git.iko.soy/typeable/oauth2-proxy
on master help sign in
Allow specifying multiple google apps domains.
964929adrew
main.go+5−4
compare with master
unifiedsplit
@@ -23,12 +23,13 @@ var (
23 htpasswdFile = flag.String("htpasswd-file", "", "additionally authenticate against a htpasswd file. Entries must be created with \"htpasswd -s\" for SHA encryption")
23 htpasswdFile = flag.String("htpasswd-file", "", "additionally authenticate against a htpasswd file. Entries must be created with \"htpasswd -s\" for SHA encryption")
24 cookieSecret = flag.String("cookie-secret", "", "the seed string for secure cookies")
24 cookieSecret = flag.String("cookie-secret", "", "the seed string for secure cookies")
25 cookieDomain = flag.String("cookie-domain", "", "an optional cookie domain to force cookies to")
25 cookieDomain = flag.String("cookie-domain", "", "an optional cookie domain to force cookies to")
26− googleAppsDomain = flag.String("google-apps-domain", "", "authenticate against the given google apps domain")
27 authenticatedEmailsFile = flag.String("authenticated-emails-file", "", "authenticate against emails via file (one per line)")
26 authenticatedEmailsFile = flag.String("authenticated-emails-file", "", "authenticate against emails via file (one per line)")
27+ googleAppsDomains = StringArray{}
28 upstreams = StringArray{}
28 upstreams = StringArray{}
29)
29)
30
30
31func init() {
31func init() {
32+ flag.Var(&googleAppsDomains, "google-apps-domain", "authenticate against the given google apps domain (may be given multiple times)")
32 flag.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint. If multiple, routing is based on path")
33 flag.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint. If multiple, routing is based on path")
33}
34}
34
35
@@ -78,11 +79,11 @@ func main() {
78 log.Fatalf("error parsing --redirect-url %s", err.Error())
79 log.Fatalf("error parsing --redirect-url %s", err.Error())
79 }
80 }
80
81
81− validator := NewValidator(*googleAppsDomain, *authenticatedEmailsFile)
82+ validator := NewValidator(googleAppsDomains, *authenticatedEmailsFile)
82 oauthproxy := NewOauthProxy(upstreamUrls, *clientID, *clientSecret, validator)
83 oauthproxy := NewOauthProxy(upstreamUrls, *clientID, *clientSecret, validator)
83 oauthproxy.SetRedirectUrl(redirectUrl)
84 oauthproxy.SetRedirectUrl(redirectUrl)
84− if *googleAppsDomain != "" && *authenticatedEmailsFile == "" {
85+ if len(googleAppsDomains) != 0 && *authenticatedEmailsFile == "" {
85− oauthproxy.SignInMessage = fmt.Sprintf("using a %s email address", *googleAppsDomain)
86+ oauthproxy.SignInMessage = fmt.Sprintf("using a email address from the following domains: %v", strings.Join(googleAppsDomains, ", "))
86 }
87 }
87 if *htpasswdFile != "" {
88 if *htpasswdFile != "" {
88 oauthproxy.HtpasswdFile, err = NewHtpasswdFromFile(*htpasswdFile)
89 oauthproxy.HtpasswdFile, err = NewHtpasswdFromFile(*htpasswdFile)
validator.go+5−9
@@ -8,13 +8,8 @@ import (
8 "strings"
8 "strings"
9)
9)
10
10
11−func NewValidator(domain string, usersFile string) func(string) bool {
11+func NewValidator(domains []string, usersFile string) func(string) bool {
12−
13 validUsers := make(map[string]bool)
12 validUsers := make(map[string]bool)
14− emailSuffix := ""
15− if domain != "" {
16− emailSuffix = fmt.Sprintf("@%s", domain)
17− }
18
13
19 if usersFile != "" {
14 if usersFile != "" {
20 r, err := os.Open(usersFile)
15 r, err := os.Open(usersFile)
@@ -32,9 +27,10 @@ func NewValidator(domain string, usersFile string) func(string) bool {
32 }
27 }
33
28
34 validator := func(email string) bool {
29 validator := func(email string) bool {
35− var valid bool
30+ valid := false
36− if emailSuffix != "" {
31+ for _, domain := range domains {
32+ emailSuffix := fmt.Sprintf("@%s", domain)
37− valid = strings.HasSuffix(email, emailSuffix)
33+ valid = valid || strings.HasSuffix(email, emailSuffix)
38 }
34 }
39 if !valid {
35 if !valid {
40 _, valid = validUsers[email]
36 _, valid = validUsers[email]