af7be2d · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merge pull request #319 from advarisk/auth-request

various fixes for getting Nginx auth_request mode working

commitaf7be2d622e2d2aecc4b7170f5e75fdff51e1ffe authorJehiah Czebotar <jehiah@gmail.com> dateWed 29 Mar 2017, 12:14 (10 years ago) parent93852a2 fe44b89

5 files changed+63−4

compare with master

unifiedsplit

README.md+19−4 main.go+1 oauthproxy.go+11 oauthproxy_test.go+30 options.go+2

README.md+19−4

@@ -359,10 +359,25 @@ server {

359359 }

360360

361361 location /oauth2/ {

362− proxy_pass http://127.0.0.1:4180;

363− proxy_set_header Host $host;

364− proxy_set_header X-Real-IP $remote_addr;

365− proxy_set_header X-Scheme $scheme;

362+ proxy_pass http://127.0.0.1:4180;

363+ proxy_set_header Host $host;

364+ proxy_set_header X-Real-IP $remote_addr;

365+ proxy_set_header X-Scheme $scheme;

366+ proxy_set_header X-Auth-Request-Redirect $request_uri;

367+ }

368+

369+ location /upstream/ {

370+ auth_request /oauth2/auth;

371+ error_page 401 = /oauth2/sign_in;

372+

373+ # pass information via X-User and X-Email headers to backend,

374+ # requires running with --set-xauthrequest flag

375+ auth_request_set $user $upstream_http_x_auth_request_user;

376+ auth_request_set $email $upstream_http_x_auth_request_email;

377+ proxy_set_header X-User $user;

378+ proxy_set_header X-Email $email;

379+

380+ proxy_pass http://backend/;

366381 }

367382

368383 location / {

main.go+1

@@ -30,6 +30,7 @@ func main() {

3030 flagSet.String("tls-cert", "", "path to certificate file")

3131 flagSet.String("tls-key", "", "path to private key file")

3232 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")

33+ flagSet.Bool("set-xauthrequest", false, "set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)")

3334 flagSet.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path")

3435 flagSet.Bool("pass-basic-auth", true, "pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream")

3536 flagSet.Bool("pass-user-headers", true, "pass X-Forwarded-User and X-Forwarded-Email information to upstream")

oauthproxy.go+11

@@ -60,6 +60,7 @@ type OAuthProxy struct {

6060 HtpasswdFile *HtpasswdFile

6161 DisplayHtpasswdForm bool

6262 serveMux http.Handler

63+ SetXAuthRequest bool

6364 PassBasicAuth bool

6465 SkipProviderButton bool

6566 PassUserHeaders bool

@@ -198,6 +199,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

198199 redirectURL: redirectURL,

199200 skipAuthRegex: opts.SkipAuthRegex,

200201 compiledRegex: opts.CompiledRegex,

202+ SetXAuthRequest: opts.SetXAuthRequest,

201203 PassBasicAuth: opts.PassBasicAuth,

202204 PassUserHeaders: opts.PassUserHeaders,

203205 BasicAuthPassword: opts.BasicAuthPassword,

@@ -361,6 +363,9 @@ func (p *OAuthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code

361363 rw.WriteHeader(code)

362364

363365 redirect_url := req.URL.RequestURI()

366+ if req.Header.Get("X-Auth-Request-Redirect") != "" {

367+ redirect_url = req.Header.Get("X-Auth-Request-Redirect")

368+ }

364369 if redirect_url == p.SignInPath {

365370 redirect_url = "/"

366371 }

@@ -663,6 +668,12 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int

663668 req.Header["X-Forwarded-Email"] = []string{session.Email}

664669 }

665670 }

671+ if p.SetXAuthRequest {

672+ rw.Header().Set("X-Auth-Request-User", session.User)

673+ if session.Email != "" {

674+ rw.Header().Set("X-Auth-Request-Email", session.Email)

675+ }

676+ }

666677 if p.PassAccessToken && session.AccessToken != "" {

667678 req.Header["X-Forwarded-Access-Token"] = []string{session.AccessToken}

668679 }

oauthproxy_test.go+30

@@ -611,6 +611,36 @@ func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {

611611 assert.Equal(t, "unauthorized request\n", string(bodyBytes))

612612}

613613

614+func TestAuthOnlyEndpointSetXAuthRequestHeaders(t *testing.T) {

615+ var pc_test ProcessCookieTest

616+

617+ pc_test.opts = NewOptions()

618+ pc_test.opts.SetXAuthRequest = true

619+ pc_test.opts.Validate()

620+

621+ pc_test.proxy = NewOAuthProxy(pc_test.opts, func(email string) bool {

622+ return pc_test.validate_user

623+ })

624+ pc_test.proxy.provider = &TestProvider{

625+ ValidToken: true,

626+ }

627+

628+ pc_test.validate_user = true

629+

630+ pc_test.rw = httptest.NewRecorder()

631+ pc_test.req, _ = http.NewRequest("GET",

632+ pc_test.opts.ProxyPrefix+"/auth", nil)

633+

634+ startSession := &providers.SessionState{

635+ User: "oauth_user", Email: "oauth_user@example.com", AccessToken: "oauth_token"}

636+ pc_test.SaveSession(startSession, time.Now())

637+

638+ pc_test.proxy.ServeHTTP(pc_test.rw, pc_test.req)

639+ assert.Equal(t, http.StatusAccepted, pc_test.rw.Code)

640+ assert.Equal(t, "oauth_user", pc_test.rw.HeaderMap["X-Auth-Request-User"][0])

641+ assert.Equal(t, "oauth_user@example.com", pc_test.rw.HeaderMap["X-Auth-Request-Email"][0])

642+}

643+

614644type SignatureAuthenticator struct {

615645 auth hmacauth.HmacAuth

616646}

options.go+2

@@ -57,6 +57,7 @@ type Options struct {

5757 SkipProviderButton bool `flag:"skip-provider-button" cfg:"skip_provider_button"`

5858 PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers"`

5959 SSLInsecureSkipVerify bool `flag:"ssl-insecure-skip-verify" cfg:"ssl_insecure_skip_verify"`

60+ SetXAuthRequest bool `flag:"set-xauthrequest" cfg:"set_xauthrequest"`

6061

6162 // These options allow for other providers besides Google, with

6263 // potential overrides.

@@ -97,6 +98,7 @@ func NewOptions() *Options {

9798 CookieHttpOnly: true,

9899 CookieExpire: time.Duration(168) * time.Hour,

99100 CookieRefresh: time.Duration(0),

101+ SetXAuthRequest: false,

100102 PassBasicAuth: true,

101103 PassUserHeaders: true,

102104 PassAccessToken: false,