git.iko.soy/typeable/oauth2-proxy
on master help sign in
bugfix: default scopes for OIDCProvider based providers
commit7683902a4295b8f35349ea93628cfb832c38b665 authortuunit <jan@larwig.com> dateSun 10 Sep 2023, 19:57 (3 years ago) parent3c2d67d
8 files changed+37−15
compare with master
unifiedsplit
CHANGELOG.md+1 providers/adfs.go+1−4 providers/adfs_test.go+7−1 providers/gitlab.go+1−4 providers/gitlab_test.go+9 providers/keycloak_oidc.go+1−3 providers/keycloak_oidc_test.go+10−2 providers/oidc.go+7−1
CHANGELOG.md+1
@@ -11,6 +11,7 @@
1111- [#2221](https://github.com/oauth2-proxy/oauth2-proxy/pull/2221) Backwards compatible fix for wrong environment variable name (OAUTH2_PROXY_GOOGLE_GROUPS) (@kvanzuijlen)
1212- [#1989](https://github.com/oauth2-proxy/oauth2-proxy/pull/1989) Fix default scope for keycloak-oidc provider
1313- [#2217](https://github.com/oauth2-proxy/oauth2-proxy/pull/2217) Upgrade alpine to version 3.18 (@polarctos)
14+- [#2229](https://github.com/oauth2-proxy/oauth2-proxy/pull/2229) bugfix: default scopes for OIDCProvider based providers
1415
1516# V7.5.0
1617
providers/adfs.go+1−4
@@ -46,10 +46,7 @@ func NewADFSProvider(p *ProviderData, opts options.ADFSOptions) *ADFSProvider {
4646 }
4747 }
4848
49− oidcProvider := &OIDCProvider{
50− ProviderData: p,
51− SkipNonce: false,
52− }
49+ oidcProvider := NewOIDCProvider(p, options.OIDCOptions{InsecureSkipNonce: false})
5350
5451 return &ADFSProvider{
5552 OIDCProvider: oidcProvider,
providers/adfs_test.go+7−1
@@ -136,7 +136,13 @@ var _ = Describe("ADFS Provider Tests", func() {
136136 It("uses defaults", func() {
137137 providerData := NewADFSProvider(&ProviderData{}, options.ADFSOptions{}).Data()
138138 Expect(providerData.ProviderName).To(Equal("ADFS"))
139− Expect(providerData.Scope).To(Equal("openid email profile"))
139+ Expect(providerData.Scope).To(Equal(oidcDefaultScope))
140+ })
141+ It("uses custom scope", func() {
142+ providerData := NewADFSProvider(&ProviderData{Scope: "openid email"}, options.ADFSOptions{}).Data()
143+ Expect(providerData.ProviderName).To(Equal("ADFS"))
144+ Expect(providerData.Scope).To(Equal("openid email"))
145+ Expect(providerData.Scope).NotTo(Equal(oidcDefaultScope))
140146 })
141147 })
142148
providers/gitlab.go+1−4
@@ -40,10 +40,7 @@ func NewGitLabProvider(p *ProviderData, opts options.GitLabOptions) (*GitLabProv
4040 p.Scope = gitlabDefaultScope
4141 }
4242
43− oidcProvider := &OIDCProvider{
44− ProviderData: p,
45− SkipNonce: false,
46− }
43+ oidcProvider := NewOIDCProvider(p, options.OIDCOptions{InsecureSkipNonce: false})
4744
4845 provider := &GitLabProvider{
4946 OIDCProvider: oidcProvider,
providers/gitlab_test.go+9
@@ -170,6 +170,15 @@ var _ = Describe("Gitlab Provider Tests", func() {
170170 b.Close()
171171 })
172172
173+ Context("New Provider Init", func() {
174+ It("creates new keycloak oidc provider with expected defaults", func() {
175+ providerData := p.Data()
176+ Expect(providerData.ProviderName).To(Equal(gitlabProviderName))
177+ Expect(providerData.Scope).To(Equal(gitlabDefaultScope))
178+ Expect(providerData.ProviderName).NotTo(Equal(oidcDefaultScope))
179+ })
180+ })
181+
173182 Context("with bad token", func() {
174183 It("should trigger an error", func() {
175184 p.AllowUnverifiedEmail = false
providers/keycloak_oidc.go+1−3
@@ -22,9 +22,7 @@ func NewKeycloakOIDCProvider(p *ProviderData, opts options.KeycloakOptions) *Key
2222 })
2323
2424 provider := &KeycloakOIDCProvider{
25− OIDCProvider: &OIDCProvider{
26− ProviderData: p,
27− },
25+ OIDCProvider: NewOIDCProvider(p, options.OIDCOptions{InsecureSkipNonce: false}),
2826 }
2927
3028 provider.addAllowedRoles(opts.Roles)
providers/keycloak_oidc_test.go+10−2
@@ -67,7 +67,7 @@ func newKeycloakOIDCProvider(serverURL *url.URL, opts options.KeycloakOptions) *
6767 Scheme: "https",
6868 Host: "keycloak-oidc.com",
6969 Path: "/api/v3/user"},
70− Scope: "openid email profile"},
70+ },
7171 opts)
7272
7373 if serverURL != nil {
@@ -97,7 +97,15 @@ var _ = Describe("Keycloak OIDC Provider Tests", func() {
9797 Expect(providerData.RedeemURL.String()).To(Equal("https://keycloak-oidc.com/oauth/token"))
9898 Expect(providerData.ProfileURL.String()).To(Equal("https://keycloak-oidc.com/api/v3/user"))
9999 Expect(providerData.ValidateURL.String()).To(Equal("https://keycloak-oidc.com/api/v3/user"))
100− Expect(providerData.Scope).To(Equal("openid email profile"))
100+ Expect(providerData.Scope).To(Equal(oidcDefaultScope))
101+ })
102+ It("creates new keycloak oidc provider with custom scope", func() {
103+ p := NewKeycloakOIDCProvider(&ProviderData{Scope: "openid email"}, options.KeycloakOptions{})
104+ providerData := p.Data()
105+
106+ Expect(providerData.ProviderName).To(Equal(keycloakOIDCProviderName))
107+ Expect(providerData.Scope).To(Equal("openid email"))
108+ Expect(providerData.Scope).NotTo(Equal(oidcDefaultScope))
101109 })
102110 })
103111
providers/oidc.go+7−1
@@ -24,8 +24,14 @@ const oidcDefaultScope = "openid email profile"
2424
2525// NewOIDCProvider initiates a new OIDCProvider
2626func NewOIDCProvider(p *ProviderData, opts options.OIDCOptions) *OIDCProvider {
27+ name := "OpenID Connect"
28+
29+ if p.ProviderName != "" {
30+ name = p.ProviderName
31+ }
32+
2733 oidcProviderDefaults := providerDefaults{
28− name: "OpenID Connect",
34+ name: name,
2935 loginURL: nil,
3036 redeemURL: nil,
3137 profileURL: nil,