="google": OAuth provider

contrib/oauth2_proxy.cfg.example+1

@@ -23,6 +23,7 @@

2323

2424## pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream

2525# pass_basic_auth = true

26+# pass_user_headers = true

2627## pass the request Host Header to upstream

2728## when disabled the upstream Host is used as the Host Header

2829# pass_host_header = true

main.go+1

@@ -32,6 +32,7 @@ func main() {

3232 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")

3333 flagSet.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path")

3434 flagSet.Bool("pass-basic-auth", true, "pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream")

35+ flagSet.Bool("pass-user-headers", true, "pass X-Forwarded-User and X-Forwarded-Email information to upstream")

3536 flagSet.String("basic-auth-password", "", "the password to set when passing the HTTP Basic Auth header")

3637 flagSet.Bool("pass-access-token", false, "pass OAuth access_token to upstream via X-Forwarded-Access-Token header")

3738 flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")

oauthproxy.go+8

@@ -61,6 +61,7 @@ type OAuthProxy struct {

6161 serveMux http.Handler

6262 PassBasicAuth bool

6363 SkipProviderButton bool

64+ PassUserHeaders bool

6465 BasicAuthPassword string

6566 PassAccessToken bool

6667 CookieCipher *cookie.Cipher

@@ -196,6 +197,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

196197 skipAuthRegex: opts.SkipAuthRegex,

197198 compiledRegex: opts.CompiledRegex,

198199 PassBasicAuth: opts.PassBasicAuth,

200+ PassUserHeaders: opts.PassUserHeaders,

199201 BasicAuthPassword: opts.BasicAuthPassword,

200202 PassAccessToken: opts.PassAccessToken,

201203 SkipProviderButton: opts.SkipProviderButton,

@@ -615,6 +617,12 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int

615617 req.Header["X-Forwarded-Email"] = []string{session.Email}

616618 }

617619 }

620+ if p.PassUserHeaders {

621+ req.Header["X-Forwarded-User"] = []string{session.User}

622+ if session.Email != "" {

623+ req.Header["X-Forwarded-Email"] = []string{session.Email}

624+ }

625+ }

618626 if p.PassAccessToken && session.AccessToken != "" {

619627 req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}

620628 }

oauthproxy_test.go+1

@@ -156,6 +156,7 @@ func TestBasicAuthPassword(t *testing.T) {

156156 opts.ClientSecret = "foobar"

157157 opts.CookieSecure = false

158158 opts.PassBasicAuth = true

159+ opts.PassUserHeaders = true

159160 opts.BasicAuthPassword = "This is a secure password"

160161 opts.Validate()

161162

options.go+2

@@ -54,6 +54,7 @@ type Options struct {

5454 PassAccessToken bool `flag:"pass-access-token" cfg:"pass_access_token"`

5555 PassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header"`

5656 SkipProviderButton bool `flag:"skip-provider-button" cfg:"skip_provider_button"`

57+ PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers"`

5758

5859 // These options allow for other providers besides Google, with

5960 // potential overrides.

@@ -95,6 +96,7 @@ func NewOptions() *Options {

9596 CookieExpire: time.Duration(168) * time.Hour,

9697 CookieRefresh: time.Duration(0),

9798 PassBasicAuth: true,

99+ PassUserHeaders: true,

98100 PassAccessToken: false,

99101 PassHostHeader: true,

100102 SkipProviderButton: false,