git.iko.soy/typeable/oauth2-proxy
on master help sign in
deref everything... but why?

Signed-off-by: Jan Larwig <jan@larwig.com>

commitceb9a387b12b06230e4e03fef67edbb4931bc1a1 authorJan Larwig <jan@larwig.com> dateFri 31 Oct 2025, 16:11 (1 year ago) parent527c72f
14 files changed+61−52
compare with master
unifiedsplit
main.go+5−2 main_test.go+12−5 pkg/middleware/headers.go+2−1 pkg/upstream/http.go+4−4 pkg/upstream/proxy.go+4−3 pkg/upstream/static.go+2−11 pkg/validation/options.go+2−1 pkg/validation/providers.go+6−5 pkg/validation/upstreams.go+9−8 providers/adfs.go+2−1 providers/google.go+4−5 providers/ms_entra_id.go+2−1 providers/oidc.go+2−1 providers/providers.go+5−4
main.go+5−2
@@ -75,11 +75,14 @@ func loadConfiguration(config, yamlConfig string, extraFlags *pflag.FlagSet, arg
7575
7676 if yamlConfig != "" {
7777 logger.Printf("WARNING: You are using alpha configuration. The structure in this configuration file may change without notice. You MUST remove conflicting options from your existing configuration.")
78− return loadYamlOptions(yamlConfig, config, extraFlags, args)
78+ opts, err = loadYamlOptions(yamlConfig, config, extraFlags, args)
79+ if err != nil {
80+ return nil, fmt.Errorf("failed to load yaml options: %w", err)
81+ }
7982 }
8083
84+ // Ensure defaults after loading configuration
8185 opts.EnsureDefaults()
82−
8386 return opts, nil
8487}
8588
main_test.go+12−5
@@ -123,6 +123,7 @@ redirect_url="http://localhost:4180/oauth2/callback"
123123 opts.RawRedirectURL = "http://localhost:4180/oauth2/callback"
124124
125125 opts.UpstreamServers = options.UpstreamConfig{
126+ ProxyRawPath: ptr.Ptr(false),
126127 Upstreams: []options.Upstream{
127128 {
128129 ID: "/",
@@ -132,6 +133,7 @@ redirect_url="http://localhost:4180/oauth2/callback"
132133 PassHostHeader: ptr.Ptr(true),
133134 ProxyWebSockets: ptr.Ptr(true),
134135 Timeout: ptr.Ptr(options.DefaultUpstreamTimeout),
136+ Static: ptr.Ptr(false),
135137 InsecureSkipTLSVerify: ptr.Ptr(false),
136138 DisableKeepAlives: ptr.Ptr(false),
137139 },
@@ -139,7 +141,8 @@ redirect_url="http://localhost:4180/oauth2/callback"
139141 }
140142
141143 authHeader := options.Header{
142− Name: "Authorization",
144+ Name: "Authorization",
145+ PreserveRequestValue: ptr.Ptr(false),
143146 Values: []options.HeaderValue{
144147 {
145148 ClaimSource: &options.ClaimSource{
@@ -153,10 +156,7 @@ redirect_url="http://localhost:4180/oauth2/callback"
153156 },
154157 }
155158
156− authHeader.PreserveRequestValue = ptr.Ptr(false)
157159 opts.InjectRequestHeaders = append([]options.Header{authHeader}, opts.InjectRequestHeaders...)
158−
159− authHeader.PreserveRequestValue = nil
160160 opts.InjectResponseHeaders = append(opts.InjectResponseHeaders, authHeader)
161161
162162 opts.Providers = options.Providers{
@@ -186,6 +186,12 @@ redirect_url="http://localhost:4180/oauth2/callback"
186186 InsecureSkipIssuerVerification: ptr.Ptr(false),
187187 SkipDiscovery: ptr.Ptr(false),
188188 },
189+ MicrosoftEntraIDConfig: options.MicrosoftEntraIDOptions{
190+ FederatedTokenAuth: ptr.Ptr(false),
191+ },
192+ ADFSConfig: options.ADFSOptions{
193+ SkipScope: ptr.Ptr(false),
194+ },
189195 LoginURLParameters: []options.LoginURLParameter{
190196 {Name: "approval_prompt", Default: []string{"force"}},
191197 },
@@ -254,7 +260,8 @@ redirect_url="http://localhost:4180/oauth2/callback"
254260 Expect(err).ToNot(HaveOccurred())
255261 }
256262 Expect(in.expectedOptions).ToNot(BeNil())
257− Expect(opts).To(EqualOpts(in.expectedOptions()))
263+ expectedOpts := in.expectedOptions()
264+ Expect(opts).To(EqualOpts(expectedOpts))
258265 },
259266 Entry("with legacy configuration", loadConfigurationTableInput{
260267 configContent: testCoreConfig + testLegacyConfig,
pkg/middleware/headers.go+2−1
@@ -9,6 +9,7 @@ import (
99 middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
1010 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
1111 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/header"
12+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
1213)
1314
1415func NewRequestHeaderInjector(headers []options.Header) (alice.Constructor, error) {
@@ -27,7 +28,7 @@ func NewRequestHeaderInjector(headers []options.Header) (alice.Constructor, erro
2728func newStripHeaders(headers []options.Header) alice.Constructor {
2829 headersToStrip := []options.Header{}
2930 for _, header := range headers {
30− if !(*header.PreserveRequestValue) {
31+ if !ptr.Deref(header.PreserveRequestValue, false) {
3132 headersToStrip = append(headersToStrip, header)
3233 }
3334 }
pkg/upstream/http.go+4−4
@@ -54,7 +54,7 @@ func newHTTPUpstreamProxy(upstream options.Upstream, u *url.URL, sigData *option
5454
5555 // Set up a WebSocket proxy if required
5656 var wsProxy http.Handler
57− if *upstream.ProxyWebSockets {
57+ if ptr.Deref(upstream.ProxyWebSockets, false) {
5858 wsProxy = newWebSocketReverseProxy(u, upstream.InsecureSkipTLSVerify)
5959 }
6060
@@ -150,14 +150,14 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr
150150
151151 // InsecureSkipVerify is a configurable option we allow
152152 /* #nosec G402 */
153− if *upstream.InsecureSkipTLSVerify {
153+ if ptr.Deref(upstream.InsecureSkipTLSVerify, false) {
154154 transport.TLSClientConfig.InsecureSkipVerify = true
155155 }
156156
157157 // Ensure we always pass the original request path
158158 setProxyDirector(proxy)
159159
160− if upstream.PassHostHeader != nil && !(*upstream.PassHostHeader) {
160+ if !ptr.Deref(upstream.PassHostHeader, false) {
161161 setProxyUpstreamHostHeader(proxy, target)
162162 }
163163
@@ -169,7 +169,7 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr
169169
170170 // Pass on DisableKeepAlives to the transport settings
171171 // to allow for disabling HTTP keep-alive connections
172− transport.DisableKeepAlives = *upstream.DisableKeepAlives
172+ transport.DisableKeepAlives = ptr.Deref(upstream.DisableKeepAlives, false)
173173
174174 // Apply the customized transport to our proxy before returning it
175175 proxy.Transport = transport
pkg/upstream/proxy.go+4−3
@@ -14,6 +14,7 @@ import (
1414 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
1515 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/app/pagewriter"
1616 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
17+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
1718)
1819
1920// ProxyErrorHandler is a function that will be used to render error pages when
@@ -27,12 +28,12 @@ func NewProxy(upstreams options.UpstreamConfig, sigData *options.SignatureData,
2728 serveMux: mux.NewRouter(),
2829 }
2930
30− if *upstreams.ProxyRawPath {
31+ if ptr.Deref(upstreams.ProxyRawPath, false) {
3132 m.serveMux.UseEncodedPath()
3233 }
3334
3435 for _, upstream := range sortByPathLongest(upstreams.Upstreams) {
35− if *upstream.Static {
36+ if ptr.Deref(upstream.Static, false) {
3637 if err := m.registerStaticResponseHandler(upstream, writer); err != nil {
3738 return nil, fmt.Errorf("could not register static upstream %q: %v", upstream.ID, err)
3839 }
@@ -74,7 +75,7 @@ func (m *multiUpstreamProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request
7475
7576// registerStaticResponseHandler registers a static response handler with at the given path.
7677func (m *multiUpstreamProxy) registerStaticResponseHandler(upstream options.Upstream, writer pagewriter.Writer) error {
77− logger.Printf("mapping path %q => static response %d", upstream.Path, derefStaticCode(upstream.StaticCode))
78+ logger.Printf("mapping path %q => static response %d", upstream.Path, ptr.Deref(upstream.StaticCode, 200))
7879 return m.registerHandler(upstream, newStaticResponseHandler(upstream.ID, upstream.StaticCode), writer)
7980}
8081
pkg/upstream/static.go+2−11
@@ -6,15 +6,14 @@ import (
66
77 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
88 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
9+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
910)
1011
11−const defaultStaticResponseCode = 200
12−
1312// newStaticResponseHandler creates a new staticResponseHandler that serves a
1413// a static response code.
1514func newStaticResponseHandler(upstream string, code *int) http.Handler {
1615 return &staticResponseHandler{
17− code: derefStaticCode(code),
16+ code: ptr.Deref(code, 200),
1817 upstream: upstream,
1918 }
2019}
@@ -38,11 +37,3 @@ func (s *staticResponseHandler) ServeHTTP(rw http.ResponseWriter, req *http.Requ
3837 logger.Errorf("Error writing static response: %v", err)
3938 }
4039}
41−
42−// derefStaticCode returns the derefenced value, or the default if the value is nil
43−func derefStaticCode(code *int) int {
44− if code != nil {
45− return *code
46− }
47− return defaultStaticResponseCode
48−}
pkg/validation/options.go+2−1
@@ -15,6 +15,7 @@ import (
1515 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
1616 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
1717 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
18+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
1819)
1920
2021// Validate checks that required options are set and validates those that they
@@ -34,7 +35,7 @@ func Validate(o *options.Options) error {
3435 transport := requests.DefaultTransport.(*http.Transport)
3536 transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow
3637 } else if len(o.Providers[0].CAFiles) > 0 {
37− pool, err := util.GetCertPool(o.Providers[0].CAFiles, *o.Providers[0].UseSystemTrustStore)
38+ pool, err := util.GetCertPool(o.Providers[0].CAFiles, ptr.Deref(o.Providers[0].UseSystemTrustStore, false))
3839 if err == nil {
3940 transport := requests.DefaultTransport.(*http.Transport)
4041 transport.TLSClientConfig = &tls.Config{
pkg/validation/providers.go+6−5
@@ -5,6 +5,7 @@ import (
55 "os"
66
77 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
8+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
89)
910
1011// validateProviders is the initial validation migration for multiple providrers
@@ -64,7 +65,7 @@ func validateProvider(provider options.Provider, providerIDs map[string]struct{}
6465// providerRequiresClientSecret checks if provider requires client secret to be set
6566// or it can be omitted in favor of JWT token to authenticate oAuth client
6667func providerRequiresClientSecret(provider options.Provider) bool {
67− if provider.Type == "entra-id" && *provider.MicrosoftEntraIDConfig.FederatedTokenAuth {
68+ if provider.Type == "entra-id" && ptr.Deref(provider.MicrosoftEntraIDConfig.FederatedTokenAuth, false) {
6869 return false
6970 }
7071
@@ -96,9 +97,9 @@ func validateGoogleConfig(provider options.Provider) []string {
9697
9798 hasAdminEmail := provider.GoogleConfig.AdminEmail != ""
9899 hasSAJSON := provider.GoogleConfig.ServiceAccountJSON != ""
99− useADC := provider.GoogleConfig.UseApplicationDefaultCredentials
100+ useADC := ptr.Deref(provider.GoogleConfig.UseApplicationDefaultCredentials, false)
100101
101− if !hasAdminEmail && !hasSAJSON && !(*useADC) {
102+ if !hasAdminEmail && !hasSAJSON && !useADC {
102103 return msgs
103104 }
104105
@@ -107,7 +108,7 @@ func validateGoogleConfig(provider options.Provider) []string {
107108 }
108109
109110 _, err := os.Stat(provider.GoogleConfig.ServiceAccountJSON)
110− if !(*useADC) {
111+ if !useADC {
111112 if !hasSAJSON {
112113 msgs = append(msgs, "missing setting: google-service-account-json or google-use-application-default-credentials")
113114 } else if err != nil {
@@ -123,7 +124,7 @@ func validateGoogleConfig(provider options.Provider) []string {
123124func validateEntraConfig(provider options.Provider) []string {
124125 msgs := []string{}
125126
126− if *provider.MicrosoftEntraIDConfig.FederatedTokenAuth {
127+ if ptr.Deref(provider.MicrosoftEntraIDConfig.FederatedTokenAuth, false) {
127128 federatedTokenPath := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")
128129
129130 if federatedTokenPath == "" {
pkg/validation/upstreams.go+9−8
@@ -5,6 +5,7 @@ import (
55 "net/url"
66
77 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
8+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
89)
910
1011func validateUpstreams(upstreams options.UpstreamConfig) []string {
@@ -54,28 +55,28 @@ func validateUpstream(upstream options.Upstream, ids, paths map[string]struct{})
5455func validateStaticUpstream(upstream options.Upstream) []string {
5556 msgs := []string{}
5657
57− if !(*upstream.Static) && upstream.StaticCode != nil {
58+ if !ptr.Deref(upstream.Static, false) && upstream.StaticCode != nil {
5859 msgs = append(msgs, fmt.Sprintf("upstream %q has staticCode (%d), but is not a static upstream, set 'static' for a static response", upstream.ID, *upstream.StaticCode))
5960 }
6061
6162 // Checks after this only make sense when the upstream is static
62− if !(*upstream.Static) {
63+ if !ptr.Deref(upstream.Static, false) {
6364 return msgs
6465 }
6566
6667 if upstream.URI != "" {
6768 msgs = append(msgs, fmt.Sprintf("upstream %q has uri, but is a static upstream, this will have no effect.", upstream.ID))
6869 }
69− if *upstream.InsecureSkipTLSVerify {
70+ if ptr.Deref(upstream.InsecureSkipTLSVerify, false) {
7071 msgs = append(msgs, fmt.Sprintf("upstream %q has insecureSkipTLSVerify, but is a static upstream, this will have no effect.", upstream.ID))
7172 }
72− if upstream.FlushInterval != nil && *upstream.FlushInterval != options.DefaultUpstreamFlushInterval {
73+ if ptr.Deref(upstream.FlushInterval, options.DefaultUpstreamFlushInterval) != options.DefaultUpstreamFlushInterval {
7374 msgs = append(msgs, fmt.Sprintf("upstream %q has flushInterval, but is a static upstream, this will have no effect.", upstream.ID))
7475 }
75− if *upstream.PassHostHeader {
76+ if ptr.Deref(upstream.PassHostHeader, false) {
7677 msgs = append(msgs, fmt.Sprintf("upstream %q has passHostHeader, but is a static upstream, this will have no effect.", upstream.ID))
7778 }
78− if *upstream.ProxyWebSockets {
79+ if ptr.Deref(upstream.ProxyWebSockets, false) {
7980 msgs = append(msgs, fmt.Sprintf("upstream %q has proxyWebSockets, but is a static upstream, this will have no effect.", upstream.ID))
8081 }
8182
@@ -85,13 +86,13 @@ func validateStaticUpstream(upstream options.Upstream) []string {
8586func validateUpstreamURI(upstream options.Upstream) []string {
8687 msgs := []string{}
8788
88− if !(*upstream.Static) && upstream.URI == "" {
89+ if !ptr.Deref(upstream.Static, false) && upstream.URI == "" {
8990 msgs = append(msgs, fmt.Sprintf("upstream %q has empty uri: uris are required for all non-static upstreams", upstream.ID))
9091 return msgs
9192 }
9293
9394 // Checks after this only make sense the upstream is not static
94− if *upstream.Static {
95+ if !ptr.Deref(upstream.Static, false) {
9596 return msgs
9697 }
9798
providers/adfs.go+2−1
@@ -8,6 +8,7 @@ import (
88
99 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
1010 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
11+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
1112)
1213
1314// ADFSProvider represents an ADFS based Identity Provider
@@ -50,7 +51,7 @@ func NewADFSProvider(p *ProviderData, opts options.Provider) *ADFSProvider {
5051
5152 return &ADFSProvider{
5253 OIDCProvider: oidcProvider,
53− skipScope: *opts.ADFSConfig.SkipScope,
54+ skipScope: ptr.Deref(opts.ADFSConfig.SkipScope, false),
5455 oidcEnrichFunc: oidcProvider.EnrichSession,
5556 oidcRefreshFunc: oidcProvider.RefreshSession,
5657 }
providers/google.go+4−5
@@ -19,6 +19,7 @@ import (
1919 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
2020 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
2121 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
22+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
2223 "golang.org/x/oauth2"
2324 "golang.org/x/oauth2/google"
2425 admin "google.golang.org/api/admin/directory/v1"
@@ -108,9 +109,7 @@ func NewGoogleProvider(p *ProviderData, opts options.GoogleOptions) (*GoogleProv
108109 },
109110 }
110111
111− if opts.UseOrganizationID || opts.ServiceAccountJSON != "" || *opts.UseApplicationDefaultCredentials {
112− provider.configureGroups(opts)
113−
112+ if opts.UseOrganizationID || opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, false) {
114113 // reuse admin service to avoid multiple calls for token
115114 var adminService *admin.Service
116115
@@ -133,7 +132,7 @@ func NewGoogleProvider(p *ProviderData, opts options.GoogleOptions) (*GoogleProv
133132 }
134133 }
135134
136− if opts.ServiceAccountJSON != "" || opts.UseApplicationDefaultCredentials {
135+ if opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, false) {
137136 if adminService == nil {
138137 adminService = getAdminService(opts)
139138 }
@@ -305,7 +304,7 @@ var possibleScopesList = [...]string{
305304}
306305
307306func getOauth2TokenSource(ctx context.Context, opts options.GoogleOptions, scope string) oauth2.TokenSource {
308− if *opts.UseApplicationDefaultCredentials {
307+ if ptr.Deref(opts.UseApplicationDefaultCredentials, false) {
309308 ts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{
310309 TargetPrincipal: getTargetPrincipal(ctx, opts),
311310 Scopes: strings.Split(scope, " "),
providers/ms_entra_id.go+2−1
@@ -16,6 +16,7 @@ import (
1616 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
1717 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
1818 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"
19+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
1920 "github.com/spf13/cast"
2021 "golang.org/x/oauth2"
2122)
@@ -51,7 +52,7 @@ func NewMicrosoftEntraIDProvider(p *ProviderData, opts options.Provider) *Micros
5152 OIDCProvider: NewOIDCProvider(p, opts.OIDCConfig),
5253
5354 multiTenantAllowedTenants: opts.MicrosoftEntraIDConfig.AllowedTenants,
54− federatedTokenAuth: *opts.MicrosoftEntraIDConfig.FederatedTokenAuth,
55+ federatedTokenAuth: ptr.Deref(opts.MicrosoftEntraIDConfig.FederatedTokenAuth, false),
5556 microsoftGraphURL: microsoftGraphURL,
5657 }
5758}
providers/oidc.go+2−1
@@ -12,6 +12,7 @@ import (
1212 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
1313 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
1414 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
15+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
1516 "golang.org/x/oauth2"
1617)
1718
@@ -50,7 +51,7 @@ func NewOIDCProvider(p *ProviderData, opts options.OIDCOptions) *OIDCProvider {
5051
5152 return &OIDCProvider{
5253 ProviderData: p,
53− SkipNonce: *opts.InsecureSkipNonce,
54+ SkipNonce: ptr.Deref(opts.InsecureSkipNonce, false),
5455 }
5556}
5657
providers/providers.go+5−4
@@ -9,6 +9,7 @@ import (
99 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
1010 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
1111 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"
12+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
1213 k8serrors "k8s.io/apimachinery/pkg/util/errors"
1314)
1415
@@ -98,8 +99,8 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
9899 IssuerURL: providerConfig.OIDCConfig.IssuerURL,
99100 JWKsURL: providerConfig.OIDCConfig.JwksURL,
100101 PublicKeyFiles: providerConfig.OIDCConfig.PublicKeyFiles,
101− SkipDiscovery: *providerConfig.OIDCConfig.SkipDiscovery,
102− SkipIssuerVerification: *providerConfig.OIDCConfig.InsecureSkipIssuerVerification,
102+ SkipDiscovery: ptr.Deref(providerConfig.OIDCConfig.SkipDiscovery, false),
103+ SkipIssuerVerification: ptr.Deref(providerConfig.OIDCConfig.InsecureSkipIssuerVerification, false),
103104 })
104105 if err != nil {
105106 return nil, fmt.Errorf("error building OIDC ProviderVerifier: %v", err)
@@ -143,10 +144,10 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,
143144 }
144145
145146 // Make the OIDC options available to all providers that support it
146− p.AllowUnverifiedEmail = *providerConfig.OIDCConfig.InsecureAllowUnverifiedEmail
147+ p.AllowUnverifiedEmail = ptr.Deref(providerConfig.OIDCConfig.InsecureAllowUnverifiedEmail, false)
147148 p.EmailClaim = providerConfig.OIDCConfig.EmailClaim
148149 p.GroupsClaim = providerConfig.OIDCConfig.GroupsClaim
149− p.SkipClaimsFromProfileURL = *providerConfig.SkipClaimsFromProfileURL
150+ p.SkipClaimsFromProfileURL = ptr.Deref(providerConfig.SkipClaimsFromProfileURL, false)
150151
151152 // Set PKCE enabled or disabled based on discovery and force options
152153 p.CodeChallengeMethod = parseCodeChallengeMethod(providerConfig)