git.iko.soy/typeable/oauth2-proxy
on master help sign in
Fix default scope settings for none oidc providers like GitHub (#1927)

* fix default scope settings for none oidc providers * add changelog for bugfix * fix scope test cases by producing and accessing correct result value

commit8b77c9700979f2a249a9967204deecc63b91f6cf authorJan Larwig <jan@larwig.com> dateFri 23 Dec 2022, 10:00 (4 years ago) parentddcc433
3 files changed+24−7
CHANGELOG.md+1 providers/providers.go+1−1 providers/providers_test.go+22−6
CHANGELOG.md+1
@@ -12,6 +12,7 @@
1212- [#1882](https://github.com/oauth2-proxy/oauth2-proxy/pull/1882) Make `htpasswd.GetUsers` racecondition safe
1313- [#1883](https://github.com/oauth2-proxy/oauth2-proxy/pull/1883) Ensure v8 manifest variant is set on docker images
1414- [#1906](https://github.com/oauth2-proxy/oauth2-proxy/pull/1906) Fix PKCE code verifier generation to never use UTF-8 characters
15+- [#1927](https://github.com/oauth2-proxy/oauth2-proxy/pull/1927) Fix default scope settings for none oidc providers
1516
1617# V7.4.0
1718
providers/providers.go+1−1
@@ -152,7 +152,7 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
152152 p.EmailClaim = providerConfig.OIDCConfig.UserIDClaim
153153 }
154154
155− if p.Scope == "" {
155+ if providerConfig.Type == "oidc" && p.Scope == "" {
156156 p.Scope = "openid email profile"
157157
158158 if len(providerConfig.AllowedGroups) > 0 {
providers/providers_test.go+22−6
@@ -125,32 +125,48 @@ func TestScope(t *testing.T) {
125125
126126 testCases := []struct {
127127 name string
128+ configuredType options.ProviderType
128129 configuredScope string
129130 expectedScope string
130131 allowedGroups []string
131132 }{
132133 {
133− name: "with no scope provided",
134+ name: "oidc: with no scope provided",
135+ configuredType: "oidc",
134136 configuredScope: "",
135137 expectedScope: "openid email profile",
136138 },
137139 {
138− name: "with no scope provided and groups",
140+ name: "oidc: with no scope provided and groups",
141+ configuredType: "oidc",
139142 configuredScope: "",
140143 expectedScope: "openid email profile groups",
141144 allowedGroups: []string{"foo"},
142145 },
143146 {
144− name: "with a configured scope provided",
147+ name: "oidc: with a configured scope provided",
148+ configuredType: "oidc",
145149 configuredScope: "openid",
146150 expectedScope: "openid",
147151 },
152+ {
153+ name: "github: with no scope provided",
154+ configuredType: "github",
155+ configuredScope: "",
156+ expectedScope: "user:email",
157+ },
158+ {
159+ name: "github: with a configured scope provided",
160+ configuredType: "github",
161+ configuredScope: "user:email org:read",
162+ expectedScope: "user:email org:read",
163+ },
148164 }
149165
150166 for _, tc := range testCases {
151167 providerConfig := options.Provider{
152168 ID: providerID,
153− Type: "oidc",
169+ Type: tc.configuredType,
154170 ClientID: clientID,
155171 ClientSecretFile: clientSecret,
156172 LoginURL: msAuthURL,
@@ -164,10 +180,10 @@ func TestScope(t *testing.T) {
164180 },
165181 }
166182
167− pd, err := newProviderDataFromConfig(providerConfig)
183+ pd, err := NewProvider(providerConfig)
168184 g.Expect(err).ToNot(HaveOccurred())
169185
170− g.Expect(pd.Scope).To(Equal(tc.expectedScope))
186+ g.Expect(pd.Data().Scope).To(Equal(tc.expectedScope))
171187 }
172188}
173189