git.iko.soy/typeable/oauth2-proxy
on master help sign in
New flag "-ssl-upstream-insecure-skip-validation" (#234)

* New flag "-ssl-upstream-insecure-skip-validation" to skip SSL validation for upstreams with self generated / invalid SSL certificates. * Fix tests for modified NewReverseProxy method. * Added change to the changelog. * Remove duplicate entries from changelog.

commit7134d22bcc9d7504e6082a6cbef97edd7390c71a authorjansinger <jsinger@eggmouse.com> dateWed 7 Aug 2019, 18:48 (7 years ago) parentd856602
6 files changed+33−23
compare with master
unifiedsplit
CHANGELOG.md+1 docs/configuration/configuration.md+2−1 main.go+2−1 oauthproxy.go+9−3 oauthproxy_test.go+2−2 options.go+17−16
CHANGELOG.md+1
@@ -36,6 +36,7 @@
3636
3737## Changes since v3.2.0
3838
39+- [#234](https://github.com/pusher/oauth2_proxy/pull/234) Added option `-ssl-upstream-insecure-skip-validation` to skip validation of upstream SSL certificates (@jansinger)
3940- [#224](https://github.com/pusher/oauth2_proxy/pull/224) Check Google group membership using hasMember to support nested groups and external users (@jpalpant)
4041- [#231](https://github.com/pusher/oauth2_proxy/pull/231) Add optional group membership and email domain checks to the GitLab provider (@Overv)
4142- [#178](https://github.com/pusher/outh2_proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)
docs/configuration/configuration.md+2−1
@@ -99,7 +99,8 @@ Usage of oauth2_proxy:
9999 -skip-jwt-bearer-tokens: will skip requests that have verified JWT bearer tokens
100100 -skip-oidc-discovery: bypass OIDC endpoint discovery. login-url, redeem-url and oidc-jwks-url must be configured in this case
101101 -skip-provider-button: will skip sign-in-page to directly reach the next step: oauth/start
102− -ssl-insecure-skip-verify: skip validation of certificates presented when using HTTPS
102+ -ssl-insecure-skip-verify: skip validation of certificates presented when using HTTPS providers
103+ -ssl-upstream-insecure-skip-verify: skip validation of certificates presented when using HTTPS upstreams
103104 -standard-logging: Log standard runtime information (default true)
104105 -standard-logging-format string: Template for standard log lines (see "Logging Configuration" paragraph below)
105106 -tls-cert-file string: path to certificate file
main.go+2−1
@@ -47,7 +47,8 @@ func main() {
4747 flagSet.Var(&skipAuthRegex, "skip-auth-regex", "bypass authentication for requests path's that match (may be given multiple times)")
4848 flagSet.Bool("skip-provider-button", false, "will skip sign-in-page to directly reach the next step: oauth/start")
4949 flagSet.Bool("skip-auth-preflight", false, "will skip authentication for OPTIONS requests")
50− flagSet.Bool("ssl-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS")
50+ flagSet.Bool("ssl-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS providers")
51+ flagSet.Bool("ssl-upstream-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS upstreams")
5152 flagSet.Duration("flush-interval", time.Duration(1)*time.Second, "period between response flushing when streaming responses")
5253 flagSet.Bool("skip-jwt-bearer-tokens", false, "will skip requests that have verified JWT bearer tokens (default false)")
5354 flagSet.Var(&jwtIssuers, "extra-jwt-issuers", "if skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)")
oauthproxy.go+9−3
@@ -2,6 +2,7 @@ package main
22
33import (
44 "context"
5+ "crypto/tls"
56 b64 "encoding/base64"
67 "errors"
78 "fmt"
@@ -128,9 +129,14 @@ func (u *UpstreamProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
128129
129130// NewReverseProxy creates a new reverse proxy for proxying requests to upstream
130131// servers
131−func NewReverseProxy(target *url.URL, flushInterval time.Duration) (proxy *httputil.ReverseProxy) {
132+func NewReverseProxy(target *url.URL, opts *Options) (proxy *httputil.ReverseProxy) {
132133 proxy = httputil.NewSingleHostReverseProxy(target)
133− proxy.FlushInterval = flushInterval
134+ proxy.FlushInterval = opts.FlushInterval
135+ if opts.SSLUpstreamInsecureSkipVerify {
136+ proxy.Transport = &http.Transport{
137+ TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
138+ }
139+ }
134140 return proxy
135141}
136142
@@ -163,7 +169,7 @@ func NewFileServer(path string, filesystemPath string) (proxy http.Handler) {
163169// NewWebSocketOrRestReverseProxy creates a reverse proxy for REST or websocket based on url
164170func NewWebSocketOrRestReverseProxy(u *url.URL, opts *Options, auth hmacauth.HmacAuth) http.Handler {
165171 u.Path = ""
166− proxy := NewReverseProxy(u, opts.FlushInterval)
172+ proxy := NewReverseProxy(u, opts)
167173 if !opts.PassHostHeader {
168174 setProxyUpstreamHostHeader(proxy, u)
169175 } else {
oauthproxy_test.go+2−2
@@ -122,7 +122,7 @@ func TestNewReverseProxy(t *testing.T) {
122122 backendHost := net.JoinHostPort(backendHostname, backendPort)
123123 proxyURL, _ := url.Parse(backendURL.Scheme + "://" + backendHost + "/")
124124
125− proxyHandler := NewReverseProxy(proxyURL, time.Second)
125+ proxyHandler := NewReverseProxy(proxyURL, &Options{FlushInterval: time.Second})
126126 setProxyUpstreamHostHeader(proxyHandler, proxyURL)
127127 frontend := httptest.NewServer(proxyHandler)
128128 defer frontend.Close()
@@ -144,7 +144,7 @@ func TestEncodedSlashes(t *testing.T) {
144144 defer backend.Close()
145145
146146 b, _ := url.Parse(backend.URL)
147− proxyHandler := NewReverseProxy(b, time.Second)
147+ proxyHandler := NewReverseProxy(b, &Options{FlushInterval: time.Second})
148148 setProxyDirector(proxyHandler)
149149 frontend := httptest.NewServer(proxyHandler)
150150 defer frontend.Close()
options.go+17−16
@@ -62,22 +62,23 @@ type Options struct {
6262 // Embed SessionOptions
6363 options.SessionOptions
6464
65− Upstreams []string `flag:"upstream" cfg:"upstreams" env:"OAUTH2_PROXY_UPSTREAMS"`
66− SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex" env:"OAUTH2_PROXY_SKIP_AUTH_REGEX"`
67− SkipJwtBearerTokens bool `flag:"skip-jwt-bearer-tokens" cfg:"skip_jwt_bearer_tokens" env:"OAUTH2_PROXY_SKIP_JWT_BEARER_TOKENS"`
68− ExtraJwtIssuers []string `flag:"extra-jwt-issuers" cfg:"extra_jwt_issuers" env:"OAUTH2_PROXY_EXTRA_JWT_ISSUERS"`
69− PassBasicAuth bool `flag:"pass-basic-auth" cfg:"pass_basic_auth" env:"OAUTH2_PROXY_PASS_BASIC_AUTH"`
70− BasicAuthPassword string `flag:"basic-auth-password" cfg:"basic_auth_password" env:"OAUTH2_PROXY_BASIC_AUTH_PASSWORD"`
71− PassAccessToken bool `flag:"pass-access-token" cfg:"pass_access_token" env:"OAUTH2_PROXY_PASS_ACCESS_TOKEN"`
72− PassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header" env:"OAUTH2_PROXY_PASS_HOST_HEADER"`
73− SkipProviderButton bool `flag:"skip-provider-button" cfg:"skip_provider_button" env:"OAUTH2_PROXY_SKIP_PROVIDER_BUTTON"`
74− PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers" env:"OAUTH2_PROXY_PASS_USER_HEADERS"`
75− SSLInsecureSkipVerify bool `flag:"ssl-insecure-skip-verify" cfg:"ssl_insecure_skip_verify" env:"OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY"`
76− SetXAuthRequest bool `flag:"set-xauthrequest" cfg:"set_xauthrequest" env:"OAUTH2_PROXY_SET_XAUTHREQUEST"`
77− SetAuthorization bool `flag:"set-authorization-header" cfg:"set_authorization_header" env:"OAUTH2_PROXY_SET_AUTHORIZATION_HEADER"`
78− PassAuthorization bool `flag:"pass-authorization-header" cfg:"pass_authorization_header" env:"OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER"`
79− SkipAuthPreflight bool `flag:"skip-auth-preflight" cfg:"skip_auth_preflight" env:"OAUTH2_PROXY_SKIP_AUTH_PREFLIGHT"`
80− FlushInterval time.Duration `flag:"flush-interval" cfg:"flush_interval" env:"OAUTH2_PROXY_FLUSH_INTERVAL"`
65+ Upstreams []string `flag:"upstream" cfg:"upstreams" env:"OAUTH2_PROXY_UPSTREAMS"`
66+ SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex" env:"OAUTH2_PROXY_SKIP_AUTH_REGEX"`
67+ SkipJwtBearerTokens bool `flag:"skip-jwt-bearer-tokens" cfg:"skip_jwt_bearer_tokens" env:"OAUTH2_PROXY_SKIP_JWT_BEARER_TOKENS"`
68+ ExtraJwtIssuers []string `flag:"extra-jwt-issuers" cfg:"extra_jwt_issuers" env:"OAUTH2_PROXY_EXTRA_JWT_ISSUERS"`
69+ PassBasicAuth bool `flag:"pass-basic-auth" cfg:"pass_basic_auth" env:"OAUTH2_PROXY_PASS_BASIC_AUTH"`
70+ BasicAuthPassword string `flag:"basic-auth-password" cfg:"basic_auth_password" env:"OAUTH2_PROXY_BASIC_AUTH_PASSWORD"`
71+ PassAccessToken bool `flag:"pass-access-token" cfg:"pass_access_token" env:"OAUTH2_PROXY_PASS_ACCESS_TOKEN"`
72+ PassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header" env:"OAUTH2_PROXY_PASS_HOST_HEADER"`
73+ SkipProviderButton bool `flag:"skip-provider-button" cfg:"skip_provider_button" env:"OAUTH2_PROXY_SKIP_PROVIDER_BUTTON"`
74+ PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers" env:"OAUTH2_PROXY_PASS_USER_HEADERS"`
75+ SSLInsecureSkipVerify bool `flag:"ssl-insecure-skip-verify" cfg:"ssl_insecure_skip_verify" env:"OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY"`
76+ SSLUpstreamInsecureSkipVerify bool `flag:"ssl-upstream-insecure-skip-verify" cfg:"ssl_upstream_insecure_skip_verify" env:"OAUTH2_PROXY_SSL_UPSTREAM_INSECURE_SKIP_VERIFY"`
77+ SetXAuthRequest bool `flag:"set-xauthrequest" cfg:"set_xauthrequest" env:"OAUTH2_PROXY_SET_XAUTHREQUEST"`
78+ SetAuthorization bool `flag:"set-authorization-header" cfg:"set_authorization_header" env:"OAUTH2_PROXY_SET_AUTHORIZATION_HEADER"`
79+ PassAuthorization bool `flag:"pass-authorization-header" cfg:"pass_authorization_header" env:"OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER"`
80+ SkipAuthPreflight bool `flag:"skip-auth-preflight" cfg:"skip_auth_preflight" env:"OAUTH2_PROXY_SKIP_AUTH_PREFLIGHT"`
81+ FlushInterval time.Duration `flag:"flush-interval" cfg:"flush_interval" env:"OAUTH2_PROXY_FLUSH_INTERVAL"`
8182
8283 // These options allow for other providers besides Google, with
8384 // potential overrides.