git.iko.soy/typeable/oauth2-proxy
on master help sign in
Add a detailed allowed_groups example to Important Notes
commit753f6c548acd9a5c9563bf7f061d575733af25d7 authorNick Meves <nick.meves@greenhouse.io> dateFri 27 Nov 2020, 10:45 (6 years ago) parent65e15f2
2 files changed+11−1
compare with master
unifiedsplit
CHANGELOG.md+6−1 oauthproxy.go+5
CHANGELOG.md+6−1
@@ -7,8 +7,13 @@
77- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) `--user-id-claim` option is deprecated and replaced by `--oidc-email-claim`
88- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled
99- [#849](https://github.com/oauth2-proxy/oauth2-proxy/pull/849) `/oauth2/auth` `allowed_groups` querystring parameter can be paired with the `allowed-groups` configuration option.
10− - In this scenario, the user's group must be in both lists to not get a 401 or 403 response code.
1110 - The `allowed_groups` querystring parameter can specify multiple comma delimited groups.
11+ - In this scenario, the user must have a group (from their multiple groups) present in both lists to not get a 401 or 403 response code.
12+ - Example:
13+ - OAuth2-Proxy globally sets the `allowed_groups` as `engineering`.
14+ - An application using Kubernetes ingress uses the `/oauth2/auth` endpoint with `allowed_groups` querystring set to `backend`.
15+ - A user must have a session with the groups `["engineering", "backend"]` to pass authorization.
16+ - Another user with the groups `["engineering", "frontend"]` would fail the querystring authorization portion.
1217- [#905](https://github.com/oauth2-proxy/oauth2-proxy/pull/905) Existing sessions from v6.0.0 or earlier are no longer valid. They will trigger a reauthentication.
1318- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) `skip-auth-strip-headers` now applies to all requests, not just those where authentication would be skipped.
1419- [#797](https://github.com/oauth2-proxy/oauth2-proxy/pull/797) The behavior of the Google provider Groups restriction changes with this
oauthproxy.go+5
@@ -1026,6 +1026,11 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R
10261026
10271027// authOnlyAuthorize handles special authorization logic that is only done
10281028// on the AuthOnly endpoint for use with Nginx subrequest architectures.
1029+//
1030+// TODO (@NickMeves): This method is a placeholder to be extended but currently
1031+// fails the linter. Remove the nolint when functionality expands.
1032+//
1033+//nolint:S1008
10291034func authOnlyAuthorize(req *http.Request, s *sessionsapi.SessionState) bool {
10301035 // Allow secondary group restrictions based on the `allowed_groups`
10311036 // querystring parameter