7285701 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Introduce `validate-url` flag/config

commit72857018eec737548e581a918acfebd94e4b44d9 authorMike Bland <michael.bland@gsa.gov> dateFri 8 May 2015, 17:13 (11 years ago) parent8e2d836

8 files changed+40−5

compare with master

unifiedsplit

main.go+1 oauthproxy.go+2 options.go+7−5 providers/google.go+5 providers/google_test.go+9 providers/myusa.go+5 providers/myusa_test.go+10 providers/provider_data.go+1

main.go+1

@@ -56,6 +56,7 @@ func main() {

5656 flagSet.String("login-url", "", "Authentication endpoint")

5757 flagSet.String("redeem-url", "", "Token redemption endpoint")

5858 flagSet.String("profile-url", "", "Profile access endpoint")

59+ flagSet.String("validate-url", "", "Access token validation endpoint")

5960 flagSet.String("scope", "", "Oauth scope specification")

6061

6162 flagSet.Parse(os.Args[1:])

oauthproxy.go+2

@@ -40,6 +40,7 @@ type OauthProxy struct {

4040 provider providers.Provider

4141 oauthRedemptionUrl *url.URL // endpoint to redeem the code

4242 oauthLoginUrl *url.URL // to redirect the user to

43+ oauthValidateUrl *url.URL // to validate the access token

4344 oauthScope string

4445 clientID string

4546 clientSecret string

@@ -146,6 +147,7 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {

146147 provider: opts.provider,

147148 oauthRedemptionUrl: opts.provider.Data().RedeemUrl,

148149 oauthLoginUrl: opts.provider.Data().LoginUrl,

150+ oauthValidateUrl: opts.provider.Data().ValidateUrl,

149151 serveMux: serveMux,

150152 redirectUrl: redirectUrl,

151153 skipAuthRegex: opts.SkipAuthRegex,

options.go+7−5

@@ -39,11 +39,12 @@ type Options struct {

3939

4040 // These options allow for other providers besides Google, with

4141 // potential overrides.

42− Provider string `flag:"provider" cfg:"provider"`

43− LoginUrl string `flag:"login-url" cfg:"login_url"`

44− RedeemUrl string `flag:"redeem-url" cfg:"redeem_url"`

45− ProfileUrl string `flag:"profile-url" cfg:"profile_url"`

46− Scope string `flag:"scope" cfg:"scope"`

42+ Provider string `flag:"provider" cfg:"provider"`

43+ LoginUrl string `flag:"login-url" cfg:"login_url"`

44+ RedeemUrl string `flag:"redeem-url" cfg:"redeem_url"`

45+ ProfileUrl string `flag:"profile-url" cfg:"profile_url"`

46+ ValidateUrl string `flag:"validate-url" cfg:"validate_url"`

47+ Scope string `flag:"scope" cfg:"scope"`

4748

4849 RequestLogging bool `flag:"request-logging" cfg:"request_logging"`

4950

@@ -148,6 +149,7 @@ func parseProviderInfo(o *Options, msgs []string) []string {

148149 p.LoginUrl, msgs = parseUrl(o.LoginUrl, "login", msgs)

149150 p.RedeemUrl, msgs = parseUrl(o.RedeemUrl, "redeem", msgs)

150151 p.ProfileUrl, msgs = parseUrl(o.ProfileUrl, "profile", msgs)

152+ p.ValidateUrl, msgs = parseUrl(o.ValidateUrl, "validate", msgs)

151153 o.provider = providers.New(o.Provider, p)

152154 return msgs

153155}

providers/google.go+5

@@ -24,6 +24,11 @@ func NewGoogleProvider(p *ProviderData) *GoogleProvider {

2424 Host: "accounts.google.com",

2525 Path: "/o/oauth2/token"}

2626 }

27+ if p.ValidateUrl.String() == "" {

28+ p.ValidateUrl = &url.URL{Scheme: "https",

29+ Host: "www.googleapis.com",

30+ Path: "/oauth2/v1/tokeninfo"}

31+ }

2732 if p.Scope == "" {

2833 p.Scope = "profile email"

2934 }

providers/google_test.go+9

@@ -15,6 +15,7 @@ func newGoogleProvider() *GoogleProvider {

1515 LoginUrl: &url.URL{},

1616 RedeemUrl: &url.URL{},

1717 ProfileUrl: &url.URL{},

18+ ValidateUrl: &url.URL{},

1819 Scope: ""})

1920}

2021

@@ -26,6 +27,8 @@ func TestGoogleProviderDefaults(t *testing.T) {

2627 p.Data().LoginUrl.String())

2728 assert.Equal(t, "https://accounts.google.com/o/oauth2/token",

2829 p.Data().RedeemUrl.String())

30+ assert.Equal(t, "https://www.googleapis.com/oauth2/v1/tokeninfo",

31+ p.Data().ValidateUrl.String())

2932 assert.Equal(t, "", p.Data().ProfileUrl.String())

3033 assert.Equal(t, "profile email", p.Data().Scope)

3134}

@@ -45,6 +48,10 @@ func TestGoogleProviderOverrides(t *testing.T) {

4548 Scheme: "https",

4649 Host: "example.com",

4750 Path: "/oauth/profile"},

51+ ValidateUrl: &url.URL{

52+ Scheme: "https",

53+ Host: "example.com",

54+ Path: "/oauth/tokeninfo"},

4855 Scope: "profile"})

4956 assert.NotEqual(t, nil, p)

5057 assert.Equal(t, "Google", p.Data().ProviderName)

@@ -54,6 +61,8 @@ func TestGoogleProviderOverrides(t *testing.T) {

5461 p.Data().RedeemUrl.String())

5562 assert.Equal(t, "https://example.com/oauth/profile",

5663 p.Data().ProfileUrl.String())

64+ assert.Equal(t, "https://example.com/oauth/tokeninfo",

65+ p.Data().ValidateUrl.String())

5766 assert.Equal(t, "profile", p.Data().Scope)

5867}

5968

providers/myusa.go+5

@@ -32,6 +32,11 @@ func NewMyUsaProvider(p *ProviderData) *MyUsaProvider {

3232 Host: myUsaHost,

3333 Path: "/api/v1/profile"}

3434 }

35+ if p.ValidateUrl.String() == "" {

36+ p.ValidateUrl = &url.URL{Scheme: "https",

37+ Host: myUsaHost,

38+ Path: "/api/v1/tokeninfo"}

39+ }

3540 if p.Scope == "" {

3641 p.Scope = "profile.email"

3742 }

providers/myusa_test.go+10

@@ -21,11 +21,13 @@ func testMyUsaProvider(hostname string) *MyUsaProvider {

2121 LoginUrl: &url.URL{},

2222 RedeemUrl: &url.URL{},

2323 ProfileUrl: &url.URL{},

24+ ValidateUrl: &url.URL{},

2425 Scope: ""})

2526 if hostname != "" {

2627 updateUrl(p.Data().LoginUrl, hostname)

2728 updateUrl(p.Data().RedeemUrl, hostname)

2829 updateUrl(p.Data().ProfileUrl, hostname)

30+ updateUrl(p.Data().ValidateUrl, hostname)

2931 }

3032 return p

3133}

@@ -56,6 +58,8 @@ func TestMyUsaProviderDefaults(t *testing.T) {

5658 p.Data().RedeemUrl.String())

5759 assert.Equal(t, "https://alpha.my.usa.gov/api/v1/profile",

5860 p.Data().ProfileUrl.String())

61+ assert.Equal(t, "https://alpha.my.usa.gov/api/v1/tokeninfo",

62+ p.Data().ValidateUrl.String())

5963 assert.Equal(t, "profile.email", p.Data().Scope)

6064}

6165

@@ -74,6 +78,10 @@ func TestMyUsaProviderOverrides(t *testing.T) {

7478 Scheme: "https",

7579 Host: "example.com",

7680 Path: "/oauth/profile"},

81+ ValidateUrl: &url.URL{

82+ Scheme: "https",

83+ Host: "example.com",

84+ Path: "/oauth/tokeninfo"},

7785 Scope: "profile"})

7886 assert.NotEqual(t, nil, p)

7987 assert.Equal(t, "MyUSA", p.Data().ProviderName)

@@ -83,6 +91,8 @@ func TestMyUsaProviderOverrides(t *testing.T) {

8391 p.Data().RedeemUrl.String())

8492 assert.Equal(t, "https://example.com/oauth/profile",

8593 p.Data().ProfileUrl.String())

94+ assert.Equal(t, "https://example.com/oauth/tokeninfo",

95+ p.Data().ValidateUrl.String())

8696 assert.Equal(t, "profile", p.Data().Scope)

8797}

8898

providers/provider_data.go+1

@@ -9,6 +9,7 @@ type ProviderData struct {

99 LoginUrl *url.URL

1010 RedeemUrl *url.URL

1111 ProfileUrl *url.URL

12+ ValidateUrl *url.URL

1213 Scope string

1314}

1415