git.iko.soy/typeable/oauth2-proxy
on master help sign in
Facebook Authentication Provider
a076347Jehiah Czebotar
README.md+6
compare with master
unifiedsplit
@@ -30,6 +30,7 @@ Valid providers are :
30
30
31* [Google](#google-auth-provider) *default*
31* [Google](#google-auth-provider) *default*
32* [Azure](#azure-auth-provider)
32* [Azure](#azure-auth-provider)
33+* [Facebook](#facebook-auth-provider)
33* [GitHub](#github-auth-provider)
34* [GitHub](#github-auth-provider)
34* [GitLab](#gitlab-auth-provider)
35* [GitLab](#gitlab-auth-provider)
35* [LinkedIn](#linkedin-auth-provider)
36* [LinkedIn](#linkedin-auth-provider)
@@ -87,6 +88,11 @@ Note: The user is checked against the group members list on initial authenticati
87The Azure AD auth provider uses `openid` as it default scope. It uses `https://graph.windows.net` as a default protected resource. It call to `https://graph.windows.net/me` to get the email address of the user that logs in.
88The Azure AD auth provider uses `openid` as it default scope. It uses `https://graph.windows.net` as a default protected resource. It call to `https://graph.windows.net/me` to get the email address of the user that logs in.
88
89
89
90
91+### Facebook Auth Provider
92+
93+1. Create a new FB App from <https://developers.facebook.com/>
94+2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`
95+
90### GitHub Auth Provider
96### GitHub Auth Provider
91
97
921. Create a new project: https://github.com/settings/developers
981. Create a new project: https://github.com/settings/developers
api/api.go+19
@@ -1,6 +1,7 @@
1package api
1package api
2
2
3import (
3import (
4+ "encoding/json"
4 "fmt"
5 "fmt"
5 "io/ioutil"
6 "io/ioutil"
6 "log"
7 "log"
@@ -31,6 +32,24 @@ func Request(req *http.Request) (*simplejson.Json, error) {
31 return data, nil
32 return data, nil
32}
33}
33
34
35+func RequestJson(req *http.Request, v interface{}) error {
36+ resp, err := http.DefaultClient.Do(req)
37+ if err != nil {
38+ log.Printf("%s %s %s", req.Method, req.URL, err)
39+ return err
40+ }
41+ body, err := ioutil.ReadAll(resp.Body)
42+ resp.Body.Close()
43+ log.Printf("%d %s %s %s", resp.StatusCode, req.Method, req.URL, body)
44+ if err != nil {
45+ return err
46+ }
47+ if resp.StatusCode != 200 {
48+ return fmt.Errorf("got %d %s", resp.StatusCode, body)
49+ }
50+ return json.Unmarshal(body, v)
51+}
52+
34func RequestUnparsedResponse(url string, header http.Header) (resp *http.Response, err error) {
53func RequestUnparsedResponse(url string, header http.Header) (resp *http.Response, err error) {
35 req, err := http.NewRequest("GET", url, nil)
54 req, err := http.NewRequest("GET", url, nil)
36 if err != nil {
55 if err != nil {
providers/facebook.gonew file+80
@@ -0,0 +1,80 @@
1+package providers
2+
3+import (
4+ "errors"
5+ "fmt"
6+ "net/http"
7+ "net/url"
8+
9+ "github.com/bitly/oauth2_proxy/api"
10+)
11+
12+type FacebookProvider struct {
13+ *ProviderData
14+}
15+
16+func NewFacebookProvider(p *ProviderData) *FacebookProvider {
17+ p.ProviderName = "Facebook"
18+ if p.LoginURL.String() == "" {
19+ p.LoginURL = &url.URL{Scheme: "https",
20+ Host: "www.facebook.com",
21+ Path: "/v2.5/dialog/oauth",
22+ // ?granted_scopes=true
23+ }
24+ }
25+ if p.RedeemURL.String() == "" {
26+ p.RedeemURL = &url.URL{Scheme: "https",
27+ Host: "graph.facebook.com",
28+ Path: "/v2.5/oauth/access_token",
29+ }
30+ }
31+ if p.ProfileURL.String() == "" {
32+ p.ProfileURL = &url.URL{Scheme: "https",
33+ Host: "graph.facebook.com",
34+ Path: "/v2.5/me",
35+ }
36+ }
37+ if p.ValidateURL.String() == "" {
38+ p.ValidateURL = p.ProfileURL
39+ }
40+ if p.Scope == "" {
41+ p.Scope = "public_profile email"
42+ }
43+ return &FacebookProvider{ProviderData: p}
44+}
45+
46+func getFacebookHeader(access_token string) http.Header {
47+ header := make(http.Header)
48+ header.Set("Accept", "application/json")
49+ header.Set("x-li-format", "json")
50+ header.Set("Authorization", fmt.Sprintf("Bearer %s", access_token))
51+ return header
52+}
53+
54+func (p *FacebookProvider) GetEmailAddress(s *SessionState) (string, error) {
55+ if s.AccessToken == "" {
56+ return "", errors.New("missing access token")
57+ }
58+ req, err := http.NewRequest("GET", p.ProfileURL.String()+"?fields=name,email", nil)
59+ if err != nil {
60+ return "", err
61+ }
62+ req.Header = getFacebookHeader(s.AccessToken)
63+
64+ type result struct {
65+ Email string
66+ }
67+ var r result
68+ err = api.RequestJson(req, &r)
69+ if err != nil {
70+ return "", err
71+ }
72+ if r.Email == "" {
73+ return "", errors.New("no email")
74+ }
75+ return r.Email, nil
76+}
77+
78+func (p *FacebookProvider) ValidateSessionState(s *SessionState) bool {
79+ return validateToken(p, s.AccessToken, getFacebookHeader(s.AccessToken))
80+}
providers/providers.go+2
@@ -22,6 +22,8 @@ func New(provider string, p *ProviderData) Provider {
22 return NewMyUsaProvider(p)
22 return NewMyUsaProvider(p)
23 case "linkedin":
23 case "linkedin":
24 return NewLinkedInProvider(p)
24 return NewLinkedInProvider(p)
25+ case "facebook":
26+ return NewFacebookProvider(p)
25 case "github":
27 case "github":
26 return NewGitHubProvider(p)
28 return NewGitHubProvider(p)
27 case "azure":
29 case "azure":