@@ -1,36 +1,32 @@
11package providers
22
33import (
4− "context"
5− "errors"
6− "fmt"
74 "net/url"
85 "strings"
9−
10− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
116)
127
138// ADFSProvider represents an ADFS based Identity Provider
149type ADFSProvider struct {
1510 *OIDCProvider
16− SkipScope bool
11+ skipScope bool
1712}
1813
1914var _ Provider = (*ADFSProvider)(nil)
2015
2116const (
22− ADFSProviderName = "ADFS"
23− ADFSDefaultScope = "openid email profile"
24− ADFSSkipScope = false
17+ adfsProviderName = "ADFS"
18+ adfsDefaultScope = "openid email profile"
19+ adfsSkipScope = false
20+ adfsEmailClaim = "upn"
2521)
2622
2723// NewADFSProvider initiates a new ADFSProvider
2824func NewADFSProvider(p *ProviderData) *ADFSProvider {
29−
3025 p.setProviderDefaults(providerDefaults{
31− name: ADFSProviderName,
32− scope: ADFSDefaultScope,
26+ name: adfsProviderName,
27+ scope: adfsDefaultScope,
3328 })
29+ p.EmailClaim = adfsEmailClaim
3430
3531 if p.ProtectedResource != nil && p.ProtectedResource.String() != "" {
3632 resource := p.ProtectedResource.String()
@@ -48,13 +44,13 @@ func NewADFSProvider(p *ProviderData) *ADFSProvider {
4844 ProviderData: p,
4945 SkipNonce: true,
5046 },
51− SkipScope: ADFSSkipScope,
47+ skipScope: adfsSkipScope,
5248 }
5349}
5450
5551// Configure defaults the ADFSProvider configuration options
5652func (p *ADFSProvider) Configure(skipScope bool) {
57− p.SkipScope = skipScope
53+ p.skipScope = skipScope
5854}
5955
6056// GetLoginURL Override to double encode the state parameter. If not query params are lost
@@ -65,36 +61,10 @@ func (p *ADFSProvider) GetLoginURL(redirectURI, state, nonce string) string {
6561 extraParams.Add("nonce", nonce)
6662 }
6763 loginURL := makeLoginURL(p.Data(), redirectURI, url.QueryEscape(state), extraParams)
68− if p.SkipScope {
64+ if p.skipScope {
6965 q := loginURL.Query()
7066 q.Del("scope")
7167 loginURL.RawQuery = q.Encode()
7268 }
7369 return loginURL.String()
7470}
75−
76−// EnrichSession to add email
77−func (p *ADFSProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
78− if s.Email != "" {
79− return nil
80− }
81−
82− idToken, err := p.Verifier.Verify(ctx, s.IDToken)
83− if err != nil {
84− return err
85− }
86−
87− p.EmailClaim = "upn"
88− c, err := p.getClaims(idToken)
89−
90− if err != nil {
91− return fmt.Errorf("couldn't extract claims from id_token (%v)", err)
92− }
93− s.Email = c.Email
94−
95− if s.Email == "" {
96− err = errors.New("email not set")
97− }
98−
99− return err
100−}