git.iko.soy/typeable/oauth2-proxy
on master help sign in
bugfix: move oidc scope logic to oidc provider
commit6f6039c82b18e9c6acd06cf19b3452d823804da6 authorJan Larwig <jan@larwig.com> dateSun 27 Aug 2023, 12:26 (3 years ago) parent01386bf
3 files changed+12−11
compare with master
unifiedsplit
CHANGELOG.md+1 providers/oidc.go+11−3 providers/providers.go−8
CHANGELOG.md+1
@@ -7,6 +7,7 @@
77## Breaking Changes
88
99## Changes since v7.5.0
10+- [#1989](https://github.com/oauth2-proxy/oauth2-proxy/pull/1989) Fix default scope for keycloak-oidc provider
1011
1112# V7.5.0
1213
providers/oidc.go+11−3
@@ -20,16 +20,24 @@ type OIDCProvider struct {
2020 SkipNonce bool
2121}
2222
23+const oidcDefaultScope = "openid email profile"
24+
2325// NewOIDCProvider initiates a new OIDCProvider
2426func NewOIDCProvider(p *ProviderData, opts options.OIDCOptions) *OIDCProvider {
25− p.setProviderDefaults(providerDefaults{
27+ oidcProviderDefaults := providerDefaults{
2628 name: "OpenID Connect",
2729 loginURL: nil,
2830 redeemURL: nil,
2931 profileURL: nil,
3032 validateURL: nil,
31− scope: "",
32− })
33+ scope: oidcDefaultScope,
34+ }
35+
36+ if len(p.AllowedGroups) > 0 {
37+ oidcProviderDefaults.scope += " groups"
38+ }
39+
40+ p.setProviderDefaults(oidcProviderDefaults)
3341 p.getAuthorizationHeaderFunc = makeOIDCHeader
3442
3543 return &OIDCProvider{
providers/providers.go−8
@@ -156,14 +156,6 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
156156 p.EmailClaim = providerConfig.OIDCConfig.UserIDClaim
157157 }
158158
159− if providerConfig.Type == "oidc" && p.Scope == "" {
160− p.Scope = "openid email profile"
161−
162− if len(providerConfig.AllowedGroups) > 0 {
163− p.Scope += " groups"
164− }
165− }
166−
167159 p.setAllowedGroups(providerConfig.AllowedGroups)
168160
169161 return p, nil