@@ -5,7 +5,6 @@ import (
55 "errors"
66 "fmt"
77 "html/template"
8− "log"
98 "net"
109 "net/http"
1110 "net/http/httputil"
@@ -16,6 +15,7 @@ import (
1615
1716 "github.com/mbland/hmacauth"
1817 "github.com/pusher/oauth2_proxy/cookie"
18+ "github.com/pusher/oauth2_proxy/logger"
1919 "github.com/pusher/oauth2_proxy/providers"
2020 "github.com/yhat/wsutil"
2121)
@@ -185,15 +185,28 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {
185185 path := u.Path
186186 switch u.Scheme {
187187 case httpScheme, httpsScheme:
188+<<<<<<< HEAD
188189 log.Printf("mapping path %q => upstream %q", path, u)
189190 proxy := NewWebSocketOrRestReverseProxy(u, opts, auth)
190191 serveMux.Handle(path, proxy)
191192
193+=======
194+ u.Path = ""
195+ logger.Printf("mapping path %q => upstream %q", path, u)
196+ proxy := NewReverseProxy(u, opts.FlushInterval)
197+ if !opts.PassHostHeader {
198+ setProxyUpstreamHostHeader(proxy, u)
199+ } else {
200+ setProxyDirector(proxy)
201+ }
202+ serveMux.Handle(path,
203+ &UpstreamProxy{u.Host, proxy, auth})
204+>>>>>>> Auth and standard logging with file rolling
192205 case "file":
193206 if u.Fragment != "" {
194207 path = u.Fragment
195208 }
196− log.Printf("mapping path %q => file system %q", path, u.Path)
209+ logger.Printf("mapping path %q => file system %q", path, u.Path)
197210 proxy := NewFileServer(path, u.Path)
198211 serveMux.Handle(path, &UpstreamProxy{path, proxy, nil, nil})
199212 default:
@@ -201,7 +214,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {
201214 }
202215 }
203216 for _, u := range opts.CompiledRegex {
204− log.Printf("compiled skip-auth-regex => %q", u)
217+ logger.Printf("compiled skip-auth-regex => %q", u)
205218 }
206219
207220 redirectURL := opts.redirectURL
@@ -209,20 +222,24 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {
209222 redirectURL.Path = fmt.Sprintf("%s/callback", opts.ProxyPrefix)
210223 }
211224
212− log.Printf("OAuthProxy configured for %s Client ID: %s", opts.provider.Data().ProviderName, opts.ClientID)
225+ logger.Printf("OAuthProxy configured for %s Client ID: %s", opts.provider.Data().ProviderName, opts.ClientID)
213226 refresh := "disabled"
214227 if opts.CookieRefresh != time.Duration(0) {
215228 refresh = fmt.Sprintf("after %s", opts.CookieRefresh)
216229 }
217230
231+<<<<<<< HEAD
218232 log.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domain:%s path:%s refresh:%s", opts.CookieName, opts.CookieSecure, opts.CookieHTTPOnly, opts.CookieExpire, opts.CookieDomain, opts.CookiePath, refresh)
233+=======
234+ logger.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domain:%s refresh:%s", opts.CookieName, opts.CookieSecure, opts.CookieHTTPOnly, opts.CookieExpire, opts.CookieDomain, refresh)
235+>>>>>>> Auth and standard logging with file rolling
219236
220237 var cipher *cookie.Cipher
221238 if opts.PassAccessToken || opts.SetAuthorization || opts.PassAuthorization || (opts.CookieRefresh != time.Duration(0)) {
222239 var err error
223240 cipher, err = cookie.NewCipher(secretBytes(opts.CookieSecret))
224241 if err != nil {
225− log.Fatal("cookie-secret error: ", err)
242+ logger.Fatal("cookie-secret error: ", err)
226243 }
227244 }
228245
@@ -425,7 +442,7 @@ func (p *OAuthProxy) makeCookie(req *http.Request, name string, value string, ex
425442 domain = h
426443 }
427444 if !strings.HasSuffix(domain, p.CookieDomain) {
428− log.Printf("Warning: request host is %q but using configured cookie domain of %q", domain, p.CookieDomain)
445+ logger.Printf("Warning: request host is %q but using configured cookie domain of %q", domain, p.CookieDomain)
429446 }
430447 }
431448
@@ -529,7 +546,6 @@ func (p *OAuthProxy) PingPage(rw http.ResponseWriter) {
529546
530547// ErrorPage writes an error response
531548func (p *OAuthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, message string) {
532− log.Printf("ErrorPage %d %s %s", code, title, message)
533549 rw.WriteHeader(code)
534550 t := struct {
535551 Title string
@@ -588,9 +604,10 @@ func (p *OAuthProxy) ManualSignIn(rw http.ResponseWriter, req *http.Request) (st
588604 }
589605 // check auth
590606 if p.HtpasswdFile.Validate(user, passwd) {
591− log.Printf("authenticated %q via HtpasswdFile", user)
607+ logger.PrintAuthf(user, req, logger.AuthSuccess, "Successful authentication via HtpasswdFile")
592608 return user, true
593609 }
610+ logger.PrintAuthf(user, req, logger.AuthFailure, "Failed authentication via HtpasswdFile; unauthorized")
594611 return "", false
595612}
596613
@@ -686,6 +703,7 @@ func (p *OAuthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
686703func (p *OAuthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {
687704 redirect, err := p.GetRedirect(req)
688705 if err != nil {
706+ logger.Printf("Error obtaining redirect: %s", err.Error())
689707 p.ErrorPage(rw, 500, "Internal Error", err.Error())
690708 return
691709 }
@@ -714,12 +732,14 @@ func (p *OAuthProxy) SignOut(rw http.ResponseWriter, req *http.Request) {
714732func (p *OAuthProxy) OAuthStart(rw http.ResponseWriter, req *http.Request) {
715733 nonce, err := cookie.Nonce()
716734 if err != nil {
735+ logger.Printf("Error obtaining nonce: %s", err.Error())
717736 p.ErrorPage(rw, 500, "Internal Error", err.Error())
718737 return
719738 }
720739 p.SetCSRFCookie(rw, req, nonce)
721740 redirect, err := p.GetRedirect(req)
722741 if err != nil {
742+ logger.Printf("Error obtaining redirect: %s", err.Error())
723743 p.ErrorPage(rw, 500, "Internal Error", err.Error())
724744 return
725745 }
@@ -735,24 +755,27 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
735755 // finish the oauth cycle
736756 err := req.ParseForm()
737757 if err != nil {
758+ logger.Printf("Error while parsing OAuth callback: %s" + err.Error())
738759 p.ErrorPage(rw, 500, "Internal Error", err.Error())
739760 return
740761 }
741762 errorString := req.Form.Get("error")
742763 if errorString != "" {
764+ logger.Printf("Error while parsing OAuth callback: %s ", errorString)
743765 p.ErrorPage(rw, 403, "Permission Denied", errorString)
744766 return
745767 }
746768
747769 session, err := p.redeemCode(req.Host, req.Form.Get("code"))
748770 if err != nil {
749− log.Printf("%s error redeeming code %s", remoteAddr, err)
771+ logger.Printf("Error while parsing OAuth callback: %s ", errorString)
750772 p.ErrorPage(rw, 500, "Internal Error", "Internal Error")
751773 return
752774 }
753775
754776 s := strings.SplitN(req.Form.Get("state"), ":", 2)
755777 if len(s) != 2 {
778+ logger.Printf("Error while parsing OAuth state; invalid length")
756779 p.ErrorPage(rw, 500, "Internal Error", "Invalid State")
757780 return
758781 }
@@ -760,12 +783,13 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
760783 redirect := s[1]
761784 c, err := req.Cookie(p.CSRFCookieName)
762785 if err != nil {
786+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Failed authentication via oauth2; unable too obtain CSRF cookie")
763787 p.ErrorPage(rw, 403, "Permission Denied", err.Error())
764788 return
765789 }
766790 p.ClearCSRFCookie(rw, req)
767791 if c.Value != nonce {
768− log.Printf("%s csrf token mismatch, potential attack", remoteAddr)
792+ logger.PrintAuthf(session.Email, req, logger.AuthFailure, "Failed authentication via oauth2; csrf token mismatch, potential attack")
769793 p.ErrorPage(rw, 403, "Permission Denied", "csrf failed")
770794 return
771795 }
@@ -776,16 +800,16 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
776800
777801 // set cookie, or deny
778802 if p.Validator(session.Email) && p.provider.ValidateGroup(session.Email) {
779− log.Printf("%s authentication complete %s", remoteAddr, session)
803+ logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Successful authentication via oauth2; %s", session)
780804 err := p.SaveSession(rw, req, session)
781805 if err != nil {
782− log.Printf("%s %s", remoteAddr, err)
806+ logger.Printf("%s %s", remoteAddr, err)
783807 p.ErrorPage(rw, 500, "Internal Error", "Internal Error")
784808 return
785809 }
786810 http.Redirect(rw, req, redirect, 302)
787811 } else {
788− log.Printf("%s Permission Denied: %q is unauthorized", remoteAddr, session.Email)
812+ logger.PrintAuthf(session.Email, req, logger.AuthSuccess, "Failed authentication via oauth2; unauthorized")
789813 p.ErrorPage(rw, 403, "Permission Denied", "Invalid Account")
790814 }
791815}
@@ -827,16 +851,16 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int
827851
828852 session, sessionAge, err := p.LoadCookiedSession(req)
829853 if err != nil {
830− log.Printf("%s %s", remoteAddr, err)
854+ logger.Printf("Error loading cookied session: %s", err)
831855 }
832856 if session != nil && sessionAge > p.CookieRefresh && p.CookieRefresh != time.Duration(0) {
833− log.Printf("%s refreshing %s old session cookie for %s (refresh after %s)", remoteAddr, sessionAge, session, p.CookieRefresh)
857+ logger.Printf("Refreshing %s old session cookie for %s (refresh after %s)", sessionAge, session, p.CookieRefresh)
834858 saveSession = true
835859 }
836860
837861 var ok bool
838862 if ok, err = p.provider.RefreshSessionIfNeeded(session); err != nil {
839− log.Printf("%s removing session. error refreshing access token %s %s", remoteAddr, err, session)
863+ logger.Printf("%s removing session. error refreshing access token %s %s", remoteAddr, err, session)
840864 clearSession = true
841865 session = nil
842866 } else if ok {
@@ -845,7 +869,7 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int
845869 }
846870
847871 if session != nil && session.IsExpired() {
848− log.Printf("%s removing session. token expired %s", remoteAddr, session)
872+ logger.Printf("Removing session; token expired %s", session)
849873 session = nil
850874 saveSession = false
851875 clearSession = true
@@ -853,7 +877,7 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int
853877
854878 if saveSession && !revalidated && session != nil && session.AccessToken != "" {
855879 if !p.provider.ValidateSessionState(session) {
856− log.Printf("%s removing session. error validating %s", remoteAddr, session)
880+ logger.Printf("Removing session; error validating %s", session)
857881 saveSession = false
858882 session = nil
859883 clearSession = true
@@ -861,7 +885,7 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int
861885 }
862886
863887 if session != nil && session.Email != "" && !p.Validator(session.Email) {
864− log.Printf("%s Permission Denied: removing session %s", remoteAddr, session)
888+ logger.Printf(session.Email, req, logger.AuthFailure, "Failed authentication via session; removing session %s", session)
865889 session = nil
866890 saveSession = false
867891 clearSession = true
@@ -870,7 +894,7 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int
870894 if saveSession && session != nil {
871895 err = p.SaveSession(rw, req, session)
872896 if err != nil {
873− log.Printf("%s %s", remoteAddr, err)
897+ logger.PrintAuthf(session.Email, req, logger.AuthError, "Save session error %s", err)
874898 return http.StatusInternalServerError
875899 }
876900 }
@@ -881,9 +905,6 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int
881905
882906 if session == nil {
883907 session, err = p.CheckBasicAuth(req)
884− if err != nil {
885− log.Printf("%s %s", remoteAddr, err)
886− }
887908 }
888909
889910 if session == nil {
@@ -958,9 +979,10 @@ func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*providers.SessionState,
958979 return nil, fmt.Errorf("invalid format %s", b)
959980 }
960981 if p.HtpasswdFile.Validate(pair[0], pair[1]) {
961− log.Printf("authenticated %q via basic auth", pair[0])
982+ logger.PrintAuthf(pair[0], req, logger.AuthSuccess, "Successful authentication via basic auth")
962983 return &providers.SessionState{User: pair[0]}, nil
963984 }
985+ logger.PrintAuthf(pair[0], req, logger.AuthFailure, "Failed authentication via basic auth; not in Htpasswd file")
964986 return nil, fmt.Errorf("%s not in HtpasswdFile", pair[0])
965987}
966988