git.iko.soy/typeable/oauth2-proxy
on master help sign in
Use `upn` as EmailClaim throughout ADFSProvider
a531987Nick Meves
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -8,6 +8,7 @@
8
8
9## Changes since v7.2.0
9## Changes since v7.2.0
10
10
11+- [#1247](https://github.com/oauth2-proxy/oauth2-proxy/pull/1247) Use `upn` claim consistently in ADFSProvider (@NickMeves)
11- [#1447](https://github.com/oauth2-proxy/oauth2-proxy/pull/1447) Fix docker build/push issues found during last release (@JoelSpeed)
12- [#1447](https://github.com/oauth2-proxy/oauth2-proxy/pull/1447) Fix docker build/push issues found during last release (@JoelSpeed)
12- [#1433](https://github.com/oauth2-proxy/oauth2-proxy/pull/1433) Let authentication fail when session validation fails (@stippi2)
13- [#1433](https://github.com/oauth2-proxy/oauth2-proxy/pull/1433) Let authentication fail when session validation fails (@stippi2)
13- [#1445](https://github.com/oauth2-proxy/oauth2-proxy/pull/1445) Fix docker container multi arch build issue by passing GOARCH details to make build (@jkandasa)
14- [#1445](https://github.com/oauth2-proxy/oauth2-proxy/pull/1445) Fix docker container multi arch build issue by passing GOARCH details to make build (@jkandasa)
providers/adfs.go+11−41
@@ -1,36 +1,32 @@
1package providers
1package providers
2
2
3import (
3import (
4− "context"
5− "errors"
6− "fmt"
7 "net/url"
4 "net/url"
8 "strings"
5 "strings"
9−
10− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
11)
6)
12
7
13// ADFSProvider represents an ADFS based Identity Provider
8// ADFSProvider represents an ADFS based Identity Provider
14type ADFSProvider struct {
9type ADFSProvider struct {
15 *OIDCProvider
10 *OIDCProvider
16− SkipScope bool
11+ skipScope bool
17}
12}
18
13
19var _ Provider = (*ADFSProvider)(nil)
14var _ Provider = (*ADFSProvider)(nil)
20
15
21const (
16const (
22− ADFSProviderName = "ADFS"
17+ adfsProviderName = "ADFS"
23− ADFSDefaultScope = "openid email profile"
18+ adfsDefaultScope = "openid email profile"
24− ADFSSkipScope = false
19+ adfsSkipScope = false
20+ adfsEmailClaim = "upn"
25)
21)
26
22
27// NewADFSProvider initiates a new ADFSProvider
23// NewADFSProvider initiates a new ADFSProvider
28func NewADFSProvider(p *ProviderData) *ADFSProvider {
24func NewADFSProvider(p *ProviderData) *ADFSProvider {
29−
30 p.setProviderDefaults(providerDefaults{
25 p.setProviderDefaults(providerDefaults{
31− name: ADFSProviderName,
26+ name: adfsProviderName,
32− scope: ADFSDefaultScope,
27+ scope: adfsDefaultScope,
33 })
28 })
29+ p.EmailClaim = adfsEmailClaim
34
30
35 if p.ProtectedResource != nil && p.ProtectedResource.String() != "" {
31 if p.ProtectedResource != nil && p.ProtectedResource.String() != "" {
36 resource := p.ProtectedResource.String()
32 resource := p.ProtectedResource.String()
@@ -48,13 +44,13 @@ func NewADFSProvider(p *ProviderData) *ADFSProvider {
48 ProviderData: p,
44 ProviderData: p,
49 SkipNonce: true,
45 SkipNonce: true,
50 },
46 },
51− SkipScope: ADFSSkipScope,
47+ skipScope: adfsSkipScope,
52 }
48 }
53}
49}
54
50
55// Configure defaults the ADFSProvider configuration options
51// Configure defaults the ADFSProvider configuration options
56func (p *ADFSProvider) Configure(skipScope bool) {
52func (p *ADFSProvider) Configure(skipScope bool) {
57− p.SkipScope = skipScope
53+ p.skipScope = skipScope
58}
54}
59
55
60// GetLoginURL Override to double encode the state parameter. If not query params are lost
56// GetLoginURL Override to double encode the state parameter. If not query params are lost
@@ -65,36 +61,10 @@ func (p *ADFSProvider) GetLoginURL(redirectURI, state, nonce string) string {
65 extraParams.Add("nonce", nonce)
61 extraParams.Add("nonce", nonce)
66 }
62 }
67 loginURL := makeLoginURL(p.Data(), redirectURI, url.QueryEscape(state), extraParams)
63 loginURL := makeLoginURL(p.Data(), redirectURI, url.QueryEscape(state), extraParams)
68− if p.SkipScope {
64+ if p.skipScope {
69 q := loginURL.Query()
65 q := loginURL.Query()
70 q.Del("scope")
66 q.Del("scope")
71 loginURL.RawQuery = q.Encode()
67 loginURL.RawQuery = q.Encode()
72 }
68 }
73 return loginURL.String()
69 return loginURL.String()
74}
70}
75−
76−// EnrichSession to add email
77−func (p *ADFSProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
78− if s.Email != "" {
79− return nil
80− }
81−
82− idToken, err := p.Verifier.Verify(ctx, s.IDToken)
83− if err != nil {
84− return err
85− }
86−
87− p.EmailClaim = "upn"
88− c, err := p.getClaims(idToken)
89−
90− if err != nil {
91− return fmt.Errorf("couldn't extract claims from id_token (%v)", err)
92− }
93− s.Email = c.Email
94−
95− if s.Email == "" {
96− err = errors.New("email not set")
97− }
98−
99− return err
100−}
providers/adfs_test.go+2−2
@@ -134,8 +134,8 @@ var _ = Describe("ADFS Provider Tests", func() {
134 idToken, err := p.Verifier.Verify(context.Background(), rawIDToken)
134 idToken, err := p.Verifier.Verify(context.Background(), rawIDToken)
135 Expect(err).To(BeNil())
135 Expect(err).To(BeNil())
136 session, err := p.buildSessionFromClaims(idToken)
136 session, err := p.buildSessionFromClaims(idToken)
137− session.IDToken = rawIDToken
138 Expect(err).To(BeNil())
137 Expect(err).To(BeNil())
138+ session.IDToken = rawIDToken
139 err = p.EnrichSession(context.Background(), session)
139 err = p.EnrichSession(context.Background(), session)
140 Expect(session.Email).To(Equal("janed@me.com"))
140 Expect(session.Email).To(Equal("janed@me.com"))
141 Expect(err).To(BeNil())
141 Expect(err).To(BeNil())
@@ -149,7 +149,7 @@ var _ = Describe("ADFS Provider Tests", func() {
149 ProtectedResource: resource,
149 ProtectedResource: resource,
150 Scope: "",
150 Scope: "",
151 })
151 })
152− p.SkipScope = true
152+ p.skipScope = true
153
153
154 result := p.GetLoginURL("https://example.com/adfs/oauth2/", "", "")
154 result := p.GetLoginURL("https://example.com/adfs/oauth2/", "", "")
155 Expect(result).NotTo(ContainSubstring("scope="))
155 Expect(result).NotTo(ContainSubstring("scope="))