c2c1caa · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Set User = Subject in ExtraJWTBearer sessions

commitc2c1caa4042aedb66980a62f44101d5181b8e3b4 authorNick Meves <nick.meves@greenhouse.io> dateMon 1 Jun 2020, 08:56 (6 years ago) parent788d8ec

4 files changed+13−12

compare with master

unifiedsplit

CHANGELOG.md+1 oauthproxy_test.go+3−3 providers/provider_default.go+5−6 providers/provider_default_test.go+4−3

CHANGELOG.md+1

@@ -55,6 +55,7 @@

5555

5656## Changes since v5.1.1

5757

58+- [#596](https://github.com/oauth2-proxy/oauth2-proxy/pull/596) Validate Bearer IDTokens in headers with correct provider/extra JWT Verifier (@NickMeves)

5859- [#620](https://github.com/oauth2-proxy/oauth2-proxy/pull/620) Add HealthCheck middleware (@JoelSpeed)

5960- [#597](https://github.com/oauth2-proxy/oauth2-proxy/pull/597) Don't log invalid redirect if redirect is empty (@JoelSpeed)

6061- [#604](https://github.com/oauth2-proxy/oauth2-proxy/pull/604) Add Keycloak local testing environment (@EvgeniGordeev)

oauthproxy_test.go+3−3

@@ -1578,7 +1578,7 @@ func TestGetJwtSession(t *testing.T) {

15781578 // Bearer

15791579 expires := time.Unix(1912151821, 0)

15801580 session, _ := test.proxy.GetJwtSession(test.req)

1581− assert.Equal(t, session.User, "john@example.com")

1581+ assert.Equal(t, session.User, "1234567890")

15821582 assert.Equal(t, session.Email, "john@example.com")

15831583 assert.Equal(t, session.ExpiresOn, &expires)

15841584 assert.Equal(t, session.IDToken, goodJwt)

@@ -1590,12 +1590,12 @@ func TestGetJwtSession(t *testing.T) {

15901590

15911591 // Check PassAuthorization, should overwrite Basic header

15921592 assert.Equal(t, test.req.Header.Get("Authorization"), authHeader)

1593− assert.Equal(t, test.req.Header.Get("X-Forwarded-User"), "john@example.com")

1593+ assert.Equal(t, test.req.Header.Get("X-Forwarded-User"), "1234567890")

15941594 assert.Equal(t, test.req.Header.Get("X-Forwarded-Email"), "john@example.com")

15951595

15961596 // SetAuthorization and SetXAuthRequest

15971597 assert.Equal(t, test.rw.Header().Get("Authorization"), authHeader)

1598− assert.Equal(t, test.rw.Header().Get("X-Auth-Request-User"), "john@example.com")

1598+ assert.Equal(t, test.rw.Header().Get("X-Auth-Request-User"), "1234567890")

15991599 assert.Equal(t, test.rw.Header().Get("X-Auth-Request-Email"), "john@example.com")

16001600}

16011601

providers/provider_default.go+5−6

@@ -164,14 +164,13 @@ func (p *ProviderData) CreateSessionStateFromBearerToken(ctx context.Context, ra

164164

165165 newSession := &sessions.SessionState{

166166 Email: claims.Email,

167− User: claims.Email,

167+ User: claims.Subject,

168168 PreferredUsername: claims.PreferredUsername,

169+ AccessToken: rawIDToken,

170+ IDToken: rawIDToken,

171+ RefreshToken: "",

172+ ExpiresOn: &idToken.Expiry,

169173 }

170174

171− newSession.AccessToken = rawIDToken

172− newSession.IDToken = rawIDToken

173− newSession.RefreshToken = ""

174− newSession.ExpiresOn = &idToken.Expiry

175−

176175 return newSession, nil

177176}

providers/provider_default_test.go+4−3

@@ -4,12 +4,13 @@ import (

44 "context"

55 "crypto/rand"

66 "crypto/rsa"

7− "github.com/coreos/go-oidc"

8− "github.com/dgrijalva/jwt-go"

97 "net/url"

108 "testing"

119 "time"

1210

11+ "github.com/coreos/go-oidc"

12+ "github.com/dgrijalva/jwt-go"

13+

1314 "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"

1415 "github.com/stretchr/testify/assert"

1516)

@@ -71,7 +72,7 @@ func TestCreateSessionStateFromBearerToken(t *testing.T) {

7172

7273 key, _ := rsa.GenerateKey(rand.Reader, 2048)

7374 rawIDToken, _ := jwt.NewWithClaims(jwt.SigningMethodRS256, minimalIDToken).SignedString(key)

74− idToken, err := verifier.Verify(context.Background(), rawIDToken)

75+ idToken, _ := verifier.Verify(context.Background(), rawIDToken)

7576

7677 session, err := (*ProviderData)(nil).CreateSessionStateFromBearerToken(context.Background(), rawIDToken, idToken)

7778