git.iko.soy/typeable/oauth2-proxy
on master help sign in
Remove options dependency on providers package
commit95dd2745c7f0d0de3812478f2dc49768042af2cc authorJoel Speed <joel.speed@hotmail.co.uk> dateTue 15 Feb 2022, 11:07 (5 years ago) parent9832844
3 files changed+23−21
compare with master
unifiedsplit
pkg/apis/options/legacy_options.go+4−5 pkg/apis/options/options.go+5−11 pkg/apis/options/providers.go+14−5
pkg/apis/options/legacy_options.go+4−5
@@ -8,7 +8,6 @@ import (
88 "time"
99
1010 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
11− "github.com/oauth2-proxy/oauth2-proxy/v7/providers"
1211 "github.com/spf13/pflag"
1312)
1413
@@ -552,9 +551,9 @@ func legacyProviderFlagSet() *pflag.FlagSet {
552551 flagSet.Bool("insecure-oidc-skip-nonce", true, "skip verifying the OIDC ID Token's nonce claim")
553552 flagSet.Bool("skip-oidc-discovery", false, "Skip OIDC discovery and use manually supplied Endpoints")
554553 flagSet.String("oidc-jwks-url", "", "OpenID Connect JWKS URL (ie: https://www.googleapis.com/oauth2/v3/certs)")
555− flagSet.String("oidc-groups-claim", providers.OIDCGroupsClaim, "which OIDC claim contains the user groups")
556− flagSet.String("oidc-email-claim", providers.OIDCEmailClaim, "which OIDC claim contains the user's email")
557− flagSet.StringSlice("oidc-audience-claim", providers.OIDCAudienceClaims, "which OIDC claims are used as audience to verify against client id")
554+ flagSet.String("oidc-groups-claim", OIDCGroupsClaim, "which OIDC claim contains the user groups")
555+ flagSet.String("oidc-email-claim", OIDCEmailClaim, "which OIDC claim contains the user's email")
556+ flagSet.StringSlice("oidc-audience-claim", OIDCAudienceClaims, "which OIDC claims are used as audience to verify against client id")
558557 flagSet.StringSlice("oidc-extra-audience", []string{}, "additional audiences allowed to pass audience verification")
559558 flagSet.String("login-url", "", "Authentication endpoint")
560559 flagSet.String("redeem-url", "", "Token redemption endpoint")
@@ -570,7 +569,7 @@ func legacyProviderFlagSet() *pflag.FlagSet {
570569 flagSet.String("jwt-key-file", "", "path to the private key file in PEM format used to sign the JWT so that you can say something like -jwt-key-file=/etc/ssl/private/jwt_signing_key.pem: required by login.gov")
571570 flagSet.String("pubjwk-url", "", "JWK pubkey access endpoint: required by login.gov")
572571
573− flagSet.String("user-id-claim", providers.OIDCEmailClaim, "(DEPRECATED for `oidc-email-claim`) which claim contains the user ID")
572+ flagSet.String("user-id-claim", OIDCEmailClaim, "(DEPRECATED for `oidc-email-claim`) which claim contains the user ID")
574573 flagSet.StringSlice("allowed-group", []string{}, "restrict logins to members of this group (may be given multiple times)")
575574 flagSet.StringSlice("allowed-role", []string{}, "(keycloak-oidc) restrict logins to members of these roles (may be given multiple times)")
576575
pkg/apis/options/options.go+5−11
@@ -6,7 +6,6 @@ import (
66
77 ipapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/ip"
88 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/oidc"
9− "github.com/oauth2-proxy/oauth2-proxy/v7/providers"
109 "github.com/spf13/pflag"
1110)
1211
@@ -68,7 +67,6 @@ type Options struct {
6867
6968 // internal values that are set after config validation
7069 redirectURL *url.URL
71− provider providers.Provider
7270 signatureData *SignatureData
7371 oidcVerifier *internaloidc.IDTokenVerifier
7472 jwtBearerVerifiers []*internaloidc.IDTokenVerifier
@@ -77,7 +75,6 @@ type Options struct {
7775
7876// Options for Getting internal values
7977func (o *Options) GetRedirectURL() *url.URL { return o.redirectURL }
80−func (o *Options) GetProvider() providers.Provider { return o.provider }
8178func (o *Options) GetSignatureData() *SignatureData { return o.signatureData }
8279func (o *Options) GetOIDCVerifier() *internaloidc.IDTokenVerifier { return o.oidcVerifier }
8380func (o *Options) GetJWTBearerVerifiers() []*internaloidc.IDTokenVerifier {
@@ -86,14 +83,11 @@ func (o *Options) GetJWTBearerVerifiers() []*internaloidc.IDTokenVerifier {
8683func (o *Options) GetRealClientIPParser() ipapi.RealClientIPParser { return o.realClientIPParser }
8784
8885// Options for Setting internal values
89−func (o *Options) SetRedirectURL(s *url.URL) { o.redirectURL = s }
90−func (o *Options) SetProvider(s providers.Provider) { o.provider = s }
91−func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s }
92−func (o *Options) SetOIDCVerifier(s *internaloidc.IDTokenVerifier) { o.oidcVerifier = s }
93−func (o *Options) SetJWTBearerVerifiers(s []*internaloidc.IDTokenVerifier) {
94− o.jwtBearerVerifiers = s
95−}
96−func (o *Options) SetRealClientIPParser(s ipapi.RealClientIPParser) { o.realClientIPParser = s }
86+func (o *Options) SetRedirectURL(s *url.URL) { o.redirectURL = s }
87+func (o *Options) SetSignatureData(s *SignatureData) { o.signatureData = s }
88+func (o *Options) SetOIDCVerifier(s *internaloidc.IDTokenVerifier) { o.oidcVerifier = s }
89+func (o *Options) SetJWTBearerVerifiers(s []*internaloidc.IDTokenVerifier) { o.jwtBearerVerifiers = s }
90+func (o *Options) SetRealClientIPParser(s ipapi.RealClientIPParser) { o.realClientIPParser = s }
9791
9892// NewOptions constructs a new Options with defaulted values
9993func NewOptions() *Options {
pkg/apis/options/providers.go+14−5
@@ -1,6 +1,15 @@
11package options
22
3−import "github.com/oauth2-proxy/oauth2-proxy/v7/providers"
3+const (
4+ // OIDCEmailClaim is the generic email claim used by the OIDC provider.
5+ OIDCEmailClaim = "email"
6+
7+ // OIDCGroupsClaim is the generic groups claim used by the OIDC provider.
8+ OIDCGroupsClaim = "groups"
9+)
10+
11+// OIDCAudienceClaims is the generic audience claim list used by the OIDC provider.
12+var OIDCAudienceClaims = []string{"aud"}
413
514// Providers is a collection of definitions for providers.
615type Providers []Provider
@@ -194,10 +203,10 @@ func providerDefaults() Providers {
194203 InsecureAllowUnverifiedEmail: false,
195204 InsecureSkipNonce: true,
196205 SkipDiscovery: false,
197− UserIDClaim: providers.OIDCEmailClaim, // Deprecated: Use OIDCEmailClaim
198− EmailClaim: providers.OIDCEmailClaim,
199− GroupsClaim: providers.OIDCGroupsClaim,
200− AudienceClaims: providers.OIDCAudienceClaims,
206+ UserIDClaim: OIDCEmailClaim, // Deprecated: Use OIDCEmailClaim
207+ EmailClaim: OIDCEmailClaim,
208+ GroupsClaim: OIDCGroupsClaim,
209+ AudienceClaims: OIDCAudienceClaims,
201210 ExtraAudiences: []string{},
202211 },
203212 },