git.iko.soy/typeable/oauth2-proxy
on master help sign in
*: rename Oauth to OAuth
6db1880Brandon Philips
main.go+3−3
compare with master
unifiedsplit
@@ -66,8 +66,8 @@ func main() {
66 flagSet.String("redeem-url", "", "Token redemption endpoint")
66 flagSet.String("redeem-url", "", "Token redemption endpoint")
67 flagSet.String("profile-url", "", "Profile access endpoint")
67 flagSet.String("profile-url", "", "Profile access endpoint")
68 flagSet.String("validate-url", "", "Access token validation endpoint")
68 flagSet.String("validate-url", "", "Access token validation endpoint")
69− flagSet.String("scope", "", "Oauth scope specification")
69+ flagSet.String("scope", "", "OAuth scope specification")
70− flagSet.String("approval-prompt", "force", "Oauth approval_prompt")
70+ flagSet.String("approval-prompt", "force", "OAuth approval_prompt")
71
71
72 flagSet.Parse(os.Args[1:])
72 flagSet.Parse(os.Args[1:])
73
73
@@ -95,7 +95,7 @@ func main() {
95 }
95 }
96
96
97 validator := NewValidator(opts.EmailDomains, opts.AuthenticatedEmailsFile)
97 validator := NewValidator(opts.EmailDomains, opts.AuthenticatedEmailsFile)
98− oauthproxy := NewOauthProxy(opts, validator)
98+ oauthproxy := NewOAuthProxy(opts, validator)
99
99
100 if len(opts.EmailDomains) != 0 && opts.AuthenticatedEmailsFile == "" {
100 if len(opts.EmailDomains) != 0 && opts.AuthenticatedEmailsFile == "" {
101 if len(opts.EmailDomains) > 1 {
101 if len(opts.EmailDomains) > 1 {
oauthproxy.go+33−33
@@ -18,7 +18,7 @@ import (
18 "github.com/bitly/oauth2_proxy/providers"
18 "github.com/bitly/oauth2_proxy/providers"
19)
19)
20
20
21−type OauthProxy struct {
21+type OAuthProxy struct {
22 CookieSeed string
22 CookieSeed string
23 CookieName string
23 CookieName string
24 CookieDomain string
24 CookieDomain string
@@ -31,8 +31,8 @@ type OauthProxy struct {
31 RobotsPath string
31 RobotsPath string
32 PingPath string
32 PingPath string
33 SignInPath string
33 SignInPath string
34− OauthStartPath string
34+ OAuthStartPath string
35− OauthCallbackPath string
35+ OAuthCallbackPath string
36
36
37 redirectURL *url.URL // the url to receive requests at
37 redirectURL *url.URL // the url to receive requests at
38 provider providers.Provider
38 provider providers.Provider
@@ -86,7 +86,7 @@ func NewFileServer(path string, filesystemPath string) (proxy http.Handler) {
86 return http.StripPrefix(path, http.FileServer(http.Dir(filesystemPath)))
86 return http.StripPrefix(path, http.FileServer(http.Dir(filesystemPath)))
87}
87}
88
88
89−func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
89+func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {
90 serveMux := http.NewServeMux()
90 serveMux := http.NewServeMux()
91 for _, u := range opts.proxyURLs {
91 for _, u := range opts.proxyURLs {
92 path := u.Path
92 path := u.Path
@@ -119,7 +119,7 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
119 redirectURL := opts.redirectURL
119 redirectURL := opts.redirectURL
120 redirectURL.Path = fmt.Sprintf("%s/callback", opts.ProxyPrefix)
120 redirectURL.Path = fmt.Sprintf("%s/callback", opts.ProxyPrefix)
121
121
122− log.Printf("OauthProxy configured for %s Client ID: %s", opts.provider.Data().ProviderName, opts.ClientID)
122+ log.Printf("OAuthProxy configured for %s Client ID: %s", opts.provider.Data().ProviderName, opts.ClientID)
123 domain := opts.CookieDomain
123 domain := opts.CookieDomain
124 if domain == "" {
124 if domain == "" {
125 domain = "<default>"
125 domain = "<default>"
@@ -141,7 +141,7 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
141 }
141 }
142 }
142 }
143
143
144− return &OauthProxy{
144+ return &OAuthProxy{
145 CookieName: opts.CookieName,
145 CookieName: opts.CookieName,
146 CookieSeed: opts.CookieSecret,
146 CookieSeed: opts.CookieSecret,
147 CookieDomain: opts.CookieDomain,
147 CookieDomain: opts.CookieDomain,
@@ -154,8 +154,8 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
154 RobotsPath: "/robots.txt",
154 RobotsPath: "/robots.txt",
155 PingPath: "/ping",
155 PingPath: "/ping",
156 SignInPath: fmt.Sprintf("%s/sign_in", opts.ProxyPrefix),
156 SignInPath: fmt.Sprintf("%s/sign_in", opts.ProxyPrefix),
157− OauthStartPath: fmt.Sprintf("%s/start", opts.ProxyPrefix),
157+ OAuthStartPath: fmt.Sprintf("%s/start", opts.ProxyPrefix),
158− OauthCallbackPath: fmt.Sprintf("%s/callback", opts.ProxyPrefix),
158+ OAuthCallbackPath: fmt.Sprintf("%s/callback", opts.ProxyPrefix),
159
159
160 ProxyPrefix: opts.ProxyPrefix,
160 ProxyPrefix: opts.ProxyPrefix,
161 provider: opts.provider,
161 provider: opts.provider,
@@ -171,7 +171,7 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {
171 }
171 }
172}
172}
173
173
174−func (p *OauthProxy) GetRedirectURI(host string) string {
174+func (p *OAuthProxy) GetRedirectURI(host string) string {
175 // default to the request Host if not set
175 // default to the request Host if not set
176 if p.redirectURL.Host != "" {
176 if p.redirectURL.Host != "" {
177 return p.redirectURL.String()
177 return p.redirectURL.String()
@@ -189,11 +189,11 @@ func (p *OauthProxy) GetRedirectURI(host string) string {
189 return u.String()
189 return u.String()
190}
190}
191
191
192−func (p *OauthProxy) displayCustomLoginForm() bool {
192+func (p *OAuthProxy) displayCustomLoginForm() bool {
193 return p.HtpasswdFile != nil && p.DisplayHtpasswdForm
193 return p.HtpasswdFile != nil && p.DisplayHtpasswdForm
194}
194}
195
195
196−func (p *OauthProxy) redeemCode(host, code string) (s *providers.SessionState, err error) {
196+func (p *OAuthProxy) redeemCode(host, code string) (s *providers.SessionState, err error) {
197 if code == "" {
197 if code == "" {
198 return nil, errors.New("missing code")
198 return nil, errors.New("missing code")
199 }
199 }
@@ -209,7 +209,7 @@ func (p *OauthProxy) redeemCode(host, code string) (s *providers.SessionState, e
209 return
209 return
210}
210}
211
211
212−func (p *OauthProxy) MakeCookie(req *http.Request, value string, expiration time.Duration, now time.Time) *http.Cookie {
212+func (p *OAuthProxy) MakeCookie(req *http.Request, value string, expiration time.Duration, now time.Time) *http.Cookie {
213 domain := req.Host
213 domain := req.Host
214 if h, _, err := net.SplitHostPort(domain); err == nil {
214 if h, _, err := net.SplitHostPort(domain); err == nil {
215 domain = h
215 domain = h
@@ -235,15 +235,15 @@ func (p *OauthProxy) MakeCookie(req *http.Request, value string, expiration time
235 }
235 }
236}
236}
237
237
238−func (p *OauthProxy) ClearCookie(rw http.ResponseWriter, req *http.Request) {
238+func (p *OAuthProxy) ClearCookie(rw http.ResponseWriter, req *http.Request) {
239 http.SetCookie(rw, p.MakeCookie(req, "", time.Hour*-1, time.Now()))
239 http.SetCookie(rw, p.MakeCookie(req, "", time.Hour*-1, time.Now()))
240}
240}
241
241
242−func (p *OauthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val string) {
242+func (p *OAuthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val string) {
243 http.SetCookie(rw, p.MakeCookie(req, val, p.CookieExpire, time.Now()))
243 http.SetCookie(rw, p.MakeCookie(req, val, p.CookieExpire, time.Now()))
244}
244}
245
245
246−func (p *OauthProxy) LoadCookiedSession(req *http.Request) (*providers.SessionState, time.Duration, error) {
246+func (p *OAuthProxy) LoadCookiedSession(req *http.Request) (*providers.SessionState, time.Duration, error) {
247 var age time.Duration
247 var age time.Duration
248 c, err := req.Cookie(p.CookieName)
248 c, err := req.Cookie(p.CookieName)
249 if err != nil {
249 if err != nil {
@@ -264,7 +264,7 @@ func (p *OauthProxy) LoadCookiedSession(req *http.Request) (*providers.SessionSt
264 return session, age, nil
264 return session, age, nil
265}
265}
266
266
267−func (p *OauthProxy) SaveSession(rw http.ResponseWriter, req *http.Request, s *providers.SessionState) error {
267+func (p *OAuthProxy) SaveSession(rw http.ResponseWriter, req *http.Request, s *providers.SessionState) error {
268 value, err := p.provider.CookieForSession(s, p.CookieCipher)
268 value, err := p.provider.CookieForSession(s, p.CookieCipher)
269 if err != nil {
269 if err != nil {
270 return err
270 return err
@@ -273,17 +273,17 @@ func (p *OauthProxy) SaveSession(rw http.ResponseWriter, req *http.Request, s *p
273 return nil
273 return nil
274}
274}
275
275
276−func (p *OauthProxy) RobotsTxt(rw http.ResponseWriter) {
276+func (p *OAuthProxy) RobotsTxt(rw http.ResponseWriter) {
277 rw.WriteHeader(http.StatusOK)
277 rw.WriteHeader(http.StatusOK)
278 fmt.Fprintf(rw, "User-agent: *\nDisallow: /")
278 fmt.Fprintf(rw, "User-agent: *\nDisallow: /")
279}
279}
280
280
281−func (p *OauthProxy) PingPage(rw http.ResponseWriter) {
281+func (p *OAuthProxy) PingPage(rw http.ResponseWriter) {
282 rw.WriteHeader(http.StatusOK)
282 rw.WriteHeader(http.StatusOK)
283 fmt.Fprintf(rw, "OK")
283 fmt.Fprintf(rw, "OK")
284}
284}
285
285
286−func (p *OauthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, message string) {
286+func (p *OAuthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, message string) {
287 log.Printf("ErrorPage %d %s %s", code, title, message)
287 log.Printf("ErrorPage %d %s %s", code, title, message)
288 rw.WriteHeader(code)
288 rw.WriteHeader(code)
289 t := struct {
289 t := struct {
@@ -298,7 +298,7 @@ func (p *OauthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, m
298 p.templates.ExecuteTemplate(rw, "error.html", t)
298 p.templates.ExecuteTemplate(rw, "error.html", t)
299}
299}
300
300
301−func (p *OauthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code int) {
301+func (p *OAuthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code int) {
302 p.ClearCookie(rw, req)
302 p.ClearCookie(rw, req)
303 rw.WriteHeader(code)
303 rw.WriteHeader(code)
304
304
@@ -325,7 +325,7 @@ func (p *OauthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code
325 p.templates.ExecuteTemplate(rw, "sign_in.html", t)
325 p.templates.ExecuteTemplate(rw, "sign_in.html", t)
326}
326}
327
327
328−func (p *OauthProxy) ManualSignIn(rw http.ResponseWriter, req *http.Request) (string, bool) {
328+func (p *OAuthProxy) ManualSignIn(rw http.ResponseWriter, req *http.Request) (string, bool) {
329 if req.Method != "POST" || p.HtpasswdFile == nil {
329 if req.Method != "POST" || p.HtpasswdFile == nil {
330 return "", false
330 return "", false
331 }
331 }
@@ -342,7 +342,7 @@ func (p *OauthProxy) ManualSignIn(rw http.ResponseWriter, req *http.Request) (st
342 return "", false
342 return "", false
343}
343}
344
344
345−func (p *OauthProxy) GetRedirect(req *http.Request) (string, error) {
345+func (p *OAuthProxy) GetRedirect(req *http.Request) (string, error) {
346 err := req.ParseForm()
346 err := req.ParseForm()
347
347
348 if err != nil {
348 if err != nil {
@@ -358,7 +358,7 @@ func (p *OauthProxy) GetRedirect(req *http.Request) (string, error) {
358 return redirect, err
358 return redirect, err
359}
359}
360
360
361−func (p *OauthProxy) IsWhitelistedPath(path string) (ok bool) {
361+func (p *OAuthProxy) IsWhitelistedPath(path string) (ok bool) {
362 for _, u := range p.compiledRegex {
362 for _, u := range p.compiledRegex {
363 ok = u.MatchString(path)
363 ok = u.MatchString(path)
364 if ok {
364 if ok {
@@ -376,7 +376,7 @@ func getRemoteAddr(req *http.Request) (s string) {
376 return
376 return
377}
377}
378
378
379−func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
379+func (p *OAuthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
380 switch path := req.URL.Path; {
380 switch path := req.URL.Path; {
381 case path == p.RobotsPath:
381 case path == p.RobotsPath:
382 p.RobotsTxt(rw)
382 p.RobotsTxt(rw)
@@ -386,16 +386,16 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
386 p.serveMux.ServeHTTP(rw, req)
386 p.serveMux.ServeHTTP(rw, req)
387 case path == p.SignInPath:
387 case path == p.SignInPath:
388 p.SignIn(rw, req)
388 p.SignIn(rw, req)
389− case path == p.OauthStartPath:
389+ case path == p.OAuthStartPath:
390− p.OauthStart(rw, req)
390+ p.OAuthStart(rw, req)
391− case path == p.OauthCallbackPath:
391+ case path == p.OAuthCallbackPath:
392− p.OauthCallback(rw, req)
392+ p.OAuthCallback(rw, req)
393 default:
393 default:
394 p.Proxy(rw, req)
394 p.Proxy(rw, req)
395 }
395 }
396}
396}
397
397
398−func (p *OauthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {
398+func (p *OAuthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {
399 redirect, err := p.GetRedirect(req)
399 redirect, err := p.GetRedirect(req)
400 if err != nil {
400 if err != nil {
401 p.ErrorPage(rw, 500, "Internal Error", err.Error())
401 p.ErrorPage(rw, 500, "Internal Error", err.Error())
@@ -412,7 +412,7 @@ func (p *OauthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {
412 }
412 }
413}
413}
414
414
415−func (p *OauthProxy) OauthStart(rw http.ResponseWriter, req *http.Request) {
415+func (p *OAuthProxy) OAuthStart(rw http.ResponseWriter, req *http.Request) {
416 redirect, err := p.GetRedirect(req)
416 redirect, err := p.GetRedirect(req)
417 if err != nil {
417 if err != nil {
418 p.ErrorPage(rw, 500, "Internal Error", err.Error())
418 p.ErrorPage(rw, 500, "Internal Error", err.Error())
@@ -422,7 +422,7 @@ func (p *OauthProxy) OauthStart(rw http.ResponseWriter, req *http.Request) {
422 http.Redirect(rw, req, p.provider.GetLoginURL(redirectURI, redirect), 302)
422 http.Redirect(rw, req, p.provider.GetLoginURL(redirectURI, redirect), 302)
423}
423}
424
424
425−func (p *OauthProxy) OauthCallback(rw http.ResponseWriter, req *http.Request) {
425+func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
426 remoteAddr := getRemoteAddr(req)
426 remoteAddr := getRemoteAddr(req)
427
427
428 // finish the oauth cycle
428 // finish the oauth cycle
@@ -465,7 +465,7 @@ func (p *OauthProxy) OauthCallback(rw http.ResponseWriter, req *http.Request) {
465 }
465 }
466}
466}
467
467
468−func (p *OauthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
468+func (p *OAuthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
469 var saveSession, clearSession, revalidated bool
469 var saveSession, clearSession, revalidated bool
470 remoteAddr := getRemoteAddr(req)
470 remoteAddr := getRemoteAddr(req)
471
471
@@ -555,7 +555,7 @@ func (p *OauthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
555 p.serveMux.ServeHTTP(rw, req)
555 p.serveMux.ServeHTTP(rw, req)
556}
556}
557
557
558−func (p *OauthProxy) CheckBasicAuth(req *http.Request) (*providers.SessionState, error) {
558+func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*providers.SessionState, error) {
559 if p.HtpasswdFile == nil {
559 if p.HtpasswdFile == nil {
560 return nil, nil
560 return nil, nil
561 }
561 }
oauthproxy_test.go+8−8
@@ -80,7 +80,7 @@ func TestRobotsTxt(t *testing.T) {
80 opts.CookieSecret = "xyzzyplugh"
80 opts.CookieSecret = "xyzzyplugh"
81 opts.Validate()
81 opts.Validate()
82
82
83− proxy := NewOauthProxy(opts, func(string) bool { return true })
83+ proxy := NewOAuthProxy(opts, func(string) bool { return true })
84 rw := httptest.NewRecorder()
84 rw := httptest.NewRecorder()
85 req, _ := http.NewRequest("GET", "/robots.txt", nil)
85 req, _ := http.NewRequest("GET", "/robots.txt", nil)
86 proxy.ServeHTTP(rw, req)
86 proxy.ServeHTTP(rw, req)
@@ -144,7 +144,7 @@ func TestBasicAuthPassword(t *testing.T) {
144 EmailAddress: email_address,
144 EmailAddress: email_address,
145 }
145 }
146
146
147− proxy := NewOauthProxy(opts, func(email string) bool {
147+ proxy := NewOAuthProxy(opts, func(email string) bool {
148 return email == email_address
148 return email == email_address
149 })
149 })
150
150
@@ -199,7 +199,7 @@ func (tp *TestProvider) ValidateSessionState(session *providers.SessionState) bo
199
199
200type PassAccessTokenTest struct {
200type PassAccessTokenTest struct {
201 provider_server *httptest.Server
201 provider_server *httptest.Server
202− proxy *OauthProxy
202+ proxy *OAuthProxy
203 opts *Options
203 opts *Options
204}
204}
205
205
@@ -265,7 +265,7 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTes
265 EmailAddress: email_address,
265 EmailAddress: email_address,
266 }
266 }
267
267
268− t.proxy = NewOauthProxy(t.opts, func(email string) bool {
268+ t.proxy = NewOAuthProxy(t.opts, func(email string) bool {
269 return email == email_address
269 return email == email_address
270 })
270 })
271 return t
271 return t
@@ -360,7 +360,7 @@ func TestDoNotForwardAccessTokenUpstream(t *testing.T) {
360
360
361type SignInPageTest struct {
361type SignInPageTest struct {
362 opts *Options
362 opts *Options
363− proxy *OauthProxy
363+ proxy *OAuthProxy
364 sign_in_regexp *regexp.Regexp
364 sign_in_regexp *regexp.Regexp
365}
365}
366
366
@@ -375,7 +375,7 @@ func NewSignInPageTest() *SignInPageTest {
375 sip_test.opts.ClientSecret = "xyzzyplugh"
375 sip_test.opts.ClientSecret = "xyzzyplugh"
376 sip_test.opts.Validate()
376 sip_test.opts.Validate()
377
377
378− sip_test.proxy = NewOauthProxy(sip_test.opts, func(email string) bool {
378+ sip_test.proxy = NewOAuthProxy(sip_test.opts, func(email string) bool {
379 return true
379 return true
380 })
380 })
381 sip_test.sign_in_regexp = regexp.MustCompile(signInRedirectPattern)
381 sip_test.sign_in_regexp = regexp.MustCompile(signInRedirectPattern)
@@ -425,7 +425,7 @@ func TestSignInPageDirectAccessRedirectsToRoot(t *testing.T) {
425
425
426type ProcessCookieTest struct {
426type ProcessCookieTest struct {
427 opts *Options
427 opts *Options
428− proxy *OauthProxy
428+ proxy *OAuthProxy
429 rw *httptest.ResponseRecorder
429 rw *httptest.ResponseRecorder
430 req *http.Request
430 req *http.Request
431 provider TestProvider
431 provider TestProvider
@@ -449,7 +449,7 @@ func NewProcessCookieTest(opts ProcessCookieTestOpts) *ProcessCookieTest {
449 pc_test.opts.CookieRefresh = time.Hour
449 pc_test.opts.CookieRefresh = time.Hour
450 pc_test.opts.Validate()
450 pc_test.opts.Validate()
451
451
452− pc_test.proxy = NewOauthProxy(pc_test.opts, func(email string) bool {
452+ pc_test.proxy = NewOAuthProxy(pc_test.opts, func(email string) bool {
453 return pc_test.validate_user
453 return pc_test.validate_user
454 })
454 })
455 pc_test.proxy.provider = &TestProvider{
455 pc_test.proxy.provider = &TestProvider{