6e02bb4 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Extract Keycloak roles while creating a session from token (#1720)

* extract roles while creating session * add test * adjust changelog * remove unused func * shorten implementation Co-authored-by: Christian Hirsch <christian.hirsch@nitrado.net> Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

commit6e02bb496bb233465937d161053753726e5ff6c9 authorChris <33393789+MrDeerly@users.noreply.github.com> dateTue 9 Aug 2022, 00:28 (4 years ago) parentbcadad4

3 files changed+35

compare with master

unifiedsplit

CHANGELOG.md+2 providers/keycloak_oidc.go+15 providers/keycloak_oidc_test.go+18

CHANGELOG.md+2

@@ -11,6 +11,8 @@

1111

1212- [#1709](https://github.com/oauth2-proxy/oauth2-proxy/pull/1709) Show an alert message when basic auth credentials are invalid (@aiciobanu)

1313

14+- [#1720](https://github.com/oauth2-proxy/oauth2-proxy/pull/1720) Extract roles from authToken, to allow using allowed roles with Keycloak.

15+

1416# V7.3.0

1517

1618## Release Highlights

providers/keycloak_oidc.go+15

@@ -43,6 +43,21 @@ func (p *KeycloakOIDCProvider) addAllowedRoles(roles []string) {

4343 }

4444}

4545

46+// CreateSessionFromToken converts Bearer IDTokens into sessions

47+func (p *KeycloakOIDCProvider) CreateSessionFromToken(ctx context.Context, token string) (*sessions.SessionState, error) {

48+ ss, err := p.OIDCProvider.CreateSessionFromToken(ctx, token)

49+ if err != nil {

50+ return nil, fmt.Errorf("could not create session from token: %v", err)

51+ }

52+

53+ // Extract custom keycloak roles and enrich session

54+ if err := p.extractRoles(ctx, ss); err != nil {

55+ return nil, err

56+ }

57+

58+ return ss, nil

59+}

60+

4661// EnrichSession is called after Redeem to allow providers to enrich session fields

4762// such as User, Email, Groups with provider specific API calls.

4863func (p *KeycloakOIDCProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {

providers/keycloak_oidc_test.go+18

@@ -199,4 +199,22 @@ var _ = Describe("Keycloak OIDC Provider Tests", func() {

199199 Expect(existingSession.Groups).To(BeEquivalentTo([]string{"role:write", "role:default:read"}))

200200 })

201201 })

202+

203+ Context("Create new session from token", func() {

204+ It("should create a session and extract roles ", func() {

205+ server, provider := newTestKeycloakOIDCSetup()

206+ url, err := url.Parse(server.URL)

207+ Expect(err).To(BeNil())

208+ defer server.Close()

209+

210+ provider.ProfileURL = url

211+

212+ session, err := provider.CreateSessionFromToken(context.Background(), getAccessToken())

213+ Expect(err).To(BeNil())

214+ Expect(session.ExpiresOn).ToNot(BeNil())

215+ Expect(session.CreatedAt).ToNot(BeNil())

216+ Expect(session.Groups).To(BeEquivalentTo([]string{"role:write", "role:default:read"}))

217+ })

218+ })

219+

202220})