@@ -495,6 +495,8 @@ func TestBasicAuthPassword(t *testing.T) {
495495 t.Fatal(err)
496496 }
497497 }))
498+
499+ basicAuthPassword := "This is a secure password"
498500 opts := baseTestOptions()
499501 opts.UpstreamServers = options.Upstreams{
500502 {
@@ -505,11 +507,22 @@ func TestBasicAuthPassword(t *testing.T) {
505507 }
506508
507509 opts.Cookie.Secure = false
508− opts.PassBasicAuth = true
509− opts.SetBasicAuth = true
510− opts.PassUserHeaders = true
511− opts.PreferEmailToUser = true
512− opts.BasicAuthPassword = "This is a secure password"
510+ opts.InjectRequestHeaders = []options.Header{
511+ {
512+ Name: "Authorization",
513+ Values: []options.HeaderValue{
514+ {
515+ ClaimSource: &options.ClaimSource{
516+ Claim: "email",
517+ BasicAuthPassword: &options.SecretSource{
518+ Value: []byte(base64.StdEncoding.EncodeToString([]byte(basicAuthPassword))),
519+ },
520+ },
521+ },
522+ },
523+ },
524+ }
525+
513526 err := validation.Validate(opts)
514527 assert.NoError(t, err)
515528
@@ -524,148 +537,44 @@ func TestBasicAuthPassword(t *testing.T) {
524537 t.Fatal(err)
525538 }
526539
540+ // Save the required session
527541 rw := httptest.NewRecorder()
528− req, _ := http.NewRequest("GET", "/oauth2/callback?code=callback_code&state=nonce:", strings.NewReader(""))
529− req.AddCookie(proxy.MakeCSRFCookie(req, "nonce", proxy.CookieExpire, time.Now()))
530− proxy.ServeHTTP(rw, req)
531− if rw.Code >= 400 {
532− t.Fatalf("expected 3xx got %d", rw.Code)
533− }
534− cookie := rw.Header().Values("Set-Cookie")[1]
535−
536− cookieName := proxy.CookieName
537− var value string
538− keyPrefix := cookieName + "="
539−
540− for _, field := range strings.Split(cookie, "; ") {
541− value = strings.TrimPrefix(field, keyPrefix)
542− if value != field {
543− break
544− } else {
545− value = ""
546− }
547− }
548−
549− req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
550− req.AddCookie(&http.Cookie{
551− Name: cookieName,
552− Value: value,
553− Path: "/",
554− Expires: time.Now().Add(time.Duration(24)),
555− HttpOnly: true,
542+ req, _ := http.NewRequest("GET", "/", nil)
543+ err = proxy.sessionStore.Save(rw, req, &sessions.SessionState{
544+ Email: emailAddress,
556545 })
557− req.AddCookie(proxy.MakeCSRFCookie(req, "nonce", proxy.CookieExpire, time.Now()))
546+ assert.NoError(t, err)
558547
548+ // Extract the cookie value to inject into the test request
549+ cookie := rw.Header().Values("Set-Cookie")[0]
550+
551+ req, _ = http.NewRequest("GET", "/", nil)
552+ req.Header.Set("Cookie", cookie)
559553 rw = httptest.NewRecorder()
560554 proxy.ServeHTTP(rw, req)
561555
562556 // The username in the basic auth credentials is expected to be equal to the email address from the
563557 // auth response, so we use the same variable here.
564− expectedHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte(emailAddress+":"+opts.BasicAuthPassword))
558+ expectedHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte(emailAddress+":"+basicAuthPassword))
565559 assert.Equal(t, expectedHeader, rw.Body.String())
566560 providerServer.Close()
567561}
568562
569−func TestBasicAuthWithEmail(t *testing.T) {
570− opts := baseTestOptions()
571− opts.PassBasicAuth = true
572− opts.PassUserHeaders = false
573− opts.PreferEmailToUser = false
574− opts.BasicAuthPassword = "This is a secure password"
575− err := validation.Validate(opts)
576− assert.NoError(t, err)
577−
578− const emailAddress = "john.doe@example.com"
579− const userName = "9fcab5c9b889a557"
580−
581− // The username in the basic auth credentials is expected to be equal to the email address from the
582− expectedEmailHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte(emailAddress+":"+opts.BasicAuthPassword))
583− expectedUserHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte(userName+":"+opts.BasicAuthPassword))
584−
585− created := time.Now()
586− session := &sessions.SessionState{
587− User: userName,
588− Email: emailAddress,
589− AccessToken: "oauth_token",
590− CreatedAt: &created,
591− }
592− {
593− rw := httptest.NewRecorder()
594− req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase0", nil)
595− proxy, err := NewOAuthProxy(opts, func(email string) bool {
596− return email == emailAddress
597− })
598− if err != nil {
599− t.Fatal(err)
600− }
601− proxy.addHeadersForProxying(rw, req, session)
602− assert.Equal(t, expectedUserHeader, req.Header["Authorization"][0])
603− assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
604− }
605−
606− opts.PreferEmailToUser = true
607− {
608− rw := httptest.NewRecorder()
609− req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase1", nil)
610−
611− proxy, err := NewOAuthProxy(opts, func(email string) bool {
612− return email == emailAddress
613− })
614− if err != nil {
615− t.Fatal(err)
616− }
617− proxy.addHeadersForProxying(rw, req, session)
618− assert.Equal(t, expectedEmailHeader, req.Header["Authorization"][0])
619− assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
620− }
621−}
622−
623−func TestPassUserHeadersWithEmail(t *testing.T) {
563+func TestPassGroupsHeadersWithGroups(t *testing.T) {
624564 opts := baseTestOptions()
625− err := validation.Validate(opts)
626− assert.NoError(t, err)
627−
628− const emailAddress = "john.doe@example.com"
629− const userName = "9fcab5c9b889a557"
630−
631− created := time.Now()
632− session := &sessions.SessionState{
633− User: userName,
634− Email: emailAddress,
635− AccessToken: "oauth_token",
636− CreatedAt: &created,
637− }
638− {
639− rw := httptest.NewRecorder()
640− req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase0", nil)
641− proxy, err := NewOAuthProxy(opts, func(email string) bool {
642− return email == emailAddress
643− })
644− if err != nil {
645− t.Fatal(err)
646− }
647− proxy.addHeadersForProxying(rw, req, session)
648− assert.Equal(t, userName, req.Header["X-Forwarded-User"][0])
649− }
650−
651− opts.PreferEmailToUser = true
652− {
653− rw := httptest.NewRecorder()
654− req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase1", nil)
655−
656− proxy, err := NewOAuthProxy(opts, func(email string) bool {
657− return email == emailAddress
658− })
659− if err != nil {
660− t.Fatal(err)
661− }
662− proxy.addHeadersForProxying(rw, req, session)
663− assert.Equal(t, emailAddress, req.Header["X-Forwarded-User"][0])
565+ opts.InjectRequestHeaders = []options.Header{
566+ {
567+ Name: "X-Forwarded-Groups",
568+ Values: []options.HeaderValue{
569+ {
570+ ClaimSource: &options.ClaimSource{
571+ Claim: "groups",
572+ },
573+ },
574+ },
575+ },
664576 }
665−}
666577
667−func TestPassGroupsHeadersWithGroups(t *testing.T) {
668− opts := baseTestOptions()
669578 err := validation.Validate(opts)
670579 assert.NoError(t, err)
671580
@@ -681,161 +590,27 @@ func TestPassGroupsHeadersWithGroups(t *testing.T) {
681590 AccessToken: "oauth_token",
682591 CreatedAt: &created,
683592 }
684− {
685− rw := httptest.NewRecorder()
686− req, _ := http.NewRequest("GET", opts.ProxyPrefix+"/testCase0", nil)
687− proxy, err := NewOAuthProxy(opts, func(email string) bool {
688− return email == emailAddress
689− })
690− if err != nil {
691− t.Fatal(err)
692− }
693− proxy.addHeadersForProxying(rw, req, session)
694− assert.Equal(t, groups, req.Header["X-Forwarded-Groups"])
695− }
696−}
697−
698−func TestStripAuthHeaders(t *testing.T) {
699− testCases := map[string]struct {
700− SkipAuthStripHeaders bool
701− PassBasicAuth bool
702− PassUserHeaders bool
703− PassAccessToken bool
704− PassAuthorization bool
705− StrippedHeaders map[string]bool
706− }{
707− "Default options": {
708− SkipAuthStripHeaders: true,
709− PassBasicAuth: true,
710− PassUserHeaders: true,
711− PassAccessToken: false,
712− PassAuthorization: false,
713− StrippedHeaders: map[string]bool{
714− "X-Forwarded-User": true,
715− "X-Forwared-Groups": true,
716− "X-Forwarded-Email": true,
717− "X-Forwarded-Preferred-Username": true,
718− "X-Forwarded-Access-Token": false,
719− "Authorization": true,
720− },
721− },
722− "Pass access token": {
723− SkipAuthStripHeaders: true,
724− PassBasicAuth: true,
725− PassUserHeaders: true,
726− PassAccessToken: true,
727− PassAuthorization: false,
728− StrippedHeaders: map[string]bool{
729− "X-Forwarded-User": true,
730− "X-Forwared-Groups": true,
731− "X-Forwarded-Email": true,
732− "X-Forwarded-Preferred-Username": true,
733− "X-Forwarded-Access-Token": true,
734− "Authorization": true,
735− },
736− },
737− "Nothing setting Authorization": {
738− SkipAuthStripHeaders: true,
739− PassBasicAuth: false,
740− PassUserHeaders: true,
741− PassAccessToken: true,
742− PassAuthorization: false,
743− StrippedHeaders: map[string]bool{
744− "X-Forwarded-User": true,
745− "X-Forwared-Groups": true,
746− "X-Forwarded-Email": true,
747− "X-Forwarded-Preferred-Username": true,
748− "X-Forwarded-Access-Token": true,
749− "Authorization": false,
750− },
751− },
752− "Only Authorization header modified": {
753− SkipAuthStripHeaders: true,
754− PassBasicAuth: false,
755− PassUserHeaders: false,
756− PassAccessToken: false,
757− PassAuthorization: true,
758− StrippedHeaders: map[string]bool{
759− "X-Forwarded-User": false,
760− "X-Forwared-Groups": false,
761− "X-Forwarded-Email": false,
762− "X-Forwarded-Preferred-Username": false,
763− "X-Forwarded-Access-Token": false,
764− "Authorization": true,
765− },
766− },
767− "Don't strip any headers (default options)": {
768− SkipAuthStripHeaders: false,
769− PassBasicAuth: true,
770− PassUserHeaders: true,
771− PassAccessToken: false,
772− PassAuthorization: false,
773− StrippedHeaders: map[string]bool{
774− "X-Forwarded-User": false,
775− "X-Forwared-Groups": false,
776− "X-Forwarded-Email": false,
777− "X-Forwarded-Preferred-Username": false,
778− "X-Forwarded-Access-Token": false,
779− "Authorization": false,
780− },
781− },
782− "Don't strip any headers (custom options)": {
783− SkipAuthStripHeaders: false,
784− PassBasicAuth: true,
785− PassUserHeaders: true,
786− PassAccessToken: true,
787− PassAuthorization: false,
788− StrippedHeaders: map[string]bool{
789− "X-Forwarded-User": false,
790− "X-Forwared-Groups": false,
791− "X-Forwarded-Email": false,
792− "X-Forwarded-Preferred-Username": false,
793− "X-Forwarded-Access-Token": false,
794− "Authorization": false,
795− },
796− },
797− }
798593
799− initialHeaders := map[string]string{
800− "X-Forwarded-User": "9fcab5c9b889a557",
801− "X-Forwarded-Email": "john.doe@example.com",
802− "X-Forwarded-Groups": "a,b,c",
803− "X-Forwarded-Preferred-Username": "john.doe",
804− "X-Forwarded-Access-Token": "AccessToken",
805− "Authorization": "bearer IDToken",
806− }
594+ proxy, err := NewOAuthProxy(opts, func(email string) bool {
595+ return email == emailAddress
596+ })
597+ assert.NoError(t, err)
807598
808− for name, tc := range testCases {
809− t.Run(name, func(t *testing.T) {
810− opts := baseTestOptions()
811− opts.SkipAuthStripHeaders = tc.SkipAuthStripHeaders
812− opts.PassBasicAuth = tc.PassBasicAuth
813− opts.PassUserHeaders = tc.PassUserHeaders
814− opts.PassAccessToken = tc.PassAccessToken
815− opts.PassAuthorization = tc.PassAuthorization
816− err := validation.Validate(opts)
817− assert.NoError(t, err)
599+ // Save the required session
600+ rw := httptest.NewRecorder()
601+ req, _ := http.NewRequest("GET", "/", nil)
602+ err = proxy.sessionStore.Save(rw, req, session)
603+ assert.NoError(t, err)
818604
819− req, _ := http.NewRequest("GET", fmt.Sprintf("%s/testCase", opts.ProxyPrefix), nil)
820− for header, val := range initialHeaders {
821− req.Header.Set(header, val)
822− }
605+ // Extract the cookie value to inject into the test request
606+ cookie := rw.Header().Values("Set-Cookie")[0]
823607
824− proxy, err := NewOAuthProxy(opts, func(_ string) bool { return true })
825− assert.NoError(t, err)
826− if proxy.skipAuthStripHeaders {
827− proxy.stripAuthHeaders(req)
828− }
608+ req, _ = http.NewRequest("GET", "/", nil)
609+ req.Header.Set("Cookie", cookie)
610+ rw = httptest.NewRecorder()
611+ proxy.ServeHTTP(rw, req)
829612
830− for header, stripped := range tc.StrippedHeaders {
831− if stripped {
832− assert.Equal(t, req.Header.Get(header), "")
833− } else {
834− assert.Equal(t, req.Header.Get(header), initialHeaders[header])
835− }
836− }
837− })
838− }
613+ assert.Equal(t, groups, req.Header["X-Forwarded-Groups"])
839614}
840615
841616type PassAccessTokenTest struct {
@@ -884,7 +659,21 @@ func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) (*PassAccessTokenTe
884659 }
885660
886661 patt.opts.Cookie.Secure = false
887− patt.opts.PassAccessToken = opts.PassAccessToken
662+ if opts.PassAccessToken {
663+ patt.opts.InjectRequestHeaders = []options.Header{
664+ {
665+ Name: "X-Forwarded-Access-Token",
666+ Values: []options.HeaderValue{
667+ {
668+ ClaimSource: &options.ClaimSource{
669+ Claim: "access_token",
670+ },
671+ },
672+ },
673+ },
674+ }
675+ }
676+
888677 err := validation.Validate(patt.opts)
889678 if err != nil {
890679 return nil, err
@@ -1442,7 +1231,48 @@ func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {
14421231 var pcTest ProcessCookieTest
14431232
14441233 pcTest.opts = baseTestOptions()
1445− pcTest.opts.SetXAuthRequest = true
1234+ pcTest.opts.InjectResponseHeaders = []options.Header{
1235+ {
1236+ Name: "X-Auth-Request-User",
1237+ Values: []options.HeaderValue{
1238+ {
1239+ ClaimSource: &options.ClaimSource{
1240+ Claim: "user",
1241+ },
1242+ },
1243+ },
1244+ },
1245+ {
1246+ Name: "X-Auth-Request-Email",
1247+ Values: []options.HeaderValue{
1248+ {
1249+ ClaimSource: &options.ClaimSource{
1250+ Claim: "email",
1251+ },
1252+ },
1253+ },
1254+ },
1255+ {
1256+ Name: "X-Auth-Request-Groups",
1257+ Values: []options.HeaderValue{
1258+ {
1259+ ClaimSource: &options.ClaimSource{
1260+ Claim: "groups",
1261+ },
1262+ },
1263+ },
1264+ },
1265+ {
1266+ Name: "X-Forwarded-Preferred-Username",
1267+ Values: []options.HeaderValue{
1268+ {
1269+ ClaimSource: &options.ClaimSource{
1270+ Claim: "preferred_username",
1271+ },
1272+ },
1273+ },
1274+ },
1275+ }
14461276 pcTest.opts.AllowedGroups = []string{"oauth_groups"}
14471277 err := validation.Validate(pcTest.opts)
14481278 assert.NoError(t, err)
@@ -1480,8 +1310,62 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
14801310 var pcTest ProcessCookieTest
14811311
14821312 pcTest.opts = baseTestOptions()
1483− pcTest.opts.SetXAuthRequest = true
1484− pcTest.opts.SetBasicAuth = true
1313+ pcTest.opts.InjectResponseHeaders = []options.Header{
1314+ {
1315+ Name: "X-Auth-Request-User",
1316+ Values: []options.HeaderValue{
1317+ {
1318+ ClaimSource: &options.ClaimSource{
1319+ Claim: "user",
1320+ },
1321+ },
1322+ },
1323+ },
1324+ {
1325+ Name: "X-Auth-Request-Email",
1326+ Values: []options.HeaderValue{
1327+ {
1328+ ClaimSource: &options.ClaimSource{
1329+ Claim: "email",
1330+ },
1331+ },
1332+ },
1333+ },
1334+ {
1335+ Name: "X-Auth-Request-Groups",
1336+ Values: []options.HeaderValue{
1337+ {
1338+ ClaimSource: &options.ClaimSource{
1339+ Claim: "groups",
1340+ },
1341+ },
1342+ },
1343+ },
1344+ {
1345+ Name: "X-Forwarded-Preferred-Username",
1346+ Values: []options.HeaderValue{
1347+ {
1348+ ClaimSource: &options.ClaimSource{
1349+ Claim: "preferred_username",
1350+ },
1351+ },
1352+ },
1353+ },
1354+ {
1355+ Name: "Authorization",
1356+ Values: []options.HeaderValue{
1357+ {
1358+ ClaimSource: &options.ClaimSource{
1359+ Claim: "user",
1360+ BasicAuthPassword: &options.SecretSource{
1361+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("This is a secure password"))),
1362+ },
1363+ },
1364+ },
1365+ },
1366+ },
1367+ }
1368+
14851369 err := validation.Validate(pcTest.opts)
14861370 assert.NoError(t, err)
14871371
@@ -1511,7 +1395,7 @@ func TestAuthOnlyEndpointSetBasicAuthTrueRequestHeaders(t *testing.T) {
15111395 assert.Equal(t, http.StatusAccepted, pcTest.rw.Code)
15121396 assert.Equal(t, "oauth_user", pcTest.rw.Header().Values("X-Auth-Request-User")[0])
15131397 assert.Equal(t, "oauth_user@example.com", pcTest.rw.Header().Values("X-Auth-Request-Email")[0])
1514− expectedHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte("oauth_user:"+pcTest.opts.BasicAuthPassword))
1398+ expectedHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte("oauth_user:This is a secure password"))
15151399 assert.Equal(t, expectedHeader, pcTest.rw.Header().Values("Authorization")[0])
15161400}
15171401
@@ -1519,8 +1403,48 @@ func TestAuthOnlyEndpointSetBasicAuthFalseRequestHeaders(t *testing.T) {
15191403 var pcTest ProcessCookieTest
15201404
15211405 pcTest.opts = baseTestOptions()
1522− pcTest.opts.SetXAuthRequest = true
1523− pcTest.opts.SetBasicAuth = false
1406+ pcTest.opts.InjectResponseHeaders = []options.Header{
1407+ {
1408+ Name: "X-Auth-Request-User",
1409+ Values: []options.HeaderValue{
1410+ {
1411+ ClaimSource: &options.ClaimSource{
1412+ Claim: "user",
1413+ },
1414+ },
1415+ },
1416+ },
1417+ {
1418+ Name: "X-Auth-Request-Email",
1419+ Values: []options.HeaderValue{
1420+ {
1421+ ClaimSource: &options.ClaimSource{
1422+ Claim: "email",
1423+ },
1424+ },
1425+ },
1426+ },
1427+ {
1428+ Name: "X-Auth-Request-Groups",
1429+ Values: []options.HeaderValue{
1430+ {
1431+ ClaimSource: &options.ClaimSource{
1432+ Claim: "groups",
1433+ },
1434+ },
1435+ },
1436+ },
1437+ {
1438+ Name: "X-Forwarded-Preferred-Username",
1439+ Values: []options.HeaderValue{
1440+ {
1441+ ClaimSource: &options.ClaimSource{
1442+ Claim: "preferred_username",
1443+ },
1444+ },
1445+ },
1446+ },
1447+ }
15241448 err := validation.Validate(pcTest.opts)
15251449 assert.NoError(t, err)
15261450
@@ -1985,9 +1909,74 @@ func TestGetJwtSession(t *testing.T) {
19851909 &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
19861910
19871911 test, err := NewAuthOnlyEndpointTest(func(opts *options.Options) {
1988− opts.PassAuthorization = true
1989− opts.SetAuthorization = true
1990− opts.SetXAuthRequest = true
1912+ opts.InjectRequestHeaders = []options.Header{
1913+ {
1914+ Name: "Authorization",
1915+ Values: []options.HeaderValue{
1916+ {
1917+ ClaimSource: &options.ClaimSource{
1918+ Claim: "id_token",
1919+ Prefix: "Bearer ",
1920+ },
1921+ },
1922+ },
1923+ },
1924+ {
1925+ Name: "X-Forwarded-User",
1926+ Values: []options.HeaderValue{
1927+ {
1928+ ClaimSource: &options.ClaimSource{
1929+ Claim: "user",
1930+ },
1931+ },
1932+ },
1933+ },
1934+ {
1935+ Name: "X-Forwarded-Email",
1936+ Values: []options.HeaderValue{
1937+ {
1938+ ClaimSource: &options.ClaimSource{
1939+ Claim: "email",
1940+ },
1941+ },
1942+ },
1943+ },
1944+ }
1945+
1946+ opts.InjectResponseHeaders = []options.Header{
1947+ {
1948+ Name: "Authorization",
1949+ Values: []options.HeaderValue{
1950+ {
1951+ ClaimSource: &options.ClaimSource{
1952+ Claim: "id_token",
1953+ Prefix: "Bearer ",
1954+ },
1955+ },
1956+ },
1957+ },
1958+ {
1959+ Name: "X-Auth-Request-User",
1960+ Values: []options.HeaderValue{
1961+ {
1962+ ClaimSource: &options.ClaimSource{
1963+ Claim: "user",
1964+ },
1965+ },
1966+ },
1967+ },
1968+ {
1969+ Name: "X-Auth-Request-Email",
1970+ Values: []options.HeaderValue{
1971+ {
1972+ ClaimSource: &options.ClaimSource{
1973+ Claim: "email",
1974+ },
1975+ },
1976+ },
1977+ },
1978+ }
1979+
19911980 opts.SkipJwtBearerTokens = true
19921981 opts.SetJWTBearerVerifiers(append(opts.GetJWTBearerVerifiers(), verifier))
19931982 })
@@ -2004,15 +1993,6 @@ func TestGetJwtSession(t *testing.T) {
20041993 "Authorization": {authHeader},
20051994 }
20061995
2007− // Bearer
2008− expires := time.Unix(1912151821, 0)
2009− session, err := test.proxy.getAuthenticatedSession(test.rw, test.req)
2010− assert.NoError(t, err)
2011− assert.Equal(t, session.User, "1234567890")
2012− assert.Equal(t, session.Email, "john@example.com")
2013− assert.Equal(t, session.ExpiresOn, &expires)
2014− assert.Equal(t, session.IDToken, goodJwt)
2015−
20161996 test.proxy.ServeHTTP(test.rw, test.req)
20171997 if test.rw.Code >= 400 {
20181998 t.Fatalf("expected 3xx got %d", test.rw.Code)
@@ -2140,6 +2120,43 @@ func baseTestOptions() *options.Options {
21402120 opts.ClientID = clientID
21412121 opts.ClientSecret = clientSecret
21422122 opts.EmailDomains = []string{"*"}
2123+
2124+ // Default injected headers for legacy configuration
2125+ opts.InjectRequestHeaders = []options.Header{
2126+ {
2127+ Name: "Authorization",
2128+ Values: []options.HeaderValue{
2129+ {
2130+ ClaimSource: &options.ClaimSource{
2131+ Claim: "user",
2132+ BasicAuthPassword: &options.SecretSource{
2133+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("This is a secure password"))),
2134+ },
2135+ },
2136+ },
2137+ },
2138+ },
2139+ {
2140+ Name: "X-Forwarded-User",
2141+ Values: []options.HeaderValue{
2142+ {
2143+ ClaimSource: &options.ClaimSource{
2144+ Claim: "user",
2145+ },
2146+ },
2147+ },
2148+ },
2149+ {
2150+ Name: "X-Forwarded-Email",
2151+ Values: []options.HeaderValue{
2152+ {
2153+ ClaimSource: &options.ClaimSource{
2154+ Claim: "email",
2155+ },
2156+ },
2157+ },
2158+ },
2159+ }
21432160 return opts
21442161}
21452162