c0fb7e8 · typeable/oauth2-proxy

.github/CODEOWNERS+3−4

compare with master

unifiedsplit

@@ -1,10 +1,9 @@

1−# Default owner should be a Pusher cloud-team member or another maintainer

2−# unless overridden by later rules in this file

1+# Default owner should be a core maintainer unless overridden by later rules in this file

3−* @pusher/cloud-team @syscll @steakunderscore @JoelSpeed

2+* @syscll @steakunderscore @JoelSpeed

4

3

5# login.gov provider

4# login.gov provider

6# Note: If @timothy-spencer terms out of his appointment, your best bet

5# Note: If @timothy-spencer terms out of his appointment, your best bet

7−# for finding somebody who can test the oauth2_proxy would be to ask somebody

6+# for finding somebody who can test the oauth2-proxy would be to ask somebody

8# in the login.gov team (https://login.gov/developers/), the cloud.gov team

7# in the login.gov team (https://login.gov/developers/), the cloud.gov team

9# (https://cloud.gov/docs/help/), or the 18F org (https://18f.gsa.gov/contact/

8# (https://cloud.gov/docs/help/), or the 18F org (https://18f.gsa.gov/contact/

10# or the public devops channel at https://chat.18f.gov/).

9# or the public devops channel at https://chat.18f.gov/).

.gitignore+1−1

@@ -1,4 +1,4 @@

1−oauth2_proxy

1+oauth2-proxy

2vendor

3dist

4release

CHANGELOG.md+116−105

@@ -6,8 +6,19 @@

6

7## Breaking Changes

8

9+- Migration from Pusher to independent org may have introduced breaking changes for your environment.

10+ - See the changes listed below for PR [#464](https://github.com/oauth2-proxy/oauth2-proxy/pull/464) for full details

11+ - Binaries renamed from `oauth2_proxy` to `oauth2-proxy`

12+

9## Changes since v5.1.0

13## Changes since v5.1.0

10

14

15+- [#464](https://github.com/oauth2-proxy/oauth2-proxy/pull/464) Migrate to oauth2-proxy/oauth2-proxy (@JoelSpeed)

16+ - Project renamed from `pusher/oauth2_proxy` to `oauth2-proxy`

17+ - Move Go import path from `github.com/pusher/oauth2_proxy` to `github.com/oauth2-proxy/oauth2-proxy`

18+ - Remove Pusher Cloud Team from CODEOWNERS

19+ - Release images moved to `quay.io/oauth2-proxy/oauth2-proxy`

20+ - Binaries renamed from `oauth2_proxy` to `oauth2-proxy`

21+

11# v5.1.0

22# v5.1.0

12

23

13## Release Hightlights

24## Release Hightlights

@@ -24,21 +35,21 @@ N/A

24

35

25## Changes since v5.0.0

36## Changes since v5.0.0

26

37

27−- [#450](https://github.com/pusher/oauth2_proxy/pull/450) Fix http.Cookie SameSite is not copied (@johejo)

38+- [#450](https://github.com/oauth2-proxy/oauth2-proxy/pull/450) Fix http.Cookie SameSite is not copied (@johejo)

28−- [#445](https://github.com/pusher/oauth2_proxy/pull/445) Expose `acr_values` to all providers (@holyjak)

39+- [#445](https://github.com/oauth2-proxy/oauth2-proxy/pull/445) Expose `acr_values` to all providers (@holyjak)

29−- [#419](https://github.com/pusher/oauth2_proxy/pull/419) Support Go 1.14, upgrade dependencies, upgrade golangci-lint to 1.23.6 (@johejo)

40+- [#419](https://github.com/oauth2-proxy/oauth2-proxy/pull/419) Support Go 1.14, upgrade dependencies, upgrade golangci-lint to 1.23.6 (@johejo)

30−- [#444](https://github.com/pusher/oauth2_proxy/pull/444) Support prompt in addition to approval-prompt (@holyjak)

41+- [#444](https://github.com/oauth2-proxy/oauth2-proxy/pull/444) Support prompt in addition to approval-prompt (@holyjak)

31−- [#435](https://github.com/pusher/oauth2_proxy/pull/435) Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)

42+- [#435](https://github.com/oauth2-proxy/oauth2-proxy/pull/435) Fix issue with group validation calling google directory API on every HTTP request (@ericofusco)

32−- [#400](https://github.com/pusher/oauth2_proxy/pull/400) Add `nsswitch.conf` to Docker image to allow hosts file to work (@luketainton)

43+- [#400](https://github.com/oauth2-proxy/oauth2-proxy/pull/400) Add `nsswitch.conf` to Docker image to allow hosts file to work (@luketainton)

33−- [#385](https://github.com/pusher/oauth2_proxy/pull/385) Use the `Authorization` header instead of `access_token` for refreshing GitHub Provider sessions (@ibuclaw)

44+- [#385](https://github.com/oauth2-proxy/oauth2-proxy/pull/385) Use the `Authorization` header instead of `access_token` for refreshing GitHub Provider sessions (@ibuclaw)

34−- [#372](https://github.com/pusher/oauth2_proxy/pull/372) Allow fallback to secondary verified email address in GitHub provider (@dmnemec)

45+- [#372](https://github.com/oauth2-proxy/oauth2-proxy/pull/372) Allow fallback to secondary verified email address in GitHub provider (@dmnemec)

35−- [#335](https://github.com/pusher/oauth2_proxy/pull/335) OIDC Provider support for empty id_tokens in the access token refresh response (@howzat)

46+- [#335](https://github.com/oauth2-proxy/oauth2-proxy/pull/335) OIDC Provider support for empty id_tokens in the access token refresh response (@howzat)

36−- [#363](https://github.com/pusher/oauth2_proxy/pull/363) Extension of Redis Session Store to Support Redis Cluster (@yan-dblinf)

47+- [#363](https://github.com/oauth2-proxy/oauth2-proxy/pull/363) Extension of Redis Session Store to Support Redis Cluster (@yan-dblinf)

37−- [#353](https://github.com/pusher/oauth2_proxy/pull/353) Fix login page fragment handling after soft reload on Firefox (@ffdybuster)

48+- [#353](https://github.com/oauth2-proxy/oauth2-proxy/pull/353) Fix login page fragment handling after soft reload on Firefox (@ffdybuster)

38−- [#355](https://github.com/pusher/oauth2_proxy/pull/355) Add Client Secret File support for providers that rotate client secret via file system (@pasha-r)

49+- [#355](https://github.com/oauth2-proxy/oauth2-proxy/pull/355) Add Client Secret File support for providers that rotate client secret via file system (@pasha-r)

39−- [#401](https://github.com/pusher/oauth2_proxy/pull/401) Give the option to pass email address in the Basic auth header instead of upstream usernames. (@Spindel)

50+- [#401](https://github.com/oauth2-proxy/oauth2-proxy/pull/401) Give the option to pass email address in the Basic auth header instead of upstream usernames. (@Spindel)

40−- [#405](https://github.com/pusher/oauth2_proxy/pull/405) The `/sign_in` page now honors the `rd` query parameter, fixing the redirect after a successful authentication (@ti-mo)

51+- [#405](https://github.com/oauth2-proxy/oauth2-proxy/pull/405) The `/sign_in` page now honors the `rd` query parameter, fixing the redirect after a successful authentication (@ti-mo)

41−- [#434](https://github.com/pusher/oauth2_proxy/pull/434) Give the option to prefer email address in the username header when using the -pass-user-headers option (@jordancrawfordnz)

52+- [#434](https://github.com/oauth2-proxy/oauth2-proxy/pull/434) Give the option to prefer email address in the username header when using the -pass-user-headers option (@jordancrawfordnz)

42

53

43# v5.0.0

54# v5.0.0

44

55

@@ -49,23 +60,23 @@ N/A

49- DigitalOcean provider support added

60- DigitalOcean provider support added

50

61

51## Important Notes

62## Important Notes

52−- (Security) Fix for [open redirect vulnerability](https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv).. a bad actor using `/\` in redirect URIs can redirect a session to another domain

63+- (Security) Fix for [open redirect vulnerability](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-qqxw-m5fj-f7gv).. a bad actor using `/\` in redirect URIs can redirect a session to another domain

53

64

54## Breaking Changes

65## Breaking Changes

55

66

56−- [#321](https://github.com/pusher/oauth2_proxy/pull/331) Add reverse proxy boolean flag to control whether headers like `X-Real-Ip` are accepted.

67+- [#321](https://github.com/oauth2-proxy/oauth2-proxy/pull/331) Add reverse proxy boolean flag to control whether headers like `X-Real-Ip` are accepted.

57 This defaults to false. **Usage behind a reverse proxy will require this flag to be set to avoid logging the reverse proxy IP address**.

68 This defaults to false. **Usage behind a reverse proxy will require this flag to be set to avoid logging the reverse proxy IP address**.

58

69

59## Changes since v4.1.0

70## Changes since v4.1.0

60

71

61−- [#331](https://github.com/pusher/oauth2_proxy/pull/331) Add reverse proxy setting (@martin-css)

72+- [#331](https://github.com/oauth2-proxy/oauth2-proxy/pull/331) Add reverse proxy setting (@martin-css)

62−- [#365](https://github.com/pusher/oauth2_proxy/pull/365) Build with CGO=0 (@tomelliff)

73+- [#365](https://github.com/oauth2-proxy/oauth2-proxy/pull/365) Build with CGO=0 (@tomelliff)

63−- [#339](https://github.com/pusher/oauth2_proxy/pull/339) Add configuration for cookie 'SameSite' value. (@pgroudas)

74+- [#339](https://github.com/oauth2-proxy/oauth2-proxy/pull/339) Add configuration for cookie 'SameSite' value. (@pgroudas)

64−- [#347](https://github.com/pusher/oauth2_proxy/pull/347) Update keycloak provider configuration documentation. (@sushiMix)

75+- [#347](https://github.com/oauth2-proxy/oauth2-proxy/pull/347) Update keycloak provider configuration documentation. (@sushiMix)

65−- [#325](https://github.com/pusher/oauth2_proxy/pull/325) dist.sh: use sha256sum (@syscll)

76+- [#325](https://github.com/oauth2-proxy/oauth2-proxy/pull/325) dist.sh: use sha256sum (@syscll)

66−- [#179](https://github.com/pusher/oauth2_proxy/pull/179) Add Nextcloud provider (@Ramblurr)

77+- [#179](https://github.com/oauth2-proxy/oauth2-proxy/pull/179) Add Nextcloud provider (@Ramblurr)

67−- [#280](https://github.com/pusher/oauth2_proxy/pull/280) whitelisted redirect domains: add support for whitelisting specific ports or allowing wildcard ports (@kamaln7)

78+- [#280](https://github.com/oauth2-proxy/oauth2-proxy/pull/280) whitelisted redirect domains: add support for whitelisting specific ports or allowing wildcard ports (@kamaln7)

68−- [#351](https://github.com/pusher/oauth2_proxy/pull/351) Add DigitalOcean Auth provider (@kamaln7)

79+- [#351](https://github.com/oauth2-proxy/oauth2-proxy/pull/351) Add DigitalOcean Auth provider (@kamaln7)

69

80

70# v4.1.0

81# v4.1.0

71

82

@@ -84,29 +95,29 @@ N/A

84N/A

95N/A

85

96

86## Changes since v4.0.0

97## Changes since v4.0.0

87−- [#292](https://github.com/pusher/oauth2_proxy/pull/292) Added bash >= 4.0 dependency to configure script (@jmfrank63)

98+- [#292](https://github.com/oauth2-proxy/oauth2-proxy/pull/292) Added bash >= 4.0 dependency to configure script (@jmfrank63)

88−- [#227](https://github.com/pusher/oauth2_proxy/pull/227) Add Keycloak provider (@Ofinka)

99+- [#227](https://github.com/oauth2-proxy/oauth2-proxy/pull/227) Add Keycloak provider (@Ofinka)

89−- [#259](https://github.com/pusher/oauth2_proxy/pull/259) Redirect to HTTPS (@jmickey)

100+- [#259](https://github.com/oauth2-proxy/oauth2-proxy/pull/259) Redirect to HTTPS (@jmickey)

90−- [#273](https://github.com/pusher/oauth2_proxy/pull/273) Support Go 1.13 (@dio)

101+- [#273](https://github.com/oauth2-proxy/oauth2-proxy/pull/273) Support Go 1.13 (@dio)

91−- [#275](https://github.com/pusher/oauth2_proxy/pull/275) docker: build from debian buster (@syscll)

102+- [#275](https://github.com/oauth2-proxy/oauth2-proxy/pull/275) docker: build from debian buster (@syscll)

92−- [#258](https://github.com/pusher/oauth2_proxy/pull/258) Add IDToken for Azure provider (@leyshon)

103+- [#258](https://github.com/oauth2-proxy/oauth2-proxy/pull/258) Add IDToken for Azure provider (@leyshon)

93− - This PR adds the IDToken into the session for the Azure provider allowing requests to a backend to be identified as a specific user. As a consequence, if you are using a cookie to store the session the cookie will now exceed the 4kb size limit and be split into multiple cookies. This can cause problems when using nginx as a proxy, resulting in no cookie being passed at all. Either increase the proxy_buffer_size in nginx or implement the redis session storage (see https://pusher.github.io/oauth2_proxy/configuration#redis-storage)

104+ - This PR adds the IDToken into the session for the Azure provider allowing requests to a backend to be identified as a specific user. As a consequence, if you are using a cookie to store the session the cookie will now exceed the 4kb size limit and be split into multiple cookies. This can cause problems when using nginx as a proxy, resulting in no cookie being passed at all. Either increase the proxy_buffer_size in nginx or implement the redis session storage (see https://oauth2-proxy.github.io/oauth2-proxy/configuration#redis-storage)

94−- [#286](https://github.com/pusher/oauth2_proxy/pull/286) Requests.go updated with useful error messages (@biotom)

105+- [#286](https://github.com/oauth2-proxy/oauth2-proxy/pull/286) Requests.go updated with useful error messages (@biotom)

95−- [#274](https://github.com/pusher/oauth2_proxy/pull/274) Supports many github teams with api pagination support (@toshi-miura, @apratina)

106+- [#274](https://github.com/oauth2-proxy/oauth2-proxy/pull/274) Supports many github teams with api pagination support (@toshi-miura, @apratina)

96−- [#302](https://github.com/pusher/oauth2_proxy/pull/302) Rewrite dist script (@syscll)

107+- [#302](https://github.com/oauth2-proxy/oauth2-proxy/pull/302) Rewrite dist script (@syscll)

97−- [#304](https://github.com/pusher/oauth2_proxy/pull/304) Add new Logo! :tada: (@JoelSpeed)

108+- [#304](https://github.com/oauth2-proxy/oauth2-proxy/pull/304) Add new Logo! :tada: (@JoelSpeed)

98−- [#300](https://github.com/pusher/oauth2_proxy/pull/300) Added userinfo endpoint (@kbabuadze)

109+- [#300](https://github.com/oauth2-proxy/oauth2-proxy/pull/300) Added userinfo endpoint (@kbabuadze)

99−- [#309](https://github.com/pusher/oauth2_proxy/pull/309) Added support for custom CA when connecting to Redis cache (@lleszczu)

110+- [#309](https://github.com/oauth2-proxy/oauth2-proxy/pull/309) Added support for custom CA when connecting to Redis cache (@lleszczu)

100−- [#248](https://github.com/pusher/oauth2_proxy/pull/248) Fix issue with X-Auth-Request-Redirect header being ignored (@webnard)

111+- [#248](https://github.com/oauth2-proxy/oauth2-proxy/pull/248) Fix issue with X-Auth-Request-Redirect header being ignored (@webnard)

101−- [#314](https://github.com/pusher/oauth2_proxy/pull/314) Add redirect capability to sign_out (@costelmoraru)

112+- [#314](https://github.com/oauth2-proxy/oauth2-proxy/pull/314) Add redirect capability to sign_out (@costelmoraru)

102−- [#265](https://github.com/pusher/oauth2_proxy/pull/265) Add upstream with static response (@cgroschupp)

113+- [#265](https://github.com/oauth2-proxy/oauth2-proxy/pull/265) Add upstream with static response (@cgroschupp)

103−- [#317](https://github.com/pusher/oauth2_proxy/pull/317) Add build for FreeBSD (@fnkr)

114+- [#317](https://github.com/oauth2-proxy/oauth2-proxy/pull/317) Add build for FreeBSD (@fnkr)

104−- [#296](https://github.com/pusher/oauth2_proxy/pull/296) Allow to override provider's name for sign-in page (@ffdybuster)

115+- [#296](https://github.com/oauth2-proxy/oauth2-proxy/pull/296) Allow to override provider's name for sign-in page (@ffdybuster)

105

116

106# v4.0.0

117# v4.0.0

107

118

108## Release Highlights

119## Release Highlights

109−- Documentation is now on a [microsite](https://pusher.github.io/oauth2_proxy/)

120+- Documentation is now on a [microsite](https://oauth2-proxy.github.io/oauth2-proxy/)

110- Health check logging can now be disabled for quieter logs

121- Health check logging can now be disabled for quieter logs

111- Authorization Header JWTs can now be verified by the proxy to skip authentication for machine users

122- Authorization Header JWTs can now be verified by the proxy to skip authentication for machine users

112- Sessions can now be stored in Redis. This reduces refresh failures and uses smaller cookies (Recommended for those using OIDC refreshing)

123- Sessions can now be stored in Redis. This reduces refresh failures and uses smaller cookies (Recommended for those using OIDC refreshing)

@@ -118,11 +129,11 @@ reconfigure their proxies. Please read the Breaking Changes below thoroughly.

118

129

119## Breaking Changes

130## Breaking Changes

120

131

121−- [#231](https://github.com/pusher/oauth2_proxy/pull/231) Rework GitLab provider

132+- [#231](https://github.com/oauth2-proxy/oauth2-proxy/pull/231) Rework GitLab provider

122 - This PR changes the configuration options for the GitLab provider to use

133 - This PR changes the configuration options for the GitLab provider to use

123 a self-hosted instance. You now need to specify a `-oidc-issuer-url` rather than

134 a self-hosted instance. You now need to specify a `-oidc-issuer-url` rather than

124 explicit `-login-url`, `-redeem-url` and `-validate-url` parameters.

135 explicit `-login-url`, `-redeem-url` and `-validate-url` parameters.

125−- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent

136+- [#186](https://github.com/oauth2-proxy/oauth2-proxy/pull/186) Make config consistent

126 - This PR changes configuration options so that all flags have a config counterpart

137 - This PR changes configuration options so that all flags have a config counterpart

127 of the same name but with underscores (`_`) in place of hyphens (`-`).

138 of the same name but with underscores (`_`) in place of hyphens (`-`).

128 This change affects the following flags:

139 This change affects the following flags:

@@ -138,34 +149,34 @@ reconfigure their proxies. Please read the Breaking Changes below thoroughly.

138 This change affects the following existing environment variables:

149 This change affects the following existing environment variables:

139 - The `OAUTH2_SKIP_OIDC_DISCOVERY` environment variable is now `OAUTH2_PROXY_SKIP_OIDC_DISCOVERY`.

150 - The `OAUTH2_SKIP_OIDC_DISCOVERY` environment variable is now `OAUTH2_PROXY_SKIP_OIDC_DISCOVERY`.

140 - The `OAUTH2_OIDC_JWKS_URL` environment variable is now `OAUTH2_PROXY_OIDC_JWKS_URL`.

151 - The `OAUTH2_OIDC_JWKS_URL` environment variable is now `OAUTH2_PROXY_OIDC_JWKS_URL`.

141−- [#146](https://github.com/pusher/oauth2_proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field

152+- [#146](https://github.com/oauth2-proxy/oauth2-proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field

142 - This change modifies the contents of the `X-Forwarded-User` header supplied by the proxy for users where the auth response from the IdP did not contain

153 - This change modifies the contents of the `X-Forwarded-User` header supplied by the proxy for users where the auth response from the IdP did not contain

143 a username.

154 a username.

144 In that case, this header used to only contain the local part of the user's email address (e.g. `john.doe` for `john.doe@example.com`) but now contains

155 In that case, this header used to only contain the local part of the user's email address (e.g. `john.doe` for `john.doe@example.com`) but now contains

145 the user's full email address instead.

156 the user's full email address instead.

146−- [#170](https://github.com/pusher/oauth2_proxy/pull/170) Pre-built binary tarballs changed format

157+- [#170](https://github.com/oauth2-proxy/oauth2-proxy/pull/170) Pre-built binary tarballs changed format

147 - The pre-built binary tarballs again match the format of the [bitly](https://github.com/bitly/oauth2_proxy) repository, where the unpacked directory

158 - The pre-built binary tarballs again match the format of the [bitly](https://github.com/bitly/oauth2_proxy) repository, where the unpacked directory

148 has the same name as the tarball and the binary is always named `oauth2_proxy`. This was done to restore compatibility with third-party automation

159 has the same name as the tarball and the binary is always named `oauth2_proxy`. This was done to restore compatibility with third-party automation

149 recipes like https://github.com/jhoblitt/puppet-oauth2_proxy.

160 recipes like https://github.com/jhoblitt/puppet-oauth2_proxy.

150

161

151## Changes since v3.2.0

162## Changes since v3.2.0

152

163

153−- [#234](https://github.com/pusher/oauth2_proxy/pull/234) Added option `-ssl-upstream-insecure-skip-validation` to skip validation of upstream SSL certificates (@jansinger)

164+- [#234](https://github.com/oauth2-proxy/oauth2-proxy/pull/234) Added option `-ssl-upstream-insecure-skip-validation` to skip validation of upstream SSL certificates (@jansinger)

154−- [#224](https://github.com/pusher/oauth2_proxy/pull/224) Check Google group membership using hasMember to support nested groups and external users (@jpalpant)

165+- [#224](https://github.com/oauth2-proxy/oauth2-proxy/pull/224) Check Google group membership using hasMember to support nested groups and external users (@jpalpant)

155−- [#231](https://github.com/pusher/oauth2_proxy/pull/231) Add optional group membership and email domain checks to the GitLab provider (@Overv)

166+- [#231](https://github.com/oauth2-proxy/oauth2-proxy/pull/231) Add optional group membership and email domain checks to the GitLab provider (@Overv)

156−- [#226](https://github.com/pusher/oauth2_proxy/pull/226) Made setting of proxied headers deterministic based on configuration alone (@aeijdenberg)

167+- [#226](https://github.com/oauth2-proxy/oauth2-proxy/pull/226) Made setting of proxied headers deterministic based on configuration alone (@aeijdenberg)

157−- [#178](https://github.com/pusher/oauth2_proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)

168+- [#178](https://github.com/oauth2-proxy/oauth2-proxy/pull/178) Add Silence Ping Logging and Exclude Logging Paths flags (@kskewes)

158−- [#209](https://github.com/pusher/oauth2_proxy/pull/209) Improve docker build caching of layers (@dekimsey)

169+- [#209](https://github.com/oauth2-proxy/oauth2-proxy/pull/209) Improve docker build caching of layers (@dekimsey)

159−- [#186](https://github.com/pusher/oauth2_proxy/pull/186) Make config consistent (@JoelSpeed)

170+- [#186](https://github.com/oauth2-proxy/oauth2-proxy/pull/186) Make config consistent (@JoelSpeed)

160−- [#187](https://github.com/pusher/oauth2_proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)

171+- [#187](https://github.com/oauth2-proxy/oauth2-proxy/pull/187) Move root packages to pkg folder (@JoelSpeed)

161−- [#65](https://github.com/pusher/oauth2_proxy/pull/65) Improvements to authenticate requests with a JWT bearer token in the `Authorization` header via

172+- [#65](https://github.com/oauth2-proxy/oauth2-proxy/pull/65) Improvements to authenticate requests with a JWT bearer token in the `Authorization` header via

162 the `-skip-jwt-bearer-token` options. (@brianv0)

173 the `-skip-jwt-bearer-token` options. (@brianv0)

163 - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL

174 - Additional verifiers can be configured via the `-extra-jwt-issuers` flag if the JWT issuers is either an OpenID provider or has a JWKS URL

164 (e.g. `https://example.com/.well-known/jwks.json`).

175 (e.g. `https://example.com/.well-known/jwks.json`).

165−- [#180](https://github.com/pusher/oauth2_proxy/pull/180) Minor refactor of core proxying path (@aeijdenberg).

176+- [#180](https://github.com/oauth2-proxy/oauth2-proxy/pull/180) Minor refactor of core proxying path (@aeijdenberg).

166−- [#175](https://github.com/pusher/oauth2_proxy/pull/175) Bump go-oidc to v2.0.0 (@aeijdenberg).

177+- [#175](https://github.com/oauth2-proxy/oauth2-proxy/pull/175) Bump go-oidc to v2.0.0 (@aeijdenberg).

167 - Includes fix for potential signature checking issue when OIDC discovery is skipped.

178 - Includes fix for potential signature checking issue when OIDC discovery is skipped.

168−- [#155](https://github.com/pusher/oauth2_proxy/pull/155) Add RedisSessionStore implementation (@brianv0, @JoelSpeed)

179+- [#155](https://github.com/oauth2-proxy/oauth2-proxy/pull/155) Add RedisSessionStore implementation (@brianv0, @JoelSpeed)

169 - Implement flags to configure the redis session store

180 - Implement flags to configure the redis session store

170 - `-session-store-type=redis` Sets the store type to redis

181 - `-session-store-type=redis` Sets the store type to redis

171 - `-redis-connection-url` Sets the Redis connection URL

182 - `-redis-connection-url` Sets the Redis connection URL

@@ -175,18 +186,18 @@ reconfigure their proxies. Please read the Breaking Changes below thoroughly.

175 - Introduces the concept of a session ticket. Tickets are composed of the cookie name, a session ID, and a secret.

186 - Introduces the concept of a session ticket. Tickets are composed of the cookie name, a session ID, and a secret.

176 - Redis Sessions are stored encrypted with a per-session secret

187 - Redis Sessions are stored encrypted with a per-session secret

177 - Added tests for server based session stores

188 - Added tests for server based session stores

178−- [#168](https://github.com/pusher/oauth2_proxy/pull/168) Drop Go 1.11 support in Travis (@JoelSpeed)

189+- [#168](https://github.com/oauth2-proxy/oauth2-proxy/pull/168) Drop Go 1.11 support in Travis (@JoelSpeed)

179−- [#169](https://github.com/pusher/oauth2_proxy/pull/169) Update Alpine to 3.9 (@kskewes)

190+- [#169](https://github.com/oauth2-proxy/oauth2-proxy/pull/169) Update Alpine to 3.9 (@kskewes)

180−- [#148](https://github.com/pusher/oauth2_proxy/pull/148) Implement SessionStore interface within proxy (@JoelSpeed)

191+- [#148](https://github.com/oauth2-proxy/oauth2-proxy/pull/148) Implement SessionStore interface within proxy (@JoelSpeed)

181−- [#147](https://github.com/pusher/oauth2_proxy/pull/147) Add SessionStore interfaces and initial implementation (@JoelSpeed)

192+- [#147](https://github.com/oauth2-proxy/oauth2-proxy/pull/147) Add SessionStore interfaces and initial implementation (@JoelSpeed)

182 - Allows for multiple different session storage implementations including client and server side

193 - Allows for multiple different session storage implementations including client and server side

183 - Adds tests suite for interface to ensure consistency across implementations

194 - Adds tests suite for interface to ensure consistency across implementations

184 - Refactor some configuration options (around cookies) into packages

195 - Refactor some configuration options (around cookies) into packages

185−- [#114](https://github.com/pusher/oauth2_proxy/pull/114), [#154](https://github.com/pusher/oauth2_proxy/pull/154) Documentation is now available live at our [docs website](https://pusher.github.io/oauth2_proxy/) (@JoelSpeed, @icelynjennings)

196+- [#114](https://github.com/oauth2-proxy/oauth2-proxy/pull/114), [#154](https://github.com/oauth2-proxy/oauth2-proxy/pull/154) Documentation is now available live at our [docs website](https://oauth2-proxy.github.io/oauth2-proxy/) (@JoelSpeed, @icelynjennings)

186−- [#146](https://github.com/pusher/oauth2_proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field (@gargath)

197+- [#146](https://github.com/oauth2-proxy/oauth2-proxy/pull/146) Use full email address as `User` if the auth response did not contain a `User` field (@gargath)

187−- [#144](https://github.com/pusher/oauth2_proxy/pull/144) Use GO 1.12 for ARM builds (@kskewes)

198+- [#144](https://github.com/oauth2-proxy/oauth2-proxy/pull/144) Use GO 1.12 for ARM builds (@kskewes)

188−- [#142](https://github.com/pusher/oauth2_proxy/pull/142) ARM Docker USER fix (@kskewes)

199+- [#142](https://github.com/oauth2-proxy/oauth2-proxy/pull/142) ARM Docker USER fix (@kskewes)

189−- [#52](https://github.com/pusher/oauth2_proxy/pull/52) Logging Improvements (@MisterWil)

200+- [#52](https://github.com/oauth2-proxy/oauth2-proxy/pull/52) Logging Improvements (@MisterWil)

190 - Implement flags to configure file logging

201 - Implement flags to configure file logging

191 - `-logging-filename` Defines the filename to log to

202 - `-logging-filename` Defines the filename to log to

192 - `-logging-max-size` Defines the maximum

203 - `-logging-max-size` Defines the maximum

@@ -200,21 +211,21 @@ reconfigure their proxies. Please read the Breaking Changes below thoroughly.

200 - Implement two new flags to customize the logging format

211 - Implement two new flags to customize the logging format

201 - `-standard-logging-format` Sets the format for standard logging

212 - `-standard-logging-format` Sets the format for standard logging

202 - `-auth-logging-format` Sets the format for auth logging

213 - `-auth-logging-format` Sets the format for auth logging

203−- [#111](https://github.com/pusher/oauth2_proxy/pull/111) Add option for telling where to find a login.gov JWT key file (@timothy-spencer)

214+- [#111](https://github.com/oauth2-proxy/oauth2-proxy/pull/111) Add option for telling where to find a login.gov JWT key file (@timothy-spencer)

204−- [#170](https://github.com/pusher/oauth2_proxy/pull/170) Restore binary tarball contents to be compatible with bitlys original tarballs (@zeha)

215+- [#170](https://github.com/oauth2-proxy/oauth2-proxy/pull/170) Restore binary tarball contents to be compatible with bitlys original tarballs (@zeha)

205−- [#185](https://github.com/pusher/oauth2_proxy/pull/185) Fix an unsupported protocol scheme error during token validation when using the Azure provider (@jonas)

216+- [#185](https://github.com/oauth2-proxy/oauth2-proxy/pull/185) Fix an unsupported protocol scheme error during token validation when using the Azure provider (@jonas)

206−- [#141](https://github.com/pusher/oauth2_proxy/pull/141) Check google group membership based on email address (@bchess)

217+- [#141](https://github.com/oauth2-proxy/oauth2-proxy/pull/141) Check google group membership based on email address (@bchess)

207 - Google Group membership is additionally checked via email address, allowing users outside a GSuite domain to be authorized.

218 - Google Group membership is additionally checked via email address, allowing users outside a GSuite domain to be authorized.

208−- [#195](https://github.com/pusher/oauth2_proxy/pull/195) Add `-banner` flag for overriding the banner line that is displayed (@steakunderscore)

219+- [#195](https://github.com/oauth2-proxy/oauth2-proxy/pull/195) Add `-banner` flag for overriding the banner line that is displayed (@steakunderscore)

209−- [#198](https://github.com/pusher/oauth2_proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)

220+- [#198](https://github.com/oauth2-proxy/oauth2-proxy/pull/198) Switch from gometalinter to golangci-lint (@steakunderscore)

210−- [#159](https://github.com/pusher/oauth2_proxy/pull/159) Add option to skip the OIDC provider verified email check: `--insecure-oidc-allow-unverified-email` (@djfinlay)

221+- [#159](https://github.com/oauth2-proxy/oauth2-proxy/pull/159) Add option to skip the OIDC provider verified email check: `--insecure-oidc-allow-unverified-email` (@djfinlay)

211−- [#210](https://github.com/pusher/oauth2_proxy/pull/210) Update base image from Alpine 3.9 to 3.10 (@steakunderscore)

222+- [#210](https://github.com/oauth2-proxy/oauth2-proxy/pull/210) Update base image from Alpine 3.9 to 3.10 (@steakunderscore)

212−- [#201](https://github.com/pusher/oauth2_proxy/pull/201) Add Bitbucket as new OAuth2 provider, accepts email, team and repository permissions to determine authorization (@aledeganopix4d)

223+- [#201](https://github.com/oauth2-proxy/oauth2-proxy/pull/201) Add Bitbucket as new OAuth2 provider, accepts email, team and repository permissions to determine authorization (@aledeganopix4d)

213 - Implement flags to enable Bitbucket authentication:

224 - Implement flags to enable Bitbucket authentication:

214 - `-bitbucket-repository` Restrict authorization to users that can access this repository

225 - `-bitbucket-repository` Restrict authorization to users that can access this repository

215 - `-bitbucket-team` Restrict authorization to users that are part of this Bitbucket team

226 - `-bitbucket-team` Restrict authorization to users that are part of this Bitbucket team

216−- [#211](https://github.com/pusher/oauth2_proxy/pull/211) Switch from dep to go modules (@steakunderscore)

227+- [#211](https://github.com/oauth2-proxy/oauth2-proxy/pull/211) Switch from dep to go modules (@steakunderscore)

217−- [#145](https://github.com/pusher/oauth2_proxy/pull/145) Add support for OIDC UserInfo endpoint email verification (@rtluckie)

228+- [#145](https://github.com/oauth2-proxy/oauth2-proxy/pull/145) Add support for OIDC UserInfo endpoint email verification (@rtluckie)

218

229

219# v3.2.0

230# v3.2.0

220

231

@@ -234,25 +245,25 @@ instead of returning an error

234## Changes since v3.1.0

245## Changes since v3.1.0

235

246

236- [#96](https://github.com/bitly/oauth2_proxy/pull/96) Check if email is verified on GitHub (@caarlos0)

247- [#96](https://github.com/bitly/oauth2_proxy/pull/96) Check if email is verified on GitHub (@caarlos0)

237−- [#110](https://github.com/pusher/oauth2_proxy/pull/110) Added GCP healthcheck option (@timothy-spencer)

248+- [#110](https://github.com/oauth2-proxy/oauth2-proxy/pull/110) Added GCP healthcheck option (@timothy-spencer)

238−- [#112](https://github.com/pusher/oauth2_proxy/pull/112) Improve websocket support (@gyson)

249+- [#112](https://github.com/oauth2-proxy/oauth2-proxy/pull/112) Improve websocket support (@gyson)

239−- [#63](https://github.com/pusher/oauth2_proxy/pull/63) Use encoding/json for SessionState serialization (@yaegashi)

250+- [#63](https://github.com/oauth2-proxy/oauth2-proxy/pull/63) Use encoding/json for SessionState serialization (@yaegashi)

240 - Use JSON to encode session state to be stored in browser cookies

251 - Use JSON to encode session state to be stored in browser cookies

241 - Implement legacy decode function to support existing cookies generated by older versions

252 - Implement legacy decode function to support existing cookies generated by older versions

242 - Add detailed table driven tests in session_state_test.go

253 - Add detailed table driven tests in session_state_test.go

243−- [#120](https://github.com/pusher/oauth2_proxy/pull/120) Encrypting user/email from cookie (@costelmoraru)

254+- [#120](https://github.com/oauth2-proxy/oauth2-proxy/pull/120) Encrypting user/email from cookie (@costelmoraru)

244−- [#55](https://github.com/pusher/oauth2_proxy/pull/55) Added login.gov provider (@timothy-spencer)

255+- [#55](https://github.com/oauth2-proxy/oauth2-proxy/pull/55) Added login.gov provider (@timothy-spencer)

245−- [#55](https://github.com/pusher/oauth2_proxy/pull/55) Added environment variables for all config options (@timothy-spencer)

256+- [#55](https://github.com/oauth2-proxy/oauth2-proxy/pull/55) Added environment variables for all config options (@timothy-spencer)

246−- [#70](https://github.com/pusher/oauth2_proxy/pull/70) Fix handling of splitted cookies (@einfachchr)

257+- [#70](https://github.com/oauth2-proxy/oauth2-proxy/pull/70) Fix handling of splitted cookies (@einfachchr)

247−- [#92](https://github.com/pusher/oauth2_proxy/pull/92) Merge websocket proxy feature from openshift/oauth-proxy (@butzist)

258+- [#92](https://github.com/oauth2-proxy/oauth2-proxy/pull/92) Merge websocket proxy feature from openshift/oauth-proxy (@butzist)

248−- [#57](https://github.com/pusher/oauth2_proxy/pull/57) Fall back to using OIDC Subject instead of Email (@aigarius)

259+- [#57](https://github.com/oauth2-proxy/oauth2-proxy/pull/57) Fall back to using OIDC Subject instead of Email (@aigarius)

249−- [#85](https://github.com/pusher/oauth2_proxy/pull/85) Use non-root user in docker images (@kskewes)

260+- [#85](https://github.com/oauth2-proxy/oauth2-proxy/pull/85) Use non-root user in docker images (@kskewes)

250−- [#68](https://github.com/pusher/oauth2_proxy/pull/68) forward X-Auth-Access-Token header (@davidholsgrove)

261+- [#68](https://github.com/oauth2-proxy/oauth2-proxy/pull/68) forward X-Auth-Access-Token header (@davidholsgrove)

251−- [#41](https://github.com/pusher/oauth2_proxy/pull/41) Added option to manually specify OIDC endpoints instead of relying on discovery

262+- [#41](https://github.com/oauth2-proxy/oauth2-proxy/pull/41) Added option to manually specify OIDC endpoints instead of relying on discovery

252−- [#83](https://github.com/pusher/oauth2_proxy/pull/83) Add `id_token` refresh to Google provider (@leki75)

263+- [#83](https://github.com/oauth2-proxy/oauth2-proxy/pull/83) Add `id_token` refresh to Google provider (@leki75)

253−- [#10](https://github.com/pusher/oauth2_proxy/pull/10) fix redirect url param handling (@dt-rush)

264+- [#10](https://github.com/oauth2-proxy/oauth2-proxy/pull/10) fix redirect url param handling (@dt-rush)

254−- [#122](https://github.com/pusher/oauth2_proxy/pull/122) Expose -cookie-path as configuration parameter (@costelmoraru)

265+- [#122](https://github.com/oauth2-proxy/oauth2-proxy/pull/122) Expose -cookie-path as configuration parameter (@costelmoraru)

255−- [#124](https://github.com/pusher/oauth2_proxy/pull/124) Use Go 1.12 for testing and build environments (@syscll)

266+- [#124](https://github.com/oauth2-proxy/oauth2-proxy/pull/124) Use Go 1.12 for testing and build environments (@syscll)

256

267

257# v3.1.0

268# v3.1.0

258

269

@@ -273,27 +284,27 @@ instead of returning an error

273- Streamed responses will now be flushed every 1 second by default.

284- Streamed responses will now be flushed every 1 second by default.

274 Previously streamed responses were flushed only when the buffer was full.

285 Previously streamed responses were flushed only when the buffer was full.

275 To retain the old behaviour set `--flush-interval=0`.

286 To retain the old behaviour set `--flush-interval=0`.

276− See [#23](https://github.com/pusher/oauth2_proxy/pull/23) for further details.

287+ See [#23](https://github.com/oauth2-proxy/oauth2-proxy/pull/23) for further details.

277

288

278## Changes since v3.0.0

289## Changes since v3.0.0

279

290

280−- [#14](https://github.com/pusher/oauth2_proxy/pull/14) OIDC ID Token, Authorization Headers, Refreshing and Verification (@joelspeed)

291+- [#14](https://github.com/oauth2-proxy/oauth2-proxy/pull/14) OIDC ID Token, Authorization Headers, Refreshing and Verification (@joelspeed)

281 - Implement `pass-authorization-header` and `set-authorization-header` flags

292 - Implement `pass-authorization-header` and `set-authorization-header` flags

282 - Implement token refreshing in OIDC provider

293 - Implement token refreshing in OIDC provider

283 - Split cookies larger than 4k limit into multiple cookies

294 - Split cookies larger than 4k limit into multiple cookies

284 - Implement token validation in OIDC provider

295 - Implement token validation in OIDC provider

285−- [#15](https://github.com/pusher/oauth2_proxy/pull/15) WhitelistDomains (@joelspeed)

296+- [#15](https://github.com/oauth2-proxy/oauth2-proxy/pull/15) WhitelistDomains (@joelspeed)

286 - Add `--whitelist-domain` flag to allow redirection to approved domains after OAuth flow

297 - Add `--whitelist-domain` flag to allow redirection to approved domains after OAuth flow

287−- [#21](https://github.com/pusher/oauth2_proxy/pull/21) Docker Improvement (@yaegashi)

298+- [#21](https://github.com/oauth2-proxy/oauth2-proxy/pull/21) Docker Improvement (@yaegashi)

288 - Move Docker base image from debian to alpine

299 - Move Docker base image from debian to alpine

289 - Install ca-certificates in docker image

300 - Install ca-certificates in docker image

290−- [#23](https://github.com/pusher/oauth2_proxy/pull/23) Flushed streaming responses

301+- [#23](https://github.com/oauth2-proxy/oauth2-proxy/pull/23) Flushed streaming responses

291 - Long-running upstream responses will get flushed every <timeperiod> (1 second by default)

302 - Long-running upstream responses will get flushed every <timeperiod> (1 second by default)

292−- [#24](https://github.com/pusher/oauth2_proxy/pull/24) Redirect fix (@agentgonzo)

303+- [#24](https://github.com/oauth2-proxy/oauth2-proxy/pull/24) Redirect fix (@agentgonzo)

293 - After a successful login, you will be redirected to your original URL rather than /

304 - After a successful login, you will be redirected to your original URL rather than /

294−- [#35](https://github.com/pusher/oauth2_proxy/pull/35) arm and arm64 binary releases (@kskewes)

305+- [#35](https://github.com/oauth2-proxy/oauth2-proxy/pull/35) arm and arm64 binary releases (@kskewes)

295 - Add armv6 and arm64 to Makefile `release` target

306 - Add armv6 and arm64 to Makefile `release` target

296−- [#37](https://github.com/pusher/oauth2_proxy/pull/37) cross build arm and arm64 docker images (@kskewes)

307+- [#37](https://github.com/oauth2-proxy/oauth2-proxy/pull/37) cross build arm and arm64 docker images (@kskewes)

297

308

298# v3.0.0

309# v3.0.0

299

310

@@ -303,7 +314,7 @@ v2.2 as released by Bitly.

303

314

304## Changes since v2.2:

315## Changes since v2.2:

305

316

306−- [#7](https://github.com/pusher/oauth2_proxy/pull/7) Migration to Pusher (@joelspeed)

317+- [#7](https://github.com/oauth2-proxy/oauth2-proxy/pull/7) Migration to Pusher (@joelspeed)

307 - Move automated build to debian base image

318 - Move automated build to debian base image

308 - Add Makefile

319 - Add Makefile

309 - Update CI to run `make test`

320 - Update CI to run `make test`

CONTRIBUTING.md+2−2

@@ -7,8 +7,8 @@ Download the dependencies using `go mod download`.

7

8```bash

9cd $GOPATH/src/github.com # Create this directory if it doesn't exist

10−git clone git@github.com:<YOUR_FORK>/oauth2_proxy pusher/oauth2_proxy

10+git clone git@github.com:<YOUR_FORK>/oauth2-proxy oauth2-proxy/oauth2-proxy

11−cd pusher/oauth2_proxy

11+cd oauth2-proxy/oauth2-proxy

12./configure # Setup your environment variables

13go mod download

14```

Dockerfile+4−4

@@ -4,7 +4,7 @@ FROM golang:1.14-buster AS builder

4RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.24.0

5

6# Copy sources

7−WORKDIR $GOPATH/src/github.com/pusher/oauth2_proxy

7+WORKDIR $GOPATH/src/github.com/oauth2-proxy/oauth2-proxy

8

9# Fetch dependencies

10COPY go.mod go.sum ./

@@ -25,9 +25,9 @@ RUN ./configure && make build && touch jwt_signing_key.pem

25FROM alpine:3.11

26COPY nsswitch.conf /etc/nsswitch.conf

27COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

28−COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/oauth2_proxy /bin/oauth2_proxy

28+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy

29−COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem

29+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem

30

31USER 2000:2000

32

33−ENTRYPOINT ["/bin/oauth2_proxy"]

33+ENTRYPOINT ["/bin/oauth2-proxy"]

Dockerfile.arm64+4−4

@@ -4,7 +4,7 @@ FROM golang:1.14-buster AS builder

4RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.24.0

5

6# Copy sources

7−WORKDIR $GOPATH/src/github.com/pusher/oauth2_proxy

7+WORKDIR $GOPATH/src/github.com/oauth2-proxy/oauth2-proxy

8

9# Fetch dependencies

10COPY go.mod go.sum ./

@@ -25,9 +25,9 @@ RUN ./configure && GOARCH=arm64 make build && touch jwt_signing_key.pem

25FROM arm64v8/alpine:3.11

26COPY nsswitch.conf /etc/nsswitch.conf

27COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

28−COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/oauth2_proxy /bin/oauth2_proxy

28+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy

29−COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem

29+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem

30

31USER 2000:2000

32

33−ENTRYPOINT ["/bin/oauth2_proxy"]

33+ENTRYPOINT ["/bin/oauth2-proxy"]

Dockerfile.armv6+4−4

@@ -4,7 +4,7 @@ FROM golang:1.14-buster AS builder

4RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.24.0

5

6# Copy sources

7−WORKDIR $GOPATH/src/github.com/pusher/oauth2_proxy

7+WORKDIR $GOPATH/src/github.com/oauth2-proxy/oauth2-proxy

8

9# Fetch dependencies

10COPY go.mod go.sum ./

@@ -25,9 +25,9 @@ RUN ./configure && GOARCH=arm GOARM=6 make build && touch jwt_signing_key.pem

25FROM arm32v6/alpine:3.11

26COPY nsswitch.conf /etc/nsswitch.conf

27COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt

28−COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/oauth2_proxy /bin/oauth2_proxy

28+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/oauth2-proxy /bin/oauth2-proxy

29−COPY --from=builder /go/src/github.com/pusher/oauth2_proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem

29+COPY --from=builder /go/src/github.com/oauth2-proxy/oauth2-proxy/jwt_signing_key.pem /etc/ssl/private/jwt_signing_key.pem

30

31USER 2000:2000

32

33−ENTRYPOINT ["/bin/oauth2_proxy"]

33+ENTRYPOINT ["/bin/oauth2-proxy"]

Makefile+19−19

@@ -1,8 +1,8 @@

1include .env

2−BINARY := oauth2_proxy

2+BINARY := oauth2-proxy

3VERSION := $(shell git describe --always --dirty --tags 2>/dev/null || echo "undefined")

4# Allow to override image registry.

5−REGISTRY ?= quay.io/pusher

5+REGISTRY ?= quay.io/oauth2-proxy

6.NOTPARALLEL:

7

8.PHONY: all

@@ -25,35 +25,35 @@ lint:

25build: clean $(BINARY)

26

27$(BINARY):

28− GO111MODULE=on CGO_ENABLED=0 $(GO) build -a -installsuffix cgo -ldflags="-X main.VERSION=${VERSION}" -o $@ github.com/pusher/oauth2_proxy

28+ GO111MODULE=on CGO_ENABLED=0 $(GO) build -a -installsuffix cgo -ldflags="-X main.VERSION=${VERSION}" -o $@ github.com/oauth2-proxy/oauth2-proxy

29

30.PHONY: docker

31docker:

32− docker build -f Dockerfile -t $(REGISTRY)/oauth2_proxy:latest .

32+ docker build -f Dockerfile -t $(REGISTRY)/oauth2-proxy:latest .

33

34.PHONY: docker-all

35docker-all: docker

36− docker build -f Dockerfile -t $(REGISTRY)/oauth2_proxy:latest-amd64 .

36+ docker build -f Dockerfile -t $(REGISTRY)/oauth2-proxy:latest-amd64 .

37− docker build -f Dockerfile -t $(REGISTRY)/oauth2_proxy:${VERSION} .

37+ docker build -f Dockerfile -t $(REGISTRY)/oauth2-proxy:${VERSION} .

38− docker build -f Dockerfile -t $(REGISTRY)/oauth2_proxy:${VERSION}-amd64 .

38+ docker build -f Dockerfile -t $(REGISTRY)/oauth2-proxy:${VERSION}-amd64 .

39− docker build -f Dockerfile.arm64 -t $(REGISTRY)/oauth2_proxy:latest-arm64 .

39+ docker build -f Dockerfile.arm64 -t $(REGISTRY)/oauth2-proxy:latest-arm64 .

40− docker build -f Dockerfile.arm64 -t $(REGISTRY)/oauth2_proxy:${VERSION}-arm64 .

40+ docker build -f Dockerfile.arm64 -t $(REGISTRY)/oauth2-proxy:${VERSION}-arm64 .

41− docker build -f Dockerfile.armv6 -t $(REGISTRY)/oauth2_proxy:latest-armv6 .

41+ docker build -f Dockerfile.armv6 -t $(REGISTRY)/oauth2-proxy:latest-armv6 .

42− docker build -f Dockerfile.armv6 -t $(REGISTRY)/oauth2_proxy:${VERSION}-armv6 .

42+ docker build -f Dockerfile.armv6 -t $(REGISTRY)/oauth2-proxy:${VERSION}-armv6 .

43

44.PHONY: docker-push

45docker-push:

46− docker push $(REGISTRY)/oauth2_proxy:latest

46+ docker push $(REGISTRY)/oauth2-proxy:latest

47

48.PHONY: docker-push-all

49docker-push-all: docker-push

50− docker push $(REGISTRY)/oauth2_proxy:latest-amd64

50+ docker push $(REGISTRY)/oauth2-proxy:latest-amd64

51− docker push $(REGISTRY)/oauth2_proxy:${VERSION}

51+ docker push $(REGISTRY)/oauth2-proxy:${VERSION}

52− docker push $(REGISTRY)/oauth2_proxy:${VERSION}-amd64

52+ docker push $(REGISTRY)/oauth2-proxy:${VERSION}-amd64

53− docker push $(REGISTRY)/oauth2_proxy:latest-arm64

53+ docker push $(REGISTRY)/oauth2-proxy:latest-arm64

54− docker push $(REGISTRY)/oauth2_proxy:${VERSION}-arm64

54+ docker push $(REGISTRY)/oauth2-proxy:${VERSION}-arm64

55− docker push $(REGISTRY)/oauth2_proxy:latest-armv6

55+ docker push $(REGISTRY)/oauth2-proxy:latest-armv6

56− docker push $(REGISTRY)/oauth2_proxy:${VERSION}-armv6

56+ docker push $(REGISTRY)/oauth2-proxy:${VERSION}-armv6

57

58.PHONY: test

59test: lint

README.md+15−12

@@ -1,8 +1,8 @@

1![OAuth2 Proxy](/docs/logos/OAuth2_Proxy_horizontal.svg)

2

3−[![Build Status](https://secure.travis-ci.org/pusher/oauth2_proxy.svg?branch=master)](http://travis-ci.org/pusher/oauth2_proxy)

3+[![Build Status](https://secure.travis-ci.org/oauth2-proxy/oauth2-proxy.svg?branch=master)](http://travis-ci.org/oauth2-proxy/oauth2-proxy)

4−[![Go Report Card](https://goreportcard.com/badge/github.com/pusher/oauth2_proxy)](https://goreportcard.com/report/github.com/pusher/oauth2_proxy)

4+[![Go Report Card](https://goreportcard.com/badge/github.com/oauth2-proxy/oauth2-proxy)](https://goreportcard.com/report/github.com/oauth2-proxy/oauth2-proxy)

5−[![GoDoc](https://godoc.org/github.com/pusher/oauth2_proxy?status.svg)](https://godoc.org/github.com/pusher/oauth2_proxy)

5+[![GoDoc](https://godoc.org/github.com/oauth2-proxy/oauth2-proxy?status.svg)](https://godoc.org/github.com/oauth2-proxy/oauth2-proxy)

6[![MIT licensed](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)

7

8A reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others)

@@ -12,37 +12,40 @@ to validate accounts by email, domain or group.

12Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.

13A list of changes can be seen in the [CHANGELOG](CHANGELOG.md).

14

15+**Note:** This project was formerly hosted as `pusher/oauth2_proxy` but has been renamed as of 29/03/2020 to `oauth2-proxy/oauth2-proxy`.

16+Going forward, all images shall be available at `quay.io/oauth2-proxy/oauth2-proxy` and binaries wiil been named `oauth2-proxy`.

17+

15![Sign In Page](https://cloud.githubusercontent.com/assets/45028/4970624/7feb7dd8-6886-11e4-93e0-c9904af44ea8.png)

18![Sign In Page](https://cloud.githubusercontent.com/assets/45028/4970624/7feb7dd8-6886-11e4-93e0-c9904af44ea8.png)

16

19

17## Installation

20## Installation

18

21

191. Choose how to deploy:

221. Choose how to deploy:

20

23

21− a. Download [Prebuilt Binary](https://github.com/pusher/oauth2_proxy/releases) (current release is `v5.0.0`)

24+ a. Download [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v5.1.0`)

22

25

23− b. Build with `$ go get github.com/pusher/oauth2_proxy` which will put the binary in `$GOROOT/bin`

26+ b. Build with `$ go get github.com/oauth2-proxy/oauth2-proxy` which will put the binary in `$GOROOT/bin`

24

27

25− c. Using the prebuilt docker image [quay.io/pusher/oauth2_proxy](https://quay.io/pusher/oauth2_proxy) (AMD64, ARMv6 and ARM64 tags available)

28+ c. Using the prebuilt docker image [quay.io/oauth2-proxy/oauth2-proxy](https://quay.io/oauth2-proxy/oauth2-proxy) (AMD64, ARMv6 and ARM64 tags available)

26

29

27Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.

30Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.

28

31

29```

32```

30sha256sum -c sha256sum.txt 2>&1 | grep OK

33sha256sum -c sha256sum.txt 2>&1 | grep OK

31−oauth2_proxy-4.0.0.linux-amd64: OK

34+oauth2-proxy-x.y.z.linux-amd64: OK

32```

35```

33

36

34−2. [Select a Provider and Register an OAuth Application with a Provider](https://pusher.github.io/oauth2_proxy/auth-configuration)

37+2. [Select a Provider and Register an OAuth Application with a Provider](https://oauth2-proxy.github.io/oauth2-proxy/auth-configuration)

35−3. [Configure OAuth2 Proxy using config file, command line options, or environment variables](https://pusher.github.io/oauth2_proxy/configuration)

38+3. [Configure OAuth2 Proxy using config file, command line options, or environment variables](https://oauth2-proxy.github.io/oauth2-proxy/configuration)

36−4. [Configure SSL or Deploy behind a SSL endpoint](https://pusher.github.io/oauth2_proxy/tls-configuration) (example provided for Nginx)

39+4. [Configure SSL or Deploy behind a SSL endpoint](https://oauth2-proxy.github.io/oauth2-proxy/tls-configuration) (example provided for Nginx)

37

40

38

41

39## Security

42## Security

40

43

41−If you are running a version older than v5.0.0 we **strongly recommend you please update** to a current version. RE: [open redirect vulnverability](https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv)

44+If you are running a version older than v5.0.0 we **strongly recommend you please update** to a current version. RE: [open redirect vulnverability](https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-qqxw-m5fj-f7gv)

42

45

43## Docs

46## Docs

44

47

45−Read the docs on our [Docs site](https://pusher.github.io/oauth2_proxy).

48+Read the docs on our [Docs site](https://oauth2-proxy.github.io/oauth2-proxy).

46

49

47![OAuth2 Proxy Architecture](https://cloud.githubusercontent.com/assets/45028/8027702/bd040b7a-0d6a-11e5-85b9-f8d953d04f39.png)

50![OAuth2 Proxy Architecture](https://cloud.githubusercontent.com/assets/45028/8027702/bd040b7a-0d6a-11e5-85b9-f8d953d04f39.png)

48

51

RELEASE.md+2−2

@@ -1,6 +1,6 @@

1# Release

2

3−Here's how OAuth2_Proxy releases are created.

3+Here's how OAuth2 Proxy releases are created.

4

5## Schedule

6

@@ -44,4 +44,4 @@ Note this uses `v4.1.0` as an example release number.

44 ```

45 Note: Ensure the docker tags don't include `-dirty`. This means you have uncommitted changes.

46

47−12. Verify everything looks good at [quay](https://quay.io/repository/pusher/oauth2_proxy?tag=latest&tab=tags) and [github](https://github.com/pusher/oauth2_proxy/releases)

47+12. Verify everything looks good at [quay](https://quay.io/repository/oauth2-proxy/oauth2-proxy?tag=latest&tab=tags) and [github](https://github.com/oauth2-proxy/oauth2-proxy/releases)

contrib/oauth2_proxy.cfg.example → contrib/oauth2-proxy.cfg.examplerenamed+1−1

@@ -1,5 +1,5 @@

1## OAuth2 Proxy Config File

2−## https://github.com/pusher/oauth2_proxy

2+## https://github.com/oauth2-proxy/oauth2-proxy

3

4## <addr>:<port> to listen on for HTTP/HTTPS clients

5# http_address = "127.0.0.1:4180"

contrib/oauth2_proxy.service.example → contrib/oauth2-proxy.service.examplerenamed+3−3

@@ -1,10 +1,10 @@

1−# Systemd service file for oauth2_proxy daemon

1+# Systemd service file for oauth2-proxy daemon

2#

3# Date: Feb 9, 2016

4# Author: Srdjan Grubor <sgnn7@sgnn7.org>

5

6[Unit]

7−Description=oauth2_proxy daemon service

7+Description=oauth2-proxy daemon service

8After=syslog.target network.target

9

10[Service]

@@ -12,7 +12,7 @@ After=syslog.target network.target

12User=www-data

13Group=www-data

14

15−ExecStart=/usr/local/bin/oauth2_proxy -config=/etc/oauth2_proxy.cfg

15+ExecStart=/usr/local/bin/oauth2-proxy -config=/etc/oauth2-proxy.cfg

16ExecReload=/bin/kill -HUP $MAINPID

17

18KillMode=process

contrib/oauth2_proxy_autocomplete.sh → contrib/oauth2-proxy_autocomplete.shrenamed+4−4

@@ -1,12 +1,12 @@

1#

2−# Autocompletion for oauth2_proxy

2+# Autocompletion for oauth2-proxy

3#

4# To install this, copy/move this file to /etc/bash.completion.d/

5−# or add a line to your ~/.bashrc | ~/.bash_profile that says ". /path/to/oauth2_proxy/contrib/oauth2_proxy_autocomplete.sh"

5+# or add a line to your ~/.bashrc | ~/.bash_profile that says ". /path/to/oauth2-proxy/contrib/oauth2-proxy_autocomplete.sh"

6#

7

8_oauth2_proxy() {

9− _oauth2_proxy_commands=$(oauth2_proxy -h 2>&1 | sed -n '/^\s*-/s/ \+/ /gp' | awk '{print $1}' | tr '\n' ' ')

9+ _oauth2_proxy_commands=$(oauth2-proxy -h 2>&1 | sed -n '/^\s*-/s/ \+/ /gp' | awk '{print $1}' | tr '\n' ' ')

10 local cur prev

11 COMPREPLY=()

12 cur="${COMP_WORDS[COMP_CWORD]}"

@@ -27,4 +27,4 @@ _oauth2_proxy() {

27 COMPREPLY=( $(compgen -W "${_oauth2_proxy_commands}" -- ${cur}) )

28 return 0;

29}

30−complete -F _oauth2_proxy oauth2_proxy

30+complete -F _oauth2_proxy oauth2-proxy

dist.sh+2−2

@@ -28,10 +28,10 @@ for ARCH in "${ARCHS[@]}"; do

28 # Create architecture specific binaries

29 if [[ ${GO_ARCH} == "armv6" ]]; then

30 GO111MODULE=on GOOS=${GO_OS} GOARCH=arm GOARM=6 CGO_ENABLED=0 go build -ldflags="-X main.VERSION=${VERSION}" \

31− -o release/${BINARY}-${VERSION}.${ARCH}.${GO_VERSION}/${BINARY} github.com/pusher/oauth2_proxy

31+ -o release/${BINARY}-${VERSION}.${ARCH}.${GO_VERSION}/${BINARY} github.com/oauth2-proxy/oauth2-proxy

32 else

33 GO111MODULE=on GOOS=${GO_OS} GOARCH=${GO_ARCH} CGO_ENABLED=0 go build -ldflags="-X main.VERSION=${VERSION}" \

34− -o release/${BINARY}-${VERSION}.${ARCH}.${GO_VERSION}/${BINARY} github.com/pusher/oauth2_proxy

34+ -o release/${BINARY}-${VERSION}.${ARCH}.${GO_VERSION}/${BINARY} github.com/oauth2-proxy/oauth2-proxy

35 fi

36

37 cd release

docs/0_index.md+1−1

@@ -14,7 +14,7 @@ to validate accounts by email, domain or group.

14Versions v3.0.0 and up are from this fork and will have diverged from any changes in the original fork.

15A list of changes can be seen in the [CHANGELOG]({{ site.gitweb }}/CHANGELOG.md).

16

17−[![Build Status](https://secure.travis-ci.org/pusher/oauth2_proxy.svg?branch=master)](http://travis-ci.org/pusher/oauth2_proxy)

17+[![Build Status](https://secure.travis-ci.org/oauth2-proxy/oauth2-proxy.svg?branch=master)](http://travis-ci.org/oauth2-proxy/oauth2-proxy)

18

19![Sign In Page](https://cloud.githubusercontent.com/assets/45028/4970624/7feb7dd8-6886-11e4-93e0-c9904af44ea8.png)

20

docs/1_installation.md+4−4

@@ -9,17 +9,17 @@ nav_order: 1

9

101. Choose how to deploy:

11

12− a. Download [Prebuilt Binary](https://github.com/pusher/oauth2_proxy/releases) (current release is `v4.0.0`)

12+ a. Download [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v5.1.0`)

13

14− b. Build with `$ go get github.com/pusher/oauth2_proxy` which will put the binary in `$GOROOT/bin`

14+ b. Build with `$ go get github.com/oauth2-proxy/oauth2-proxy` which will put the binary in `$GOROOT/bin`

15

16− c. Using the prebuilt docker image [quay.io/pusher/oauth2_proxy](https://quay.io/pusher/oauth2_proxy) (AMD64, ARMv6 and ARM64 tags available)

16+ c. Using the prebuilt docker image [quay.io/oauth2-proxy/oauth2-proxy](https://quay.io/oauth2-proxy/oauth2-proxy) (AMD64, ARMv6 and ARM64 tags available)

17

18Prebuilt binaries can be validated by extracting the file and verifying it against the `sha256sum.txt` checksum file provided for each release starting with version `v3.0.0`.

19

20```

21$ sha256sum -c sha256sum.txt 2>&1 | grep OK

22−oauth2_proxy-4.0.0.linux-amd64: OK

22+oauth2-proxy-x.y.z.linux-amd64: OK

23```

24

252. [Select a Provider and Register an OAuth Application with a Provider](auth-configuration)

docs/2_auth.md+13−13

@@ -7,7 +7,7 @@ nav_order: 2

7

8## OAuth Provider Configuration

9

10−You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run `oauth2_proxy` on.

10+You will need to register an OAuth application with a Provider (Google, GitHub or another provider), and configure it with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.

11

12Valid providers are :

13

@@ -67,8 +67,8 @@ https://www.googleapis.com/auth/admin.directory.user.readonly

677. Create or choose an existing administrative email address on the Gmail domain to assign to the `google-admin-email` flag. This email will be impersonated by this client to make calls to the Admin SDK. See the note on the link from step 5 for the reason why.

688. Create or choose an existing email group and set that email to the `google-group` flag. You can pass multiple instances of this flag with different groups

69 and the user will be checked against all the provided groups.

70−9. Lock down the permissions on the json file downloaded from step 1 so only oauth2_proxy is able to read the file and set the path to the file in the `google-service-account-json` flag.

70+9. Lock down the permissions on the json file downloaded from step 1 so only oauth2-proxy is able to read the file and set the path to the file in the `google-service-account-json` flag.

71−10. Restart oauth2_proxy.

71+10. Restart oauth2-proxy.

72

73Note: The user is checked against the group members list on initial authentication and every time the token is refreshed ( about once an hour ).

74

@@ -163,12 +163,12 @@ Take note of your `TenantId` if applicable for your situation. The `TenantId` ca

163OpenID Connect is a spec for OAUTH 2.0 + identity that is implemented by many major providers and several open source projects. This provider was originally built against CoreOS Dex and we will use it as an example.

164

1651. Launch a Dex instance using the [getting started guide](https://github.com/coreos/dex/blob/master/Documentation/getting-started.md).

166−2. Setup oauth2_proxy with the correct provider and using the default ports and callbacks.

166+2. Setup oauth2-proxy with the correct provider and using the default ports and callbacks.

167−3. Login with the fixture use in the dex guide and run the oauth2_proxy with the following args:

167+3. Login with the fixture use in the dex guide and run the oauth2-proxy with the following args:

168

169 -provider oidc

170 -provider-display-name "My OIDC Provider"

171− -client-id oauth2_proxy

171+ -client-id oauth2-proxy

172 -client-secret proxy

173 -redirect-url http://127.0.0.1:4180/oauth2/callback

174 -oidc-issuer-url http://127.0.0.1:5556

@@ -222,7 +222,7 @@ The `oidc_issuer_url` is based on URL from your **Authorization Server**'s **Iss

222The `client_id` and `client_secret` are configured in the application settings.

223Generate a unique `client_secret` to encrypt the cookie.

224

225−Then you can start the oauth2_proxy with `./oauth2_proxy -config /etc/example.cfg`

225+Then you can start the oauth2-proxy with `./oauth2-proxy -config /etc/example.cfg`

226

227

228### login.gov Provider

@@ -251,7 +251,7 @@ First, register your application in the dashboard. The important bits are:

251

252Now start the proxy up with the following options:

253```

254−./oauth2_proxy -provider login.gov \

254+./oauth2-proxy -provider login.gov \

255 -client-id=${LOGINGOV_ISSUER} \

256 -redirect-url=http://localhost:4180/oauth2/callback \

257 -oidc-issuer-url=https://idp.int.identitysandbox.gov/ \

@@ -282,13 +282,13 @@ proxy, and you would use real hostnames everywhere.

282

283#### Skip OIDC discovery

284

285−Some providers do not support OIDC discovery via their issuer URL, so oauth2_proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.

285+Some providers do not support OIDC discovery via their issuer URL, so oauth2-proxy cannot simply grab the authorization, token and jwks URI endpoints from the provider's metadata.

286

287In this case, you can set the `-skip-oidc-discovery` option, and supply those required endpoints manually:

288

289```

290 -provider oidc

291− -client-id oauth2_proxy

291+ -client-id oauth2-proxy

292 -client-secret proxy

293 -redirect-url http://127.0.0.1:4180/oauth2/callback

294 -oidc-issuer-url http://127.0.0.1:5556

@@ -330,7 +330,7 @@ Note: in *all* cases the validate-url will *not* have the `index.php`.

330

3311. [Create a new OAuth application](https://cloud.digitalocean.com/account/api/applications)

332 * You can fill in the name, homepage, and description however you wish.

333− * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy` with the actual hostname that oauth2_proxy is running on. The URL must match oauth2_proxy's configured redirect URL.

333+ * In the "Application callback URL" field, enter: `https://oauth-proxy/oauth2/callback`, substituting `oauth2-proxy` with the actual hostname that oauth2-proxy is running on. The URL must match oauth2-proxy's configured redirect URL.

3342. Note the Client ID and Client Secret.

335

336To use the provider, pass the following options:

@@ -346,7 +346,7 @@ To use the provider, pass the following options:

346### Bitbucket Auth Provider

347

3481. [Add a new OAuth consumer](https://confluence.atlassian.com/bitbucket/oauth-on-bitbucket-cloud-238027431.html)

349− * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual hostname that oauth2_proxy is running on.

349+ * In "Callback URL" use `https://<oauth2-proxy>/oauth2/callback`, substituting `<oauth2-proxy>` with the actual hostname that oauth2-proxy is running on.

350 * In Permissions section select:

351 * Account -> Email

352 * Team membership -> Read

@@ -372,5 +372,5 @@ To authorize by email domain use `--email-domain=yourcompany.com`. To authorize

372

373Follow the examples in the [`providers` package]({{ site.gitweb }}/providers/) to define a new

374`Provider` instance. Add a new `case` to

375−[`providers.New()`]({{ site.gitweb }}/providers/providers.go) to allow `oauth2_proxy` to use the

375+[`providers.New()`]({{ site.gitweb }}/providers/providers.go) to allow `oauth2-proxy` to use the

376new `Provider`.

docs/4_tls.md+7−7

@@ -11,10 +11,10 @@ There are two recommended configurations.

11

121. Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert-file=/path/to/cert.pem` and `--tls-key-file=/path/to/cert.key`.

13

14− The command line to run `oauth2_proxy` in this configuration would look like this:

14+ The command line to run `oauth2-proxy` in this configuration would look like this:

15

16 ```bash

17− ./oauth2_proxy \

17+ ./oauth2-proxy \

18 --email-domain="yourcompany.com" \

19 --upstream=http://127.0.0.1:8080/ \

20 --tls-cert-file=/path/to/cert.pem \

@@ -28,12 +28,12 @@ There are two recommended configurations.

28

292. Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....

30

31− Because `oauth2_proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an

31+ Because `oauth2-proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an

32 external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or

33 `--http-address="http://:4180"`.

34

35− Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2_proxy` on port `4180`.

35+ Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2-proxy` on port `4180`.

36− `oauth2_proxy` will then authenticate requests for an upstream application. The external endpoint for this example

36+ `oauth2-proxy` will then authenticate requests for an upstream application. The external endpoint for this example

37 would be `https://internal.yourcompany.com/`.

38

39 An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL

@@ -59,10 +59,10 @@ There are two recommended configurations.

59 }

60 ```

61

62− The command line to run `oauth2_proxy` in this configuration would look like this:

62+ The command line to run `oauth2-proxy` in this configuration would look like this:

63

64 ```bash

65− ./oauth2_proxy \

65+ ./oauth2-proxy \

66 --email-domain="yourcompany.com" \

67 --upstream=http://127.0.0.1:8080/ \

68 --cookie-secret=... \

docs/5_endpoints.md+2−2

@@ -20,7 +20,7 @@ OAuth2 Proxy responds directly to the following endpoints. All other endpoints w

20

21### Sign out

22

23−To sign the user out, redirect them to `/oauth2/sign_out`. This endpoint only removes oauth2_proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the `rd` query parameter, i.e. redirect the user to something like (notice the url-encoding!):

23+To sign the user out, redirect them to `/oauth2/sign_out`. This endpoint only removes oauth2-proxy's own cookies, i.e. the user is still logged in with the authentication provider and may automatically re-login when accessing the application again. You will also need to redirect the user to the authentication provider's sign out page afterwards using the `rd` query parameter, i.e. redirect the user to something like (notice the url-encoding!):

24

25```

26/oauth2/sign_out?rd=https%3A%2F%2Fmy-oidc-provider.example.com%2Fsign_out_page

@@ -33,7 +33,7 @@ GET /oauth2/sign_out HTTP/1.1

33X-Auth-Request-Redirect: https://my-oidc-provider/sign_out_page

34...

35```

36−

36+

37(The "sign_out_page" should be the [`end_session_endpoint`](https://openid.net/specs/openid-connect-session-1_0.html#rfc.section.2.1) from [the metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) if your OIDC provider supports Session Management and Discovery.)

38

39BEWARE that the domain you want to redirect to (`my-oidc-provider.example.com` in the example) must be added to the [`-whitelist-domain`](configuration) configuration option otherwise the redirect will be ignored.

docs/README.md+1−1

@@ -1,7 +1,7 @@

1# Docs

2

3This folder contains our Jekyll based docs site which is hosted at

4−https://pusher.github.io/oauth2_proxy.

4+https://oauth2-proxy.github.io/oauth2-proxy.

5

6When making changes to this docs site, please test your changes locally:

7

docs/_config.yml+7−7

@@ -13,13 +13,13 @@

13# you will see them accessed via {{ site.title }}, {{ site.email }}, and so on.

14# You can create any custom variable you would like, and they will be accessible

15# in the templates via {{ site.myvariable }}.

16−title: OAuth2_Proxy

16+title: OAuth2 Proxy

17logo: /logos/OAuth2_Proxy_horizontal.svg

18description: >- # this means to ignore newlines until "baseurl:"

19− OAuth2_Proxy documentation site

19+ OAuth2-Proxy documentation site

20−baseurl: "/oauth2_proxy" # the subpath of your site, e.g. /blog

20+baseurl: "/oauth2-proxy" # the subpath of your site, e.g. /blog

21−url: "https://pusher.github.io" # the base hostname & protocol for your site, e.g. http://example.com

21+url: "https://oauth2-proxy.github.io" # the base hostname & protocol for your site, e.g. http://example.com

22−gitweb: "https://github.com/pusher/oauth2_proxy/blob/master"

22+gitweb: "https://github.com/oauth2-proxy/oauth2-proxy/blob/master"

23

24# Build settings

25markdown: kramdown

@@ -28,8 +28,8 @@ search_enabled: true

28

29# Aux links for the upper right navigation

30aux_links:

31− "OAuth2_Proxy on GitHub":

31+ "OAuth2 Proxy on GitHub":

32− - "https://github.com/pusher/oauth2_proxy"

32+ - "https://github.com/oauth2-proxy/oauth2-proxy"

33

34# Exclude from processing.

35# The following items will not be processed, by default. Create a custom list

docs/configuration/configuration.md+5−5

@@ -8,7 +8,7 @@ nav_order: 3

8

9## Configuration

10

11−`oauth2_proxy` can be configured via [config file](#config-file), [command line options](#command-line-options) or [environment variables](#environment-variables).

11+`oauth2-proxy` can be configured via [config file](#config-file), [command line options](#command-line-options) or [environment variables](#environment-variables).

12

13To generate a strong cookie secret use `python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(16)).decode())'`

14

@@ -16,7 +16,7 @@ To generate a strong cookie secret use `python -c 'import os,base64; print(base6

16

17Every command line argument can be specified in a config file by replacing hypens (-) with underscores (\_). If the argument can be specified multiple times, the config option should be plural (trailing s).

18

19−An example [oauth2_proxy.cfg]({{ site.gitweb }}/contrib/oauth2_proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `-config=/etc/oauth2_proxy.cfg`

19+An example [oauth2-proxy.cfg]({{ site.gitweb }}/contrib/oauth2-proxy.cfg.example) config file is in the contrib directory. It can be used by specifying `-config=/etc/oauth2-proxy.cfg`

20

21### Command Line Options

22

@@ -127,9 +127,9 @@ See below for provider specific options

127

128### Upstreams Configuration

129

130−`oauth2_proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter, this will forward all authenticated requests to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.

130+`oauth2-proxy` supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as `http://127.0.0.1:8080/` for the upstream parameter, this will forward all authenticated requests to the upstream server. If you instead provide `http://127.0.0.1:8080/some/path/` then it will only be requests that start with `/some/path/` which are forwarded to the upstream.

131

132−Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2_proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at. `file:///var/www/static/#/static/` will ie. make `/var/www/static/` available at `http://[oauth2_proxy url]/static/`.

132+Static file paths are configured as a file:// URL. `file:///var/www/static/` will serve the files from that directory at `http://[oauth2-proxy url]/var/www/static/`, which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at. `file:///var/www/static/#/static/` will ie. make `/var/www/static/` available at `http://[oauth2-proxy url]/static/`.

133

134Multiple upstreams can either be configured by supplying a comma separated list to the `-upstream` parameter, supplying the parameter multiple times or provinding a list in the [config file](#config-file). When multiple upstreams are used routing to them will be based on the path they are set up with.

135

@@ -246,7 +246,7 @@ Available variables for standard logging:

246

247## <a name="nginx-auth-request"></a>Configuring for use with the Nginx `auth_request` directive

248

249−The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2_proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

249+The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2-proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:

250

251```nginx

252server {

env_options_test.go+1−1

@@ -4,7 +4,7 @@ import (

4 "os"

5 "testing"

6

7− proxy "github.com/pusher/oauth2_proxy"

7+ proxy "github.com/oauth2-proxy/oauth2-proxy"

8 "github.com/stretchr/testify/assert"

9)

10

go.mod+1−1

@@ -1,4 +1,4 @@

1−module github.com/pusher/oauth2_proxy

1+module github.com/oauth2-proxy/oauth2-proxy

2

3go 1.14

4

htpasswd.go+1−1

@@ -7,7 +7,7 @@ import (

7 "io"

8 "os"

9

10− "github.com/pusher/oauth2_proxy/pkg/logger"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

11 "golang.org/x/crypto/bcrypt"

12)

13

http.go+1−1

@@ -7,7 +7,7 @@ import (

7 "strings"

8 "time"

9

10− "github.com/pusher/oauth2_proxy/pkg/logger"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

11)

12

13// Server represents an HTTP server

logging_handler.go+1−1

@@ -10,7 +10,7 @@ import (

10 "net/http"

11 "time"

12

13− "github.com/pusher/oauth2_proxy/pkg/logger"

13+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

14)

15

16// responseLogger is wrapper of http.ResponseWriter that keeps track of its HTTP status

logging_handler_test.go+1−1

@@ -9,7 +9,7 @@ import (

9 "testing"

10 "time"

11

12− "github.com/pusher/oauth2_proxy/pkg/logger"

12+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

13)

14

15func TestLoggingHandler_ServeHTTP(t *testing.T) {

main.go+3−3

@@ -12,12 +12,12 @@ import (

12

13 "github.com/BurntSushi/toml"

14 options "github.com/mreiferson/go-options"

15− "github.com/pusher/oauth2_proxy/pkg/logger"

15+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

16)

17

18func main() {

19 logger.SetFlags(logger.Lshortfile)

20− flagSet := flag.NewFlagSet("oauth2_proxy", flag.ExitOnError)

20+ flagSet := flag.NewFlagSet("oauth2-proxy", flag.ExitOnError)

21

22 emailDomains := StringArray{}

23 whitelistDomains := StringArray{}

@@ -145,7 +145,7 @@ func main() {

145 flagSet.Parse(os.Args[1:])

146

147 if *showVersion {

148− fmt.Printf("oauth2_proxy %s (built with %s)\n", VERSION, runtime.Version())

148+ fmt.Printf("oauth2-proxy %s (built with %s)\n", VERSION, runtime.Version())

149 return

150 }

151

oauthproxy.go+5−5

@@ -19,11 +19,11 @@ import (

19

20 "github.com/coreos/go-oidc"

21 "github.com/mbland/hmacauth"

22− sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

22+ sessionsapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

23− "github.com/pusher/oauth2_proxy/pkg/cookies"

23+ "github.com/oauth2-proxy/oauth2-proxy/pkg/cookies"

24− "github.com/pusher/oauth2_proxy/pkg/encryption"

24+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

25− "github.com/pusher/oauth2_proxy/pkg/logger"

25+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

26− "github.com/pusher/oauth2_proxy/providers"

26+ "github.com/oauth2-proxy/oauth2-proxy/providers"

27 "github.com/yhat/wsutil"

28)

29

oauthproxy_test.go+4−4

@@ -18,10 +18,10 @@ import (

18

19 "github.com/coreos/go-oidc"

20 "github.com/mbland/hmacauth"

21− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

21+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

22− "github.com/pusher/oauth2_proxy/pkg/logger"

22+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

23− "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"

23+ "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/cookie"

24− "github.com/pusher/oauth2_proxy/providers"

24+ "github.com/oauth2-proxy/oauth2-proxy/providers"

25 "github.com/stretchr/testify/assert"

26 "github.com/stretchr/testify/require"

27 "golang.org/x/net/websocket"

options.go+6−6

@@ -17,12 +17,12 @@ import (

17 oidc "github.com/coreos/go-oidc"

18 "github.com/dgrijalva/jwt-go"

19 "github.com/mbland/hmacauth"

20− "github.com/pusher/oauth2_proxy/pkg/apis/options"

20+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

21− sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

21+ sessionsapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

22− "github.com/pusher/oauth2_proxy/pkg/encryption"

22+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

23− "github.com/pusher/oauth2_proxy/pkg/logger"

23+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

24− "github.com/pusher/oauth2_proxy/pkg/sessions"

24+ "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions"

25− "github.com/pusher/oauth2_proxy/providers"

25+ "github.com/oauth2-proxy/oauth2-proxy/providers"

26 "gopkg.in/natefinch/lumberjack.v2"

27)

28

pkg/apis/options/sessions.go+1−1

@@ -1,6 +1,6 @@

1package options

2

3−import "github.com/pusher/oauth2_proxy/pkg/encryption"

3+import "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

4

5// SessionOptions contains configuration options for the SessionStore providers.

6type SessionOptions struct {

pkg/apis/sessions/session_state.go+1−1

@@ -7,7 +7,7 @@ import (

7 "strings"

8 "time"

9

10− "github.com/pusher/oauth2_proxy/pkg/encryption"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

11)

12

13// SessionState is used to store information about the currently authenticated user session

pkg/apis/sessions/session_state_test.go+2−2

@@ -5,8 +5,8 @@ import (

5 "testing"

6 "time"

7

8− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

8+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

9− "github.com/pusher/oauth2_proxy/pkg/encryption"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

10 "github.com/stretchr/testify/assert"

11)

12

pkg/cookies/cookies.go+2−2

@@ -7,8 +7,8 @@ import (

7 "strings"

8 "time"

9

10− "github.com/pusher/oauth2_proxy/pkg/apis/options"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

11− "github.com/pusher/oauth2_proxy/pkg/logger"

11+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

12)

13

14// MakeCookie constructs a cookie from the given parameters,

pkg/requests/requests.go+1−1

@@ -7,7 +7,7 @@ import (

7 "net/http"

8

9 "github.com/bitly/go-simplejson"

10− "github.com/pusher/oauth2_proxy/pkg/logger"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

11)

12

13// Request parses the request body into a simplejson.Json object

pkg/sessions/cookie/session_store.go+5−5

@@ -8,11 +8,11 @@ import (

8 "strings"

9 "time"

10

11− "github.com/pusher/oauth2_proxy/pkg/apis/options"

11+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

12− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

12+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

13− "github.com/pusher/oauth2_proxy/pkg/cookies"

13+ "github.com/oauth2-proxy/oauth2-proxy/pkg/cookies"

14− "github.com/pusher/oauth2_proxy/pkg/encryption"

14+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

15− "github.com/pusher/oauth2_proxy/pkg/sessions/utils"

15+ "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/utils"

16)

17

18const (

pkg/sessions/redis/redis_store.go+5−5

@@ -15,11 +15,11 @@ import (

15 "time"

16

17 "github.com/go-redis/redis"

18− "github.com/pusher/oauth2_proxy/pkg/apis/options"

18+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

19− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

19+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

20− "github.com/pusher/oauth2_proxy/pkg/cookies"

20+ "github.com/oauth2-proxy/oauth2-proxy/pkg/cookies"

21− "github.com/pusher/oauth2_proxy/pkg/encryption"

21+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

22− "github.com/pusher/oauth2_proxy/pkg/logger"

22+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

23)

24

25// TicketData is a structure representing the ticket used in server session storage

pkg/sessions/session_store.go+4−4

@@ -3,10 +3,10 @@ package sessions

3import (

4 "fmt"

5

6− "github.com/pusher/oauth2_proxy/pkg/apis/options"

6+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

7− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

7+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

8− "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"

8+ "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/cookie"

9− "github.com/pusher/oauth2_proxy/pkg/sessions/redis"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/redis"

10)

11

12// NewSessionStore creates a SessionStore from the provided configuration

pkg/sessions/session_store_test.go+8−8

@@ -11,16 +11,16 @@ import (

11 "time"

12

13 miniredis "github.com/alicebob/miniredis/v2"

14+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/options"

15+ sessionsapi "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

16+ cookiesapi "github.com/oauth2-proxy/oauth2-proxy/pkg/cookies"

17+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

18+ "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions"

19+ sessionscookie "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/cookie"

20+ "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/redis"

21+ "github.com/oauth2-proxy/oauth2-proxy/pkg/sessions/utils"

14 . "github.com/onsi/ginkgo"

22 . "github.com/onsi/ginkgo"

15 . "github.com/onsi/gomega"

23 . "github.com/onsi/gomega"

16− "github.com/pusher/oauth2_proxy/pkg/apis/options"

17− sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

18− cookiesapi "github.com/pusher/oauth2_proxy/pkg/cookies"

19− "github.com/pusher/oauth2_proxy/pkg/encryption"

20− "github.com/pusher/oauth2_proxy/pkg/sessions"

21− sessionscookie "github.com/pusher/oauth2_proxy/pkg/sessions/cookie"

22− "github.com/pusher/oauth2_proxy/pkg/sessions/redis"

23− "github.com/pusher/oauth2_proxy/pkg/sessions/utils"

24)

25

26func TestSessionStore(t *testing.T) {

pkg/sessions/utils/utils.go+2−2

@@ -3,8 +3,8 @@ package utils

3import (

4 "encoding/base64"

5

6− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

6+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

7− "github.com/pusher/oauth2_proxy/pkg/encryption"

7+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

8)

9

10// CookieForSession serializes a session state for storage in a cookie

providers/auth_test.go+1−1

@@ -5,7 +5,7 @@ import (

5 "net/http"

6 "net/url"

7

8− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

8+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

9)

10

11var authorizedAccessToken = "imaginary_access_token"

providers/azure.go+3−3

@@ -11,9 +11,9 @@ import (

11 "time"

12

13 "github.com/bitly/go-simplejson"

14− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

14+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

15− "github.com/pusher/oauth2_proxy/pkg/logger"

15+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

16− "github.com/pusher/oauth2_proxy/pkg/requests"

16+ "github.com/oauth2-proxy/oauth2-proxy/pkg/requests"

17)

18

19// AzureProvider represents an Azure based Identity Provider

providers/bitbucket.go+3−3

@@ -5,9 +5,9 @@ import (

5 "net/url"

6 "strings"

7

8− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

8+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

9− "github.com/pusher/oauth2_proxy/pkg/logger"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

10− "github.com/pusher/oauth2_proxy/pkg/requests"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/requests"

11)

12

13// BitbucketProvider represents an Bitbucket based Identity Provider

providers/bitbucket_test.go+1−1

@@ -9,7 +9,7 @@ import (

9

10 "github.com/stretchr/testify/assert"

11

12− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

12+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

13)

14

15func testBitbucketProvider(hostname, team string, repository string) *BitbucketProvider {

providers/digitalocean.go+2−2

@@ -6,8 +6,8 @@ import (

6 "net/http"

7 "net/url"

8

9− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

10− "github.com/pusher/oauth2_proxy/pkg/requests"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/requests"

11)

12

13// DigitalOceanProvider represents a DigitalOcean based Identity Provider

providers/digitalocean_test.go+1−1

@@ -6,7 +6,7 @@ import (

6 "net/url"

7 "testing"

8

9− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

10 "github.com/stretchr/testify/assert"

11)

12

providers/facebook.go+2−2

@@ -6,8 +6,8 @@ import (

6 "net/http"

7 "net/url"

8

9− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

10− "github.com/pusher/oauth2_proxy/pkg/requests"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/requests"

11)

12

13// FacebookProvider represents an Facebook based Identity Provider

providers/github.go+2−2

@@ -11,8 +11,8 @@ import (

11 "strconv"

12 "strings"

13

14− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

14+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

15− "github.com/pusher/oauth2_proxy/pkg/logger"

15+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

16)

17

18// GitHubProvider represents an GitHub based Identity Provider

providers/github_test.go+1−1

@@ -6,7 +6,7 @@ import (

6 "net/url"

7 "testing"

8

9− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

10 "github.com/stretchr/testify/assert"

11)

12

providers/gitlab.go+1−1

@@ -10,7 +10,7 @@ import (

10 "time"

11

12 oidc "github.com/coreos/go-oidc"

13− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

13+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

14 "golang.org/x/oauth2"

15)

16

providers/gitlab_test.go+1−1

@@ -6,7 +6,7 @@ import (

6 "net/url"

7 "testing"

8

9− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

10 "github.com/stretchr/testify/assert"

11)

12

providers/google.go+2−2

@@ -13,8 +13,8 @@ import (

13 "strings"

14 "time"

15

16− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

16+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

17− "github.com/pusher/oauth2_proxy/pkg/logger"

17+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

18 "golang.org/x/oauth2"

19 "golang.org/x/oauth2/google"

20 admin "google.golang.org/api/admin/directory/v1"

providers/internal_util.go+2−2

@@ -5,8 +5,8 @@ import (

5 "net/http"

6 "net/url"

7

8− "github.com/pusher/oauth2_proxy/pkg/logger"

8+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

9− "github.com/pusher/oauth2_proxy/pkg/requests"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/requests"

10)

11

12// stripToken is a helper function to obfuscate "access_token"

providers/internal_util_test.go+1−1

@@ -7,7 +7,7 @@ import (

7 "net/url"

8 "testing"

9

10− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

11 "github.com/stretchr/testify/assert"

12)

13

providers/keycloak.go+3−3

@@ -4,9 +4,9 @@ import (

4 "net/http"

5 "net/url"

6

7− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

7+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

8− "github.com/pusher/oauth2_proxy/pkg/logger"

8+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

9− "github.com/pusher/oauth2_proxy/pkg/requests"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/requests"

10)

11

12type KeycloakProvider struct {

providers/keycloak_test.go+1−1

@@ -7,7 +7,7 @@ import (

7 "testing"

8

9 "github.com/bmizerany/assert"

10− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

11)

12

13func testKeycloakProvider(hostname, group string) *KeycloakProvider {

providers/linkedin.go+2−2

@@ -6,8 +6,8 @@ import (

6 "net/http"

7 "net/url"

8

9− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

10− "github.com/pusher/oauth2_proxy/pkg/requests"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/requests"

11)

12

13// LinkedInProvider represents an LinkedIn based Identity Provider

providers/linkedin_test.go+1−1

@@ -6,7 +6,7 @@ import (

6 "net/url"

7 "testing"

8

9− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

10 "github.com/stretchr/testify/assert"

11)

12

providers/logingov.go+1−1

@@ -13,7 +13,7 @@ import (

13 "time"

14

15 "github.com/dgrijalva/jwt-go"

16− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

16+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

17 "gopkg.in/square/go-jose.v2"

18)

19

providers/nextcloud.go+3−3

@@ -4,9 +4,9 @@ import (

4 "fmt"

5 "net/http"

6

7− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

7+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

8− "github.com/pusher/oauth2_proxy/pkg/logger"

8+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

9− "github.com/pusher/oauth2_proxy/pkg/requests"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/requests"

10)

11

12// NextcloudProvider represents an Nextcloud based Identity Provider

providers/nextcloud_test.go+1−1

@@ -6,7 +6,7 @@ import (

6 "net/url"

7 "testing"

8

9− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

10 "github.com/stretchr/testify/assert"

11)

12

providers/oidc.go+2−2

@@ -10,8 +10,8 @@ import (

10 oidc "github.com/coreos/go-oidc"

11 "golang.org/x/oauth2"

12

13− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

13+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

14− "github.com/pusher/oauth2_proxy/pkg/requests"

14+ "github.com/oauth2-proxy/oauth2-proxy/pkg/requests"

15)

16

17// OIDCProvider represents an OIDC based Identity Provider

providers/oidc_test.go+1−1

@@ -20,7 +20,7 @@ import (

20 "github.com/dgrijalva/jwt-go"

21 "golang.org/x/oauth2"

22

23− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

23+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

24)

25

26const accessToken = "access_token"

providers/provider_data.go+1−1

@@ -5,7 +5,7 @@ import (

5 "io/ioutil"

6 "net/url"

7

8− "github.com/pusher/oauth2_proxy/pkg/logger"

8+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

9)

10

11// ProviderData contains information required to configure all implementations

providers/provider_default.go+2−2

@@ -10,8 +10,8 @@ import (

10 "net/url"

11 "time"

12

13− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

13+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

14− "github.com/pusher/oauth2_proxy/pkg/encryption"

14+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

15)

16

17// Redeem provides a default implementation of the OAuth2 token redemption process

providers/provider_default_test.go+1−1

@@ -4,7 +4,7 @@ import (

4 "testing"

5 "time"

6

7− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

7+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

8 "github.com/stretchr/testify/assert"

9)

10

providers/providers.go+2−2

@@ -1,8 +1,8 @@

1package providers

2

3import (

4− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

4+ "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

5− "github.com/pusher/oauth2_proxy/pkg/encryption"

5+ "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"

6)

7

8// Provider represents an upstream identity provider implementation

templates.go+2−2

@@ -4,7 +4,7 @@ import (

4 "html/template"

5 "path"

6

7− "github.com/pusher/oauth2_proxy/pkg/logger"

7+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

8)

9

10func loadTemplates(dir string) *template.Template {

@@ -149,7 +149,7 @@ func getTemplates() *template.Template {

149 <footer>

150 {{ if eq .Footer "-" }}

151 {{ else if eq .Footer ""}}

152− Secured with <a href="https://github.com/pusher/oauth2_proxy#oauth2_proxy">OAuth2 Proxy</a> version {{.Version}}

152+ Secured with <a href="https://github.com/oauth2-proxy/oauth2-proxy#oauth2_proxy">OAuth2 Proxy</a> version {{.Version}}

153 {{ else }}

154 {{.Footer}}

155 {{ end }}

validator.go+1−1

@@ -8,7 +8,7 @@ import (

8 "sync/atomic"

9 "unsafe"

10

11− "github.com/pusher/oauth2_proxy/pkg/logger"

11+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

12)

13

14// UserMap holds information from the authenticated emails file

watcher.go+1−1

@@ -7,7 +7,7 @@ import (

7 "path/filepath"

8 "time"

9

10− "github.com/pusher/oauth2_proxy/pkg/logger"

10+ "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

11 fsnotify "gopkg.in/fsnotify/fsnotify.v1"

12)

13

watcher_unsupported.go+1−1

@@ -2,7 +2,7 @@

2

3package main

4

5−import "github.com/pusher/oauth2_proxy/pkg/logger"

5+import "github.com/oauth2-proxy/oauth2-proxy/pkg/logger"

6

7func WatchForUpdates(filename string, done <-chan bool, action func()) {

8 logger.Printf("file watching not implemented on this platform")