git.iko.soy/typeable/oauth2-proxy
on master help sign in
bugfix: move oidc scope logic to oidc provider
6f6039cJan Larwig
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -7,6 +7,7 @@
7## Breaking Changes
7## Breaking Changes
8
8
9## Changes since v7.5.0
9## Changes since v7.5.0
10+- [#1989](https://github.com/oauth2-proxy/oauth2-proxy/pull/1989) Fix default scope for keycloak-oidc provider
10
11
11# V7.5.0
12# V7.5.0
12
13
providers/oidc.go+11−3
@@ -20,16 +20,24 @@ type OIDCProvider struct {
20 SkipNonce bool
20 SkipNonce bool
21}
21}
22
22
23+const oidcDefaultScope = "openid email profile"
24+
23// NewOIDCProvider initiates a new OIDCProvider
25// NewOIDCProvider initiates a new OIDCProvider
24func NewOIDCProvider(p *ProviderData, opts options.OIDCOptions) *OIDCProvider {
26func NewOIDCProvider(p *ProviderData, opts options.OIDCOptions) *OIDCProvider {
25− p.setProviderDefaults(providerDefaults{
27+ oidcProviderDefaults := providerDefaults{
26 name: "OpenID Connect",
28 name: "OpenID Connect",
27 loginURL: nil,
29 loginURL: nil,
28 redeemURL: nil,
30 redeemURL: nil,
29 profileURL: nil,
31 profileURL: nil,
30 validateURL: nil,
32 validateURL: nil,
31− scope: "",
33+ scope: oidcDefaultScope,
32− })
34+ }
35+
36+ if len(p.AllowedGroups) > 0 {
37+ oidcProviderDefaults.scope += " groups"
38+ }
39+
40+ p.setProviderDefaults(oidcProviderDefaults)
33 p.getAuthorizationHeaderFunc = makeOIDCHeader
41 p.getAuthorizationHeaderFunc = makeOIDCHeader
34
42
35 return &OIDCProvider{
43 return &OIDCProvider{
providers/providers.go−8
@@ -156,14 +156,6 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
156 p.EmailClaim = providerConfig.OIDCConfig.UserIDClaim
156 p.EmailClaim = providerConfig.OIDCConfig.UserIDClaim
157 }
157 }
158
158
159− if providerConfig.Type == "oidc" && p.Scope == "" {
160− p.Scope = "openid email profile"
161−
162− if len(providerConfig.AllowedGroups) > 0 {
163− p.Scope += " groups"
164− }
165− }
166−
167 p.setAllowedGroups(providerConfig.AllowedGroups)
159 p.setAllowedGroups(providerConfig.AllowedGroups)
168
160
169 return p, nil
161 return p, nil