b1c81e2 · typeable/oauth2-proxy

CHANGELOG.md+1

compare with master

unifiedsplit

@@ -9,6 +9,7 @@

9

10## Changes since v5.0.0

11

12+- [#444](https://github.com/pusher/oauth2_proxy/pull/444) Support prompt in addition to approval-prompt (@holyjak)

12- [#435](https://github.comq/pusher/oauth2_proxy/pull/435) Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)

13- [#435](https://github.comq/pusher/oauth2_proxy/pull/435) Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)

13- [#400](https://github.com/pusher/oauth2_proxy/pull/400) Add `nsswitch.conf` to Docker image to allow hosts file to work (@luketainton)

14- [#400](https://github.com/pusher/oauth2_proxy/pull/400) Add `nsswitch.conf` to Docker image to allow hosts file to work (@luketainton)

14- [#385](https://github.com/pusher/oauth2_proxy/pull/385) Use the `Authorization` header instead of `access_token` for refreshing GitHub Provider sessions (@ibuclaw)

15- [#385](https://github.com/pusher/oauth2_proxy/pull/385) Use the `Authorization` header instead of `access_token` for refreshing GitHub Provider sessions (@ibuclaw)

docs/configuration/configuration.md+1

@@ -80,6 +80,7 @@ An example [oauth2_proxy.cfg]({{ site.gitweb }}/contrib/oauth2_proxy.cfg.example

main.go+1

@@ -132,6 +132,7 @@ func main() {

132 flagSet.String("resource", "", "The resource that is protected (Azure AD only)")

133 flagSet.String("validate-url", "", "Access token validation endpoint")

134 flagSet.String("scope", "", "OAuth scope specification")

135+ flagSet.String("prompt", "", "OIDC prompt")

135 flagSet.String("approval-prompt", "force", "OAuth approval_prompt")

136 flagSet.String("approval-prompt", "force", "OAuth approval_prompt")

136

137

137 flagSet.String("signature-key", "", "GAP-Signature request signature key (algorithm:secretkey)")

138 flagSet.String("signature-key", "", "GAP-Signature request signature key (algorithm:secretkey)")

options.go+4−1

@@ -101,7 +101,8 @@ type Options struct {

101 ProtectedResource string `flag:"resource" cfg:"resource" env:"OAUTH2_PROXY_RESOURCE"`

102 ValidateURL string `flag:"validate-url" cfg:"validate_url" env:"OAUTH2_PROXY_VALIDATE_URL"`

103 Scope string `flag:"scope" cfg:"scope" env:"OAUTH2_PROXY_SCOPE"`

104+ Prompt string `flag:"prompt" cfg:"prompt" env:"OAUTH2_PROXY_PROMPT"`

104− ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt" env:"OAUTH2_PROXY_APPROVAL_PROMPT"`

105+ ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt" env:"OAUTH2_PROXY_APPROVAL_PROMPT"` // Deprecated by OIDC 1.0

105

106

106 // Configuration values for logging

107 // Configuration values for logging

107 LoggingFilename string `flag:"logging-filename" cfg:"logging_filename" env:"OAUTH2_PROXY_LOGGING_FILENAME"`

108 LoggingFilename string `flag:"logging-filename" cfg:"logging_filename" env:"OAUTH2_PROXY_LOGGING_FILENAME"`

@@ -171,6 +172,7 @@ func NewOptions() *Options {

171 SetAuthorization: false,

172 SetAuthorization: false,

172 PassAuthorization: false,

173 PassAuthorization: false,

173 PreferEmailToUser: false,

174 PreferEmailToUser: false,

175+ Prompt: "", // Change to "login" when ApprovalPrompt officially deprecated

174 ApprovalPrompt: "force",

176 ApprovalPrompt: "force",

175 InsecureOIDCAllowUnverifiedEmail: false,

177 InsecureOIDCAllowUnverifiedEmail: false,

176 SkipOIDCDiscovery: false,

178 SkipOIDCDiscovery: false,

@@ -411,6 +413,7 @@ func parseProviderInfo(o *Options, msgs []string) []string {

411 ClientID: o.ClientID,

413 ClientID: o.ClientID,

412 ClientSecret: o.ClientSecret,

414 ClientSecret: o.ClientSecret,

413 ClientSecretFile: o.ClientSecretFile,

415 ClientSecretFile: o.ClientSecretFile,

416+ Prompt: o.Prompt,

414 ApprovalPrompt: o.ApprovalPrompt,

417 ApprovalPrompt: o.ApprovalPrompt,

415 }

418 }

416 p.LoginURL, msgs = parseURL(o.LoginURL, "login", msgs)

419 p.LoginURL, msgs = parseURL(o.LoginURL, "login", msgs)

providers/provider_data.go+1

@@ -20,6 +20,7 @@ type ProviderData struct {

20 ProtectedResource *url.URL

21 ValidateURL *url.URL

22 Scope string

23+ Prompt string

23 ApprovalPrompt string

24 ApprovalPrompt string

24}

25}

25

26

providers/provider_default.go+5−1

@@ -90,7 +90,11 @@ func (p *ProviderData) GetLoginURL(redirectURI, state string) string {

90 a = *p.LoginURL

91 params, _ := url.ParseQuery(a.RawQuery)

92 params.Set("redirect_uri", redirectURI)

93+ if p.Prompt != "" {

94+ params.Set("prompt", p.Prompt)

95+ } else { // Legacy variant of the prompt param:

93− params.Set("approval_prompt", p.ApprovalPrompt)

96+ params.Set("approval_prompt", p.ApprovalPrompt)

97+ }

94 params.Add("scope", p.Scope)

98 params.Add("scope", p.Scope)

95 params.Set("client_id", p.ClientID)

99 params.Set("client_id", p.ClientID)

96 params.Set("response_type", "code")

100 params.Set("response_type", "code")