b313e99 · typeable/oauth2-proxy

README.md+3−3

compare with master

unifiedsplit

@@ -55,7 +55,7 @@ For Google, the registration steps are:

551. Create a new project: https://github.com/settings/developers

562. Under `Authorization callback URL` enter the correct url ie `https://internal.yourcompany.com/oauth2/callback`

57

58−The GitHub auth provider supports two additional parameters to restrict authentication to Organization or Team level access.

58+The GitHub auth provider supports two additional parameters to restrict authentication to Organization or Team level access. Restricting by org and team is normally accompanied with `--email-domain=*`

59

60 -github-org="": restrict logins to members of this organisation

61 -github-team="": restrict logins to members of this team

@@ -102,9 +102,9 @@ Usage of oauth2_proxy:

102 -cookie-secure=true: set secure (HTTPS) cookie flag

103 -custom-templates-dir="": path to custom html templates

104 -display-htpasswd-form=true: display username / password login form if an htpasswd file is provided

105+ -email-domain=: authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email

105 -github-org="": restrict logins to members of this organisation

106 -github-org="": restrict logins to members of this organisation

106 -github-team="": restrict logins to members of this team

107 -github-team="": restrict logins to members of this team

107− -google-apps-domain=: authenticate against the given Google apps domain (may be given multiple times)

108 -htpasswd-file="": additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption

109 -http-address="127.0.0.1:4180": [http://]<addr>:<port> or unix://<path> to listen on for HTTP clients

110 -login-url="": Authentication endpoint

@@ -163,7 +163,7 @@ The command line to run `oauth2_proxy` would look like this:

163

164```bash

165./oauth2_proxy \

166− --google-apps-domain="yourcompany.com" \

166+ --email-domain="yourcompany.com" \

167 --upstream=http://127.0.0.1:8080/ \

168 --cookie-secret=... \

169 --cookie-secure=true \

contrib/oauth2_proxy.cfg.example+4−2

@@ -22,8 +22,10 @@

22## when disabled the upstream Host is used as the Host Header

23# pass_host_header = true

24

25−## Email Domains to allow authentication for (this whitelists any email on this domain)

25+## Email Domains to allow authentication for (this authorizes any email on this domain)

26−# google_apps_domains = [

26+## for more granular authorization use `authenticated_emails_file`

27+## To authorize any email addresses use "*"

28+# email_domains = [

27# "yourcompany.com"

29# "yourcompany.com"

28# ]

30# ]

29

31

main.go+8−8

@@ -20,7 +20,7 @@ func main() {

20 log.SetFlags(log.Ldate | log.Ltime | log.Lshortfile)

21 flagSet := flag.NewFlagSet("oauth2_proxy", flag.ExitOnError)

22

23− googleAppsDomains := StringArray{}

23+ emailDomains := StringArray{}

24 upstreams := StringArray{}

25 skipAuthRegex := StringArray{}

26

@@ -35,7 +35,7 @@ func main() {

35 flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")

36 flagSet.Var(&skipAuthRegex, "skip-auth-regex", "bypass authentication for requests path's that match (may be given multiple times)")

37

38− flagSet.Var(&googleAppsDomains, "google-apps-domain", "authenticate against the given Google apps domain (may be given multiple times)")

38+ flagSet.Var(&emailDomains, "email-domain", "authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email")

39 flagSet.String("github-org", "", "restrict logins to members of this organisation")

40 flagSet.String("github-team", "", "restrict logins to members of this team")

41 flagSet.String("client-id", "", "the OAuth Client ID: ie: \"123456.apps.googleusercontent.com\"")

@@ -89,14 +89,14 @@ func main() {

89 os.Exit(1)

90 }

91

92− validator := NewValidator(opts.GoogleAppsDomains, opts.AuthenticatedEmailsFile)

92+ validator := NewValidator(opts.EmailDomains, opts.AuthenticatedEmailsFile)

93 oauthproxy := NewOauthProxy(opts, validator)

94

95− if len(opts.GoogleAppsDomains) != 0 && opts.AuthenticatedEmailsFile == "" {

95+ if len(opts.EmailDomains) != 0 && opts.AuthenticatedEmailsFile == "" {

96− if len(opts.GoogleAppsDomains) > 1 {

96+ if len(opts.EmailDomains) > 1 {

97− oauthproxy.SignInMessage = fmt.Sprintf("Authenticate using one of the following domains: %v", strings.Join(opts.GoogleAppsDomains, ", "))

97+ oauthproxy.SignInMessage = fmt.Sprintf("Authenticate using one of the following domains: %v", strings.Join(opts.EmailDomains, ", "))

98− } else {

98+ } else if opts.EmailDomains[0] != "*" {

99− oauthproxy.SignInMessage = fmt.Sprintf("Authenticate using %v", opts.GoogleAppsDomains[0])

99+ oauthproxy.SignInMessage = fmt.Sprintf("Authenticate using %v", opts.EmailDomains[0])

100 }

101 }

102

oauthproxy.go+1−1

@@ -450,7 +450,7 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {

450 value, err := buildCookieValue(

451 email, p.AesCipher, access_token)

452 if err != nil {

453− log.Printf(err.Error())

453+ log.Printf("%s", err)

454 }

455 p.SetCookie(rw, req, value)

456 http.Redirect(rw, req, redirect, 302)

options.go+1−1

@@ -19,7 +19,7 @@ type Options struct {

19 ClientSecret string `flag:"client-secret" cfg:"client_secret" env:"OAUTH2_PROXY_CLIENT_SECRET"`

20

21 AuthenticatedEmailsFile string `flag:"authenticated-emails-file" cfg:"authenticated_emails_file"`

22− GoogleAppsDomains []string `flag:"google-apps-domain" cfg:"google_apps_domains"`

22+ EmailDomains []string `flag:"email-domain" cfg:"email_domains"`

23 GitHubOrg string `flag:"github-org" cfg:"github_org"`

24 GitHubTeam string `flag:"github-team" cfg:"github_team"`

25 HtpasswdFile string `flag:"htpasswd-file" cfg:"htpasswd_file"`

validator.go+8

@@ -62,7 +62,12 @@ func newValidatorImpl(domains []string, usersFile string,

62 done <-chan bool, onUpdate func()) func(string) bool {

63 validUsers := NewUserMap(usersFile, done, onUpdate)

64

65+ var allowAll bool

65 for i, domain := range domains {

66 for i, domain := range domains {

67+ if domain == "*" {

68+ allowAll = true

69+ continue

70+ }

66 domains[i] = fmt.Sprintf("@%s", strings.ToLower(domain))

71 domains[i] = fmt.Sprintf("@%s", strings.ToLower(domain))

67 }

72 }

68

73

@@ -75,6 +80,9 @@ func newValidatorImpl(domains []string, usersFile string,

75 if !valid {

80 if !valid {

76 valid = validUsers.IsValid(email)

81 valid = validUsers.IsValid(email)

77 }

82 }

83+ if allowAll {

84+ valid = true

85+ }

78 log.Printf("validating: is %s valid? %v", email, valid)

86 log.Printf("validating: is %s valid? %v", email, valid)

79 return valid

87 return valid

80 }

88 }