bdfca92 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

Handle UPN fallback when profileURL isn't set

bdfca92Nick Meves5 years ago

providers/adfs.go+2−5

compare with master

unifiedsplit

@@ -84,11 +84,8 @@ func (p *ADFSProvider) GetLoginURL(redirectURI, state, nonce string) string {

84// from the claims. If Email is missing, falls back to ADFS `upn` claim.

85func (p *ADFSProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {

86 err := p.oidcEnrichFunc(ctx, s)

87− if err != nil {

87+ if err != nil || s.Email == "" {

88− return err

88+ // OIDC only errors if email is missing

89− }

90−

91− if s.Email == "" {

92 return p.fallbackUPN(ctx, s)

89 return p.fallbackUPN(ctx, s)

93 }

90 }

94 return nil

91 return nil

providers/adfs_test.go+11

@@ -5,6 +5,7 @@ import (

5 "crypto/rand"

6 "crypto/rsa"

7 "encoding/base64"

8+ "errors"

8 "net/http"

9 "net/http"

9 "net/http/httptest"

10 "net/http/httptest"

10 "net/url"

11 "net/url"

@@ -253,6 +254,16 @@ var _ = Describe("ADFS Provider Tests", func() {

253 Expect(err).ToNot(HaveOccurred())

254 Expect(err).ToNot(HaveOccurred())

254 Expect(session.Email).To(Equal("upn@company.com"))

255 Expect(session.Email).To(Equal("upn@company.com"))

255 })

256 })

257+

258+ It("falls back to UPN claim on errors", func() {

259+ p.oidcEnrichFunc = func(_ context.Context, s *sessions.SessionState) error {

260+ return errors.New("neither the id_token nor the profileURL set an email")

261+ }

262+

263+ err := p.EnrichSession(context.Background(), session)

264+ Expect(err).ToNot(HaveOccurred())

265+ Expect(session.Email).To(Equal("upn@company.com"))

266+ })

256 })

267 })

257

268

258 Describe("RefreshSession", func() {

269 Describe("RefreshSession", func() {