ad4f7bc · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge pull request #1545 from andytson/feature/qs-allowed-groups-bypass

ad4f7bcJoel Speed5 years ago

CHANGELOG.md+1

@@ -12,6 +12,7 @@

12- [#1477](https://github.com/oauth2-proxy/oauth2-proxy/pull/1477) Remove provider documentation for `Microsoft Azure AD` (@omBratteng)

13- [#1509](https://github.com/oauth2-proxy/oauth2-proxy/pull/1509) Update LoginGovProvider ValidateSession to pass access_token in Header (@pksheldon4)

14- [#1474](https://github.com/oauth2-proxy/oauth2-proxy/pull/1474) Support configuration of minimal acceptable TLS version (@polarctos)

15+- [#1545](https://github.com/oauth2-proxy/oauth2-proxy/pull/1545) Fix issue with query string allowed group panic on skip methods (@andytson)

16# V7.2.1

17# V7.2.1

oauthproxy.go+5

@@ -977,6 +977,11 @@ func (p *OAuthProxy) getAuthenticatedSession(rw http.ResponseWriter, req *http.R

977//

978//nolint:gosimple

979func authOnlyAuthorize(req *http.Request, s *sessionsapi.SessionState) bool {

980+ // Allow requests previously allowed to be bypassed

981+ if s == nil {

982+ return true

983+ }

984+

980 // Allow secondary group restrictions based on the `allowed_groups`

985 // Allow secondary group restrictions based on the `allowed_groups`

981 // querystring parameter

986 // querystring parameter

982 if !checkAllowedGroups(req, s) {

987 if !checkAllowedGroups(req, s) {

oauthproxy_test.go+89

@@ -2594,3 +2594,92 @@ func TestAuthOnlyAllowedGroups(t *testing.T) {

2594 })

2595 }

2596}

2597+

2598+func TestAuthOnlyAllowedGroupsWithSkipMethods(t *testing.T) {

2599+ testCases := []struct {

2600+ name string

2601+ groups []string

2602+ method string

2603+ ip string

2604+ withSession bool

2605+ expectedStatusCode int

2606+ }{

2607+ {

2608+ name: "UserWithGroupSkipAuthPreflight",

2609+ groups: []string{"a", "c"},

2610+ method: "OPTIONS",

2611+ ip: "1.2.3.5:43670",

2612+ withSession: true,

2613+ expectedStatusCode: http.StatusAccepted,

2614+ },

2615+ {

2616+ name: "UserWithGroupTrustedIp",

2617+ groups: []string{"a", "c"},

2618+ method: "GET",

2619+ ip: "1.2.3.4:43670",

2620+ withSession: true,

2621+ expectedStatusCode: http.StatusAccepted,

2622+ },

2623+ {

2624+ name: "UserWithoutGroupSkipAuthPreflight",

2625+ groups: []string{"c"},

2626+ method: "OPTIONS",

2627+ ip: "1.2.3.5:43670",

2628+ withSession: true,

2629+ expectedStatusCode: http.StatusForbidden,

2630+ },

2631+ {

2632+ name: "UserWithoutGroupTrustedIp",

2633+ groups: []string{"c"},

2634+ method: "GET",

2635+ ip: "1.2.3.4:43670",

2636+ withSession: true,

2637+ expectedStatusCode: http.StatusForbidden,

2638+ },

2639+ {

2640+ name: "UserWithoutSessionSkipAuthPreflight",

2641+ method: "OPTIONS",

2642+ ip: "1.2.3.5:43670",

2643+ withSession: false,

2644+ expectedStatusCode: http.StatusAccepted,

2645+ },

2646+ {

2647+ name: "UserWithoutSessionTrustedIp",

2648+ method: "GET",

2649+ ip: "1.2.3.4:43670",

2650+ withSession: false,

2651+ expectedStatusCode: http.StatusAccepted,

2652+ },

2653+ }

2654+

2655+ for _, tc := range testCases {

2656+ t.Run(tc.name, func(t *testing.T) {

2657+ test, err := NewAuthOnlyEndpointTest("?allowed_groups=a,b", func(opts *options.Options) {

2658+ opts.SkipAuthPreflight = true

2659+ opts.TrustedIPs = []string{"1.2.3.4"}

2660+ })

2661+ if err != nil {

2662+ t.Fatal(err)

2663+ }

2664+

2665+ test.req.Method = tc.method

2666+ test.req.RemoteAddr = tc.ip

2667+

2668+ if tc.withSession {

2669+ created := time.Now()

2670+ session := &sessions.SessionState{

2671+ Groups: tc.groups,

2672+ Email: "test",

2673+ AccessToken: "oauth_token",

2674+ CreatedAt: &created,

2675+ }

2676+ err = test.SaveSession(session)

2677+ }

2678+ assert.NoError(t, err)

2679+

2680+ test.proxy.ServeHTTP(test.rw, test.req)

2681+

2682+ assert.Equal(t, tc.expectedStatusCode, test.rw.Code)

2683+ })

2684+ }

2685+}