git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #1379 from janrotter/fix-htpasswd-user-group

Store groups from the htpasswd-user-group in the session during the manual sign in process

commita87c27b6bf05f9a9373c1e8c1320bab3fb378e77 authorJoel Speed <Joel.speed@hotmail.co.uk> dateTue 28 Sep 2021, 11:09 (5 years ago) parent044b022b0ab60b
3 files changed+52−2
compare with master
unifiedsplit
CHANGELOG.md+1 oauthproxy.go+4−2 oauthproxy_test.go+47
CHANGELOG.md+1
@@ -18,6 +18,7 @@
1818
1919## Changes since v7.1.3
2020
21+- [#1379](https://github.com/oauth2-proxy/oauth2-proxy/pull/1379) Fix the manual sign in with --htpasswd-user-group switch (@janrotter)
2122- [#1337](https://github.com/oauth2-proxy/oauth2-proxy/pull/1337) Changing user field type to text when using htpasswd (@pburgisser)
2223- [#1239](https://github.com/oauth2-proxy/oauth2-proxy/pull/1239) Base GitLab provider implementation on OIDCProvider (@NickMeves)
2324- [#1276](https://github.com/oauth2-proxy/oauth2-proxy/pull/1276) Update crypto and switched to new github.com/golang-jwt/jwt (@JVecsei)
oauthproxy.go+4−2
@@ -78,6 +78,7 @@ type OAuthProxy struct {
7878 sessionStore sessionsapi.SessionStore
7979 ProxyPrefix string
8080 basicAuthValidator basic.Validator
81+ basicAuthGroups []string
8182 SkipProviderButton bool
8283 skipAuthPreflight bool
8384 skipJwtBearerTokens bool
@@ -200,6 +201,7 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr
200201 trustedIPs: trustedIPs,
201202
202203 basicAuthValidator: basicAuthValidator,
204+ basicAuthGroups: opts.HtpasswdUserGroups,
203205 sessionChain: sessionChain,
204206 headersChain: headersChain,
205207 preAuthChain: preAuthChain,
@@ -534,7 +536,7 @@ func (p *OAuthProxy) isTrustedIP(req *http.Request) bool {
534536 return p.trustedIPs.Has(remoteAddr)
535537}
536538
537−// SignInPage writes the sing in template to the response
539+// SignInPage writes the sign in template to the response
538540func (p *OAuthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code int) {
539541 prepareNoCache(rw)
540542 err := p.ClearSessionCookie(rw, req)
@@ -589,7 +591,7 @@ func (p *OAuthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {
589591
590592 user, ok := p.ManualSignIn(req)
591593 if ok {
592− session := &sessionsapi.SessionState{User: user}
594+ session := &sessionsapi.SessionState{User: user, Groups: p.basicAuthGroups}
593595 err = p.SaveSession(rw, req, session)
594596 if err != nil {
595597 logger.Printf("Error saving session: %v", err)
oauthproxy_test.go+47
@@ -587,6 +587,53 @@ func (sipTest *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
587587 return rw.Code, rw.Body.String()
588588}
589589
590+type AlwaysSuccessfulValidator struct {
591+}
592+
593+func (AlwaysSuccessfulValidator) Validate(user, password string) bool {
594+ return true
595+}
596+
597+func TestManualSignInStoresUserGroupsInTheSession(t *testing.T) {
598+ userGroups := []string{"somegroup", "someothergroup"}
599+
600+ opts := baseTestOptions()
601+ opts.HtpasswdUserGroups = userGroups
602+ err := validation.Validate(opts)
603+ if err != nil {
604+ t.Fatal(err)
605+ }
606+
607+ proxy, err := NewOAuthProxy(opts, func(email string) bool {
608+ return true
609+ })
610+ if err != nil {
611+ t.Fatal(err)
612+ }
613+ proxy.basicAuthValidator = AlwaysSuccessfulValidator{}
614+
615+ rw := httptest.NewRecorder()
616+ formData := url.Values{}
617+ formData.Set("username", "someuser")
618+ formData.Set("password", "somepass")
619+ signInReq, _ := http.NewRequest(http.MethodPost, "/oauth2/sign_in", strings.NewReader(formData.Encode()))
620+ signInReq.Header.Add("Content-Type", "application/x-www-form-urlencoded")
621+ proxy.ServeHTTP(rw, signInReq)
622+
623+ assert.Equal(t, http.StatusFound, rw.Code)
624+
625+ req, _ := http.NewRequest(http.MethodGet, "/something", strings.NewReader(formData.Encode()))
626+ for _, c := range rw.Result().Cookies() {
627+ req.AddCookie(c)
628+ }
629+
630+ s, err := proxy.sessionStore.Load(req)
631+ if err != nil {
632+ t.Fatal(err)
633+ }
634+ assert.Equal(t, userGroups, s.Groups)
635+}
636+
590637func TestSignInPageIncludesTargetRedirect(t *testing.T) {
591638 sipTest, err := NewSignInPageTest(false)
592639 if err != nil {