git.iko.soy/typeable/oauth2-proxy
on master help sign in
Support prompt in addition to auth-prompt (#444)

Fix #380

commitb1c81e2abe816c64ef5b2406649fd9f43c341aff authorJakub Holy <jakub.holy@telia.no> dateSat 14 Mar 2020, 10:53 (7 years ago) parent0fc4131
6 files changed+13−2
compare with master
unifiedsplit
CHANGELOG.md+1 docs/configuration/configuration.md+1 main.go+1 options.go+4−1 providers/provider_data.go+1 providers/provider_default.go+5−1
CHANGELOG.md+1
@@ -9,6 +9,7 @@
99
1010## Changes since v5.0.0
1111
12+- [#444](https://github.com/pusher/oauth2_proxy/pull/444) Support prompt in addition to approval-prompt (@holyjak)
1213- [#435](https://github.comq/pusher/oauth2_proxy/pull/435) Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)
1314- [#400](https://github.com/pusher/oauth2_proxy/pull/400) Add `nsswitch.conf` to Docker image to allow hosts file to work (@luketainton)
1415- [#385](https://github.com/pusher/oauth2_proxy/pull/385) Use the `Authorization` header instead of `access_token` for refreshing GitHub Provider sessions (@ibuclaw)
docs/configuration/configuration.md+1
@@ -80,6 +80,7 @@ An example [oauth2_proxy.cfg]({{ site.gitweb }}/contrib/oauth2_proxy.cfg.example
8080| `-pass-host-header` | bool | pass the request Host Header to upstream | true |
8181| `-pass-user-headers` | bool | pass X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
8282| `-profile-url` | string | Profile access endpoint | |
83+| `-prompt` | string | [OIDC prompt](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest); if present, `approval-prompt` is ignored | `""` |
8384| `-provider` | string | OAuth provider | google |
8485| `-provider-display-name` | string | Override the provider's name with the given string; used for the sign-in page | (depends on provider) |
8586| `-ping-path` | string | the ping endpoint that can be used for basic health checks | `"/ping"` |
main.go+1
@@ -132,6 +132,7 @@ func main() {
132132 flagSet.String("resource", "", "The resource that is protected (Azure AD only)")
133133 flagSet.String("validate-url", "", "Access token validation endpoint")
134134 flagSet.String("scope", "", "OAuth scope specification")
135+ flagSet.String("prompt", "", "OIDC prompt")
135136 flagSet.String("approval-prompt", "force", "OAuth approval_prompt")
136137
137138 flagSet.String("signature-key", "", "GAP-Signature request signature key (algorithm:secretkey)")
options.go+4−1
@@ -101,7 +101,8 @@ type Options struct {
101101 ProtectedResource string `flag:"resource" cfg:"resource" env:"OAUTH2_PROXY_RESOURCE"`
102102 ValidateURL string `flag:"validate-url" cfg:"validate_url" env:"OAUTH2_PROXY_VALIDATE_URL"`
103103 Scope string `flag:"scope" cfg:"scope" env:"OAUTH2_PROXY_SCOPE"`
104− ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt" env:"OAUTH2_PROXY_APPROVAL_PROMPT"`
104+ Prompt string `flag:"prompt" cfg:"prompt" env:"OAUTH2_PROXY_PROMPT"`
105+ ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt" env:"OAUTH2_PROXY_APPROVAL_PROMPT"` // Deprecated by OIDC 1.0
105106
106107 // Configuration values for logging
107108 LoggingFilename string `flag:"logging-filename" cfg:"logging_filename" env:"OAUTH2_PROXY_LOGGING_FILENAME"`
@@ -171,6 +172,7 @@ func NewOptions() *Options {
171172 SetAuthorization: false,
172173 PassAuthorization: false,
173174 PreferEmailToUser: false,
175+ Prompt: "", // Change to "login" when ApprovalPrompt officially deprecated
174176 ApprovalPrompt: "force",
175177 InsecureOIDCAllowUnverifiedEmail: false,
176178 SkipOIDCDiscovery: false,
@@ -411,6 +413,7 @@ func parseProviderInfo(o *Options, msgs []string) []string {
411413 ClientID: o.ClientID,
412414 ClientSecret: o.ClientSecret,
413415 ClientSecretFile: o.ClientSecretFile,
416+ Prompt: o.Prompt,
414417 ApprovalPrompt: o.ApprovalPrompt,
415418 }
416419 p.LoginURL, msgs = parseURL(o.LoginURL, "login", msgs)
providers/provider_data.go+1
@@ -20,6 +20,7 @@ type ProviderData struct {
2020 ProtectedResource *url.URL
2121 ValidateURL *url.URL
2222 Scope string
23+ Prompt string
2324 ApprovalPrompt string
2425}
2526
providers/provider_default.go+5−1
@@ -90,7 +90,11 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {
9090 a = *p.LoginURL
9191 params, _ := url.ParseQuery(a.RawQuery)
9292 params.Set("redirect_uri", redirectURI)
93− params.Set("approval_prompt", p.ApprovalPrompt)
93+ if p.Prompt != "" {
94+ params.Set("prompt", p.Prompt)
95+ } else { // Legacy variant of the prompt param:
96+ params.Set("approval_prompt", p.ApprovalPrompt)
97+ }
9498 params.Add("scope", p.Scope)
9599 params.Set("client_id", p.ClientID)
96100 params.Set("response_type", "code")