ceb9a38 · typeable/oauth2-proxy

main.go+5−2

@@ -75,11 +75,14 @@ func loadConfiguration(config, yamlConfig string, extraFlags *pflag.FlagSet, arg

75

76 if yamlConfig != "" {

77 logger.Printf("WARNING: You are using alpha configuration. The structure in this configuration file may change without notice. You MUST remove conflicting options from your existing configuration.")

78− return loadYamlOptions(yamlConfig, config, extraFlags, args)

78+ opts, err = loadYamlOptions(yamlConfig, config, extraFlags, args)

79+ if err != nil {

80+ return nil, fmt.Errorf("failed to load yaml options: %w", err)

81+ }

79 }

82 }

80

83

84+ // Ensure defaults after loading configuration

81 opts.EnsureDefaults()

85 opts.EnsureDefaults()

82−

83 return opts, nil

86 return opts, nil

84}

87}

85

88

main_test.go+12−5

@@ -123,6 +123,7 @@ redirect_url="http://localhost:4180/oauth2/callback"

123 opts.RawRedirectURL = "http://localhost:4180/oauth2/callback"

124

125 opts.UpstreamServers = options.UpstreamConfig{

126+ ProxyRawPath: ptr.Ptr(false),

126 Upstreams: []options.Upstream{

127 Upstreams: []options.Upstream{

127 {

128 {

128 ID: "/",

129 ID: "/",

@@ -132,6 +133,7 @@ redirect_url="http://localhost:4180/oauth2/callback"

132 PassHostHeader: ptr.Ptr(true),

133 PassHostHeader: ptr.Ptr(true),

133 ProxyWebSockets: ptr.Ptr(true),

134 ProxyWebSockets: ptr.Ptr(true),

134 Timeout: ptr.Ptr(options.DefaultUpstreamTimeout),

135 Timeout: ptr.Ptr(options.DefaultUpstreamTimeout),

136+ Static: ptr.Ptr(false),

135 InsecureSkipTLSVerify: ptr.Ptr(false),

137 InsecureSkipTLSVerify: ptr.Ptr(false),

136 DisableKeepAlives: ptr.Ptr(false),

138 DisableKeepAlives: ptr.Ptr(false),

137 },

139 },

@@ -139,7 +141,8 @@ redirect_url="http://localhost:4180/oauth2/callback"

139 }

141 }

140

142

141 authHeader := options.Header{

143 authHeader := options.Header{

142− Name: "Authorization",

144+ Name: "Authorization",

145+ PreserveRequestValue: ptr.Ptr(false),

143 Values: []options.HeaderValue{

146 Values: []options.HeaderValue{

144 {

147 {

145 ClaimSource: &options.ClaimSource{

148 ClaimSource: &options.ClaimSource{

@@ -153,10 +156,7 @@ redirect_url="http://localhost:4180/oauth2/callback"

153 },

156 },

154 }

157 }

155

158

156− authHeader.PreserveRequestValue = ptr.Ptr(false)

157 opts.InjectRequestHeaders = append([]options.Header{authHeader}, opts.InjectRequestHeaders...)

159 opts.InjectRequestHeaders = append([]options.Header{authHeader}, opts.InjectRequestHeaders...)

158−

159− authHeader.PreserveRequestValue = nil

160 opts.InjectResponseHeaders = append(opts.InjectResponseHeaders, authHeader)

161

162 opts.Providers = options.Providers{

@@ -186,6 +186,12 @@ redirect_url="http://localhost:4180/oauth2/callback"

186 InsecureSkipIssuerVerification: ptr.Ptr(false),

187 SkipDiscovery: ptr.Ptr(false),

188 },

189+ MicrosoftEntraIDConfig: options.MicrosoftEntraIDOptions{

190+ FederatedTokenAuth: ptr.Ptr(false),

191+ },

192+ ADFSConfig: options.ADFSOptions{

193+ SkipScope: ptr.Ptr(false),

194+ },

189 LoginURLParameters: []options.LoginURLParameter{

195 LoginURLParameters: []options.LoginURLParameter{

190 {Name: "approval_prompt", Default: []string{"force"}},

196 {Name: "approval_prompt", Default: []string{"force"}},

191 },

197 },

@@ -254,7 +260,8 @@ redirect_url="http://localhost:4180/oauth2/callback"

254 Expect(err).ToNot(HaveOccurred())

260 Expect(err).ToNot(HaveOccurred())

255 }

261 }

256 Expect(in.expectedOptions).ToNot(BeNil())

262 Expect(in.expectedOptions).ToNot(BeNil())

263+ expectedOpts := in.expectedOptions()

257− Expect(opts).To(EqualOpts(in.expectedOptions()))

264+ Expect(opts).To(EqualOpts(expectedOpts))

258 },

265 },

259 Entry("with legacy configuration", loadConfigurationTableInput{

266 Entry("with legacy configuration", loadConfigurationTableInput{

260 configContent: testCoreConfig + testLegacyConfig,

267 configContent: testCoreConfig + testLegacyConfig,

pkg/middleware/headers.go+2−1

@@ -9,6 +9,7 @@ import (

9 middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"

10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

11 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/header"

12+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

12)

13)

13

14

14func NewRequestHeaderInjector(headers []options.Header) (alice.Constructor, error) {

15func NewRequestHeaderInjector(headers []options.Header) (alice.Constructor, error) {

@@ -27,7 +28,7 @@ func NewRequestHeaderInjector(headers []options.Header) (alice.Constructor, erro

27func newStripHeaders(headers []options.Header) alice.Constructor {

28func newStripHeaders(headers []options.Header) alice.Constructor {

28 headersToStrip := []options.Header{}

29 headersToStrip := []options.Header{}

29 for _, header := range headers {

30 for _, header := range headers {

30− if !(*header.PreserveRequestValue) {

31+ if !ptr.Deref(header.PreserveRequestValue, false) {

31 headersToStrip = append(headersToStrip, header)

32 headersToStrip = append(headersToStrip, header)

32 }

33 }

34 }

pkg/upstream/http.go+4−4

@@ -54,7 +54,7 @@ func newHTTPUpstreamProxy(upstream options.Upstream, u *url.URL, sigData *option

54

55 // Set up a WebSocket proxy if required

56 var wsProxy http.Handler

57− if *upstream.ProxyWebSockets {

57+ if ptr.Deref(upstream.ProxyWebSockets, false) {

58 wsProxy = newWebSocketReverseProxy(u, upstream.InsecureSkipTLSVerify)

59 }

60

@@ -150,14 +150,14 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr

150

151 // InsecureSkipVerify is a configurable option we allow

152 /* #nosec G402 */

153− if *upstream.InsecureSkipTLSVerify {

153+ if ptr.Deref(upstream.InsecureSkipTLSVerify, false) {

154 transport.TLSClientConfig.InsecureSkipVerify = true

155 }

156

157 // Ensure we always pass the original request path

158 setProxyDirector(proxy)

159

160− if upstream.PassHostHeader != nil && !(*upstream.PassHostHeader) {

160+ if !ptr.Deref(upstream.PassHostHeader, false) {

161 setProxyUpstreamHostHeader(proxy, target)

162 }

163

@@ -169,7 +169,7 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr

169

170 // Pass on DisableKeepAlives to the transport settings

171 // to allow for disabling HTTP keep-alive connections

172− transport.DisableKeepAlives = *upstream.DisableKeepAlives

172+ transport.DisableKeepAlives = ptr.Deref(upstream.DisableKeepAlives, false)

173

174 // Apply the customized transport to our proxy before returning it

175 proxy.Transport = transport

pkg/upstream/proxy.go+4−3

@@ -14,6 +14,7 @@ import (

14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

15 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/app/pagewriter"

16 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

17+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

17)

18)

18

19

19// ProxyErrorHandler is a function that will be used to render error pages when

20// ProxyErrorHandler is a function that will be used to render error pages when

@@ -27,12 +28,12 @@ func NewProxy(upstreams options.UpstreamConfig, sigData *options.SignatureData,

27 serveMux: mux.NewRouter(),

28 serveMux: mux.NewRouter(),

28 }

29 }

29

30

30− if *upstreams.ProxyRawPath {

31+ if ptr.Deref(upstreams.ProxyRawPath, false) {

31 m.serveMux.UseEncodedPath()

32 m.serveMux.UseEncodedPath()

32 }

33 }

33

34

34 for _, upstream := range sortByPathLongest(upstreams.Upstreams) {

35 for _, upstream := range sortByPathLongest(upstreams.Upstreams) {

35− if *upstream.Static {

36+ if ptr.Deref(upstream.Static, false) {

36 if err := m.registerStaticResponseHandler(upstream, writer); err != nil {

37 if err := m.registerStaticResponseHandler(upstream, writer); err != nil {

37 return nil, fmt.Errorf("could not register static upstream %q: %v", upstream.ID, err)

38 return nil, fmt.Errorf("could not register static upstream %q: %v", upstream.ID, err)

38 }

39 }

@@ -74,7 +75,7 @@ func (m *multiUpstreamProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request

74

75

75// registerStaticResponseHandler registers a static response handler with at the given path.

76// registerStaticResponseHandler registers a static response handler with at the given path.

76func (m *multiUpstreamProxy) registerStaticResponseHandler(upstream options.Upstream, writer pagewriter.Writer) error {

77func (m *multiUpstreamProxy) registerStaticResponseHandler(upstream options.Upstream, writer pagewriter.Writer) error {

77− logger.Printf("mapping path %q => static response %d", upstream.Path, derefStaticCode(upstream.StaticCode))

78+ logger.Printf("mapping path %q => static response %d", upstream.Path, ptr.Deref(upstream.StaticCode, 200))

78 return m.registerHandler(upstream, newStaticResponseHandler(upstream.ID, upstream.StaticCode), writer)

79 return m.registerHandler(upstream, newStaticResponseHandler(upstream.ID, upstream.StaticCode), writer)

79}

80}

80

81

pkg/upstream/static.go+2−11

@@ -6,15 +6,14 @@ import (

6

7 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"

8 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

9+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

9)

10)

10

11

11−const defaultStaticResponseCode = 200

12−

13// newStaticResponseHandler creates a new staticResponseHandler that serves a

12// newStaticResponseHandler creates a new staticResponseHandler that serves a

14// a static response code.

13// a static response code.

15func newStaticResponseHandler(upstream string, code *int) http.Handler {

14func newStaticResponseHandler(upstream string, code *int) http.Handler {

16 return &staticResponseHandler{

15 return &staticResponseHandler{

17− code: derefStaticCode(code),

16+ code: ptr.Deref(code, 200),

18 upstream: upstream,

17 upstream: upstream,

19 }

18 }

20}

19}

@@ -38,11 +37,3 @@ func (s *staticResponseHandler) ServeHTTP(rw http.ResponseWriter, req *http.Requ

38 logger.Errorf("Error writing static response: %v", err)

37 logger.Errorf("Error writing static response: %v", err)

39 }

38 }

40}

39}

41−

42−// derefStaticCode returns the derefenced value, or the default if the value is nil

43−func derefStaticCode(code *int) int {

44− if code != nil {

45− return *code

46− }

47− return defaultStaticResponseCode

48−}

pkg/validation/options.go+2−1

@@ -15,6 +15,7 @@ import (

15 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"

16 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

17 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"

18+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

18)

19)

19

20

20// Validate checks that required options are set and validates those that they

21// Validate checks that required options are set and validates those that they

@@ -34,7 +35,7 @@ func Validate(o *options.Options) error {

34 transport := requests.DefaultTransport.(*http.Transport)

35 transport := requests.DefaultTransport.(*http.Transport)

35 transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow

36 transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} // #nosec G402 -- InsecureSkipVerify is a configurable option we allow

36 } else if len(o.Providers[0].CAFiles) > 0 {

37 } else if len(o.Providers[0].CAFiles) > 0 {

37− pool, err := util.GetCertPool(o.Providers[0].CAFiles, *o.Providers[0].UseSystemTrustStore)

38+ pool, err := util.GetCertPool(o.Providers[0].CAFiles, ptr.Deref(o.Providers[0].UseSystemTrustStore, false))

38 if err == nil {

39 if err == nil {

39 transport := requests.DefaultTransport.(*http.Transport)

40 transport := requests.DefaultTransport.(*http.Transport)

40 transport.TLSClientConfig = &tls.Config{

41 transport.TLSClientConfig = &tls.Config{

pkg/validation/providers.go+6−5

@@ -5,6 +5,7 @@ import (

5 "os"

6

7 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

8+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

8)

9)

9

10

10// validateProviders is the initial validation migration for multiple providrers

11// validateProviders is the initial validation migration for multiple providrers

@@ -64,7 +65,7 @@ func validateProvider(provider options.Provider, providerIDs map[string]struct{}

64// providerRequiresClientSecret checks if provider requires client secret to be set

65// providerRequiresClientSecret checks if provider requires client secret to be set

65// or it can be omitted in favor of JWT token to authenticate oAuth client

66// or it can be omitted in favor of JWT token to authenticate oAuth client

66func providerRequiresClientSecret(provider options.Provider) bool {

67func providerRequiresClientSecret(provider options.Provider) bool {

67− if provider.Type == "entra-id" && *provider.MicrosoftEntraIDConfig.FederatedTokenAuth {

68+ if provider.Type == "entra-id" && ptr.Deref(provider.MicrosoftEntraIDConfig.FederatedTokenAuth, false) {

68 return false

69 return false

69 }

70 }

70

71

@@ -96,9 +97,9 @@ func validateGoogleConfig(provider options.Provider) []string {

96

97

97 hasAdminEmail := provider.GoogleConfig.AdminEmail != ""

98 hasAdminEmail := provider.GoogleConfig.AdminEmail != ""

98 hasSAJSON := provider.GoogleConfig.ServiceAccountJSON != ""

99 hasSAJSON := provider.GoogleConfig.ServiceAccountJSON != ""

99− useADC := provider.GoogleConfig.UseApplicationDefaultCredentials

100+ useADC := ptr.Deref(provider.GoogleConfig.UseApplicationDefaultCredentials, false)

100

101

101− if !hasAdminEmail && !hasSAJSON && !(*useADC) {

102+ if !hasAdminEmail && !hasSAJSON && !useADC {

102 return msgs

103 return msgs

103 }

104 }

104

105

@@ -107,7 +108,7 @@ func validateGoogleConfig(provider options.Provider) []string {

107 }

108 }

108

109

109 _, err := os.Stat(provider.GoogleConfig.ServiceAccountJSON)

110 _, err := os.Stat(provider.GoogleConfig.ServiceAccountJSON)

110− if !(*useADC) {

111+ if !useADC {

111 if !hasSAJSON {

112 if !hasSAJSON {

112 msgs = append(msgs, "missing setting: google-service-account-json or google-use-application-default-credentials")

113 msgs = append(msgs, "missing setting: google-service-account-json or google-use-application-default-credentials")

113 } else if err != nil {

114 } else if err != nil {

@@ -123,7 +124,7 @@ func validateGoogleConfig(provider options.Provider) []string {

123func validateEntraConfig(provider options.Provider) []string {

124func validateEntraConfig(provider options.Provider) []string {

124 msgs := []string{}

125 msgs := []string{}

125

126

126− if *provider.MicrosoftEntraIDConfig.FederatedTokenAuth {

127+ if ptr.Deref(provider.MicrosoftEntraIDConfig.FederatedTokenAuth, false) {

127 federatedTokenPath := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")

128 federatedTokenPath := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")

128

129

129 if federatedTokenPath == "" {

130 if federatedTokenPath == "" {

pkg/validation/upstreams.go+9−8

@@ -5,6 +5,7 @@ import (

5 "net/url"

6

7 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

8+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

8)

9)

9

10

10func validateUpstreams(upstreams options.UpstreamConfig) []string {

11func validateUpstreams(upstreams options.UpstreamConfig) []string {

@@ -54,28 +55,28 @@ func validateUpstream(upstream options.Upstream, ids, paths map[string]struct{})

54func validateStaticUpstream(upstream options.Upstream) []string {

55func validateStaticUpstream(upstream options.Upstream) []string {

55 msgs := []string{}

56 msgs := []string{}

56

57

57− if !(*upstream.Static) && upstream.StaticCode != nil {

58+ if !ptr.Deref(upstream.Static, false) && upstream.StaticCode != nil {

58 msgs = append(msgs, fmt.Sprintf("upstream %q has staticCode (%d), but is not a static upstream, set 'static' for a static response", upstream.ID, *upstream.StaticCode))

59 msgs = append(msgs, fmt.Sprintf("upstream %q has staticCode (%d), but is not a static upstream, set 'static' for a static response", upstream.ID, *upstream.StaticCode))

59 }

60 }

60

61

61 // Checks after this only make sense when the upstream is static

62 // Checks after this only make sense when the upstream is static

62− if !(*upstream.Static) {

63+ if !ptr.Deref(upstream.Static, false) {

63 return msgs

64 return msgs

64 }

65 }

65

66

66 if upstream.URI != "" {

67 if upstream.URI != "" {

67 msgs = append(msgs, fmt.Sprintf("upstream %q has uri, but is a static upstream, this will have no effect.", upstream.ID))

68 msgs = append(msgs, fmt.Sprintf("upstream %q has uri, but is a static upstream, this will have no effect.", upstream.ID))

68 }

69 }

69− if *upstream.InsecureSkipTLSVerify {

70+ if ptr.Deref(upstream.InsecureSkipTLSVerify, false) {

70 msgs = append(msgs, fmt.Sprintf("upstream %q has insecureSkipTLSVerify, but is a static upstream, this will have no effect.", upstream.ID))

71 msgs = append(msgs, fmt.Sprintf("upstream %q has insecureSkipTLSVerify, but is a static upstream, this will have no effect.", upstream.ID))

71 }

72 }

72− if upstream.FlushInterval != nil && *upstream.FlushInterval != options.DefaultUpstreamFlushInterval {

73+ if ptr.Deref(upstream.FlushInterval, options.DefaultUpstreamFlushInterval) != options.DefaultUpstreamFlushInterval {

73 msgs = append(msgs, fmt.Sprintf("upstream %q has flushInterval, but is a static upstream, this will have no effect.", upstream.ID))

74 msgs = append(msgs, fmt.Sprintf("upstream %q has flushInterval, but is a static upstream, this will have no effect.", upstream.ID))

74 }

75 }

75− if *upstream.PassHostHeader {

76+ if ptr.Deref(upstream.PassHostHeader, false) {

76 msgs = append(msgs, fmt.Sprintf("upstream %q has passHostHeader, but is a static upstream, this will have no effect.", upstream.ID))

77 msgs = append(msgs, fmt.Sprintf("upstream %q has passHostHeader, but is a static upstream, this will have no effect.", upstream.ID))

77 }

78 }

78− if *upstream.ProxyWebSockets {

79+ if ptr.Deref(upstream.ProxyWebSockets, false) {

79 msgs = append(msgs, fmt.Sprintf("upstream %q has proxyWebSockets, but is a static upstream, this will have no effect.", upstream.ID))

80 msgs = append(msgs, fmt.Sprintf("upstream %q has proxyWebSockets, but is a static upstream, this will have no effect.", upstream.ID))

80 }

81 }

81

82

@@ -85,13 +86,13 @@ func validateStaticUpstream(upstream options.Upstream) []string {

85func validateUpstreamURI(upstream options.Upstream) []string {

86func validateUpstreamURI(upstream options.Upstream) []string {

86 msgs := []string{}

87 msgs := []string{}

87

88

88− if !(*upstream.Static) && upstream.URI == "" {

89+ if !ptr.Deref(upstream.Static, false) && upstream.URI == "" {

89 msgs = append(msgs, fmt.Sprintf("upstream %q has empty uri: uris are required for all non-static upstreams", upstream.ID))

90 msgs = append(msgs, fmt.Sprintf("upstream %q has empty uri: uris are required for all non-static upstreams", upstream.ID))

90 return msgs

91 return msgs

91 }

92 }

92

93

93 // Checks after this only make sense the upstream is not static

94 // Checks after this only make sense the upstream is not static

94− if *upstream.Static {

95+ if !ptr.Deref(upstream.Static, false) {

95 return msgs

96 return msgs

96 }

97 }

97

98

providers/adfs.go+2−1

@@ -8,6 +8,7 @@ import (

8

9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"

10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

11+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

11)

12)

12

13

13// ADFSProvider represents an ADFS based Identity Provider

14// ADFSProvider represents an ADFS based Identity Provider

@@ -50,7 +51,7 @@ func NewADFSProvider(p *ProviderData, opts options.Provider) *ADFSProvider {

50

51

51 return &ADFSProvider{

52 return &ADFSProvider{

52 OIDCProvider: oidcProvider,

53 OIDCProvider: oidcProvider,

53− skipScope: *opts.ADFSConfig.SkipScope,

54+ skipScope: ptr.Deref(opts.ADFSConfig.SkipScope, false),

54 oidcEnrichFunc: oidcProvider.EnrichSession,

55 oidcEnrichFunc: oidcProvider.EnrichSession,

55 oidcRefreshFunc: oidcProvider.RefreshSession,

56 oidcRefreshFunc: oidcProvider.RefreshSession,

56 }

57 }

providers/google.go+4−5

@@ -19,6 +19,7 @@ import (

19 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

20 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

21 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

22+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

22 "golang.org/x/oauth2"

23 "golang.org/x/oauth2"

23 "golang.org/x/oauth2/google"

24 "golang.org/x/oauth2/google"

24 admin "google.golang.org/api/admin/directory/v1"

25 admin "google.golang.org/api/admin/directory/v1"

@@ -108,9 +109,7 @@ func NewGoogleProvider(p *ProviderData, opts options.GoogleOptions) (*GoogleProv

108 },

109 },

109 }

110 }

110

111

111− if opts.UseOrganizationID || opts.ServiceAccountJSON != "" || *opts.UseApplicationDefaultCredentials {

112+ if opts.UseOrganizationID || opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, false) {

112− provider.configureGroups(opts)

113−

114 // reuse admin service to avoid multiple calls for token

113 // reuse admin service to avoid multiple calls for token

115 var adminService *admin.Service

114 var adminService *admin.Service

116

115

@@ -133,7 +132,7 @@ func NewGoogleProvider(p *ProviderData, opts options.GoogleOptions) (*GoogleProv

133 }

132 }

134 }

133 }

135

134

136− if opts.ServiceAccountJSON != "" || opts.UseApplicationDefaultCredentials {

135+ if opts.ServiceAccountJSON != "" || ptr.Deref(opts.UseApplicationDefaultCredentials, false) {

137 if adminService == nil {

136 if adminService == nil {

138 adminService = getAdminService(opts)

137 adminService = getAdminService(opts)

139 }

138 }

@@ -305,7 +304,7 @@ var possibleScopesList = [...]string{

305}

304}

306

305

307func getOauth2TokenSource(ctx context.Context, opts options.GoogleOptions, scope string) oauth2.TokenSource {

306func getOauth2TokenSource(ctx context.Context, opts options.GoogleOptions, scope string) oauth2.TokenSource {

308− if *opts.UseApplicationDefaultCredentials {

307+ if ptr.Deref(opts.UseApplicationDefaultCredentials, false) {

309 ts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{

308 ts, err := impersonate.CredentialsTokenSource(ctx, impersonate.CredentialsConfig{

310 TargetPrincipal: getTargetPrincipal(ctx, opts),

309 TargetPrincipal: getTargetPrincipal(ctx, opts),

311 Scopes: strings.Split(scope, " "),

310 Scopes: strings.Split(scope, " "),

providers/ms_entra_id.go+2−1

@@ -16,6 +16,7 @@ import (

16 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

17 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

18 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util"

19+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

19 "github.com/spf13/cast"

20 "github.com/spf13/cast"

20 "golang.org/x/oauth2"

21 "golang.org/x/oauth2"

21)

22)

@@ -51,7 +52,7 @@ func NewMicrosoftEntraIDProvider(p *ProviderData, opts options.Provider) *Micros

51 OIDCProvider: NewOIDCProvider(p, opts.OIDCConfig),

52 OIDCProvider: NewOIDCProvider(p, opts.OIDCConfig),

52

53

53 multiTenantAllowedTenants: opts.MicrosoftEntraIDConfig.AllowedTenants,

54 multiTenantAllowedTenants: opts.MicrosoftEntraIDConfig.AllowedTenants,

54− federatedTokenAuth: *opts.MicrosoftEntraIDConfig.FederatedTokenAuth,

55+ federatedTokenAuth: ptr.Deref(opts.MicrosoftEntraIDConfig.FederatedTokenAuth, false),

55 microsoftGraphURL: microsoftGraphURL,

56 microsoftGraphURL: microsoftGraphURL,

56 }

57 }

57}

58}

providers/oidc.go+2−1

@@ -12,6 +12,7 @@ import (

12 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

14 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

15+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

15 "golang.org/x/oauth2"

16 "golang.org/x/oauth2"

16)

17)

17

18

@@ -50,7 +51,7 @@ func NewOIDCProvider(p *ProviderData, opts options.OIDCOptions) *OIDCProvider {

50

51

51 return &OIDCProvider{

52 return &OIDCProvider{

52 ProviderData: p,

53 ProviderData: p,

53− SkipNonce: *opts.InsecureSkipNonce,

54+ SkipNonce: ptr.Deref(opts.InsecureSkipNonce, false),

54 }

55 }

55}

56}

56

57

providers/providers.go+5−4

@@ -9,6 +9,7 @@ import (

9 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

10 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"

11 internaloidc "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/providers/oidc"

12+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"

12 k8serrors "k8s.io/apimachinery/pkg/util/errors"

13 k8serrors "k8s.io/apimachinery/pkg/util/errors"

13)

14)

14

15

@@ -98,8 +99,8 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,

98 IssuerURL: providerConfig.OIDCConfig.IssuerURL,

99 IssuerURL: providerConfig.OIDCConfig.IssuerURL,

99 JWKsURL: providerConfig.OIDCConfig.JwksURL,

100 JWKsURL: providerConfig.OIDCConfig.JwksURL,

100 PublicKeyFiles: providerConfig.OIDCConfig.PublicKeyFiles,

101 PublicKeyFiles: providerConfig.OIDCConfig.PublicKeyFiles,

101− SkipDiscovery: *providerConfig.OIDCConfig.SkipDiscovery,

102+ SkipDiscovery: ptr.Deref(providerConfig.OIDCConfig.SkipDiscovery, false),

102− SkipIssuerVerification: *providerConfig.OIDCConfig.InsecureSkipIssuerVerification,

103+ SkipIssuerVerification: ptr.Deref(providerConfig.OIDCConfig.InsecureSkipIssuerVerification, false),

103 })

104 })

104 if err != nil {

105 if err != nil {

105 return nil, fmt.Errorf("error building OIDC ProviderVerifier: %v", err)

106 return nil, fmt.Errorf("error building OIDC ProviderVerifier: %v", err)

@@ -143,10 +144,10 @@ func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData,

143 }

144 }

144

145

145 // Make the OIDC options available to all providers that support it

146 // Make the OIDC options available to all providers that support it

146− p.AllowUnverifiedEmail = *providerConfig.OIDCConfig.InsecureAllowUnverifiedEmail

147+ p.AllowUnverifiedEmail = ptr.Deref(providerConfig.OIDCConfig.InsecureAllowUnverifiedEmail, false)

147 p.EmailClaim = providerConfig.OIDCConfig.EmailClaim

148 p.EmailClaim = providerConfig.OIDCConfig.EmailClaim

148 p.GroupsClaim = providerConfig.OIDCConfig.GroupsClaim

149 p.GroupsClaim = providerConfig.OIDCConfig.GroupsClaim

149− p.SkipClaimsFromProfileURL = *providerConfig.SkipClaimsFromProfileURL

150+ p.SkipClaimsFromProfileURL = ptr.Deref(providerConfig.SkipClaimsFromProfileURL, false)

150

151

151 // Set PKCE enabled or disabled based on discovery and force options

152 // Set PKCE enabled or disabled based on discovery and force options

152 p.CodeChallengeMethod = parseCodeChallengeMethod(providerConfig)

153 p.CodeChallengeMethod = parseCodeChallengeMethod(providerConfig)