d2b1815 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

After authentication, redirect to original URI.

d2b1815Sean O'Connor13 years ago

oauthproxy.go+34−15

compare with master

unifiedsplit

@@ -67,13 +67,16 @@ func (p *OauthProxy) SetRedirectUrl(redirectUrl *url.URL) {

67 p.redirectUrl = redirectUrl

68}

70−func (p *OauthProxy) GetLoginURL() string {

70+func (p *OauthProxy) GetLoginURL(redirectUrl string) string {

71 params := url.Values{}

72 params.Add("redirect_uri", p.redirectUrl.String())

73 params.Add("approval_prompt", "force")

74 params.Add("scope", p.oauthScope)

75 params.Add("client_id", p.clientID)

76 params.Add("response_type", "code")

77+ if strings.HasPrefix(redirectUrl, "/") {

78+ params.Add("state", redirectUrl)

79+ }

77 return fmt.Sprintf("%s?%s", p.oauthLoginUrl, params.Encode())

80 return fmt.Sprintf("%s?%s", p.oauthLoginUrl, params.Encode())

78}

81}

@@ -100,6 +103,9 @@ func apiRequest(req *http.Request) (*simplejson.Json, error) {

100}

103}

101

104

102func (p *OauthProxy) redeemCode(code string) (string, error) {

105func (p *OauthProxy) redeemCode(code string) (string, error) {

106+ if code == "" {

107+ return "", errors.New("missing code")

108+ }

103 params := url.Values{}

109 params := url.Values{}

104 params.Add("redirect_uri", p.redirectUrl.String())

110 params.Add("redirect_uri", p.redirectUrl.String())

105 params.Add("client_id", p.clientID)

111 params.Add("client_id", p.clientID)

@@ -197,7 +203,6 @@ func (p *OauthProxy) ErrorPage(rw http.ResponseWriter, code int, title string, m

197}

203}

198

204

199func (p *OauthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code int) {

205func (p *OauthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code int) {

200− // TODO: capture state for which url to redirect to at the end

201 p.ClearCookie(rw, req)

206 p.ClearCookie(rw, req)

202 rw.WriteHeader(code)

207 rw.WriteHeader(code)

203 templates := getTemplates()

208 templates := getTemplates()

@@ -205,9 +210,11 @@ func (p *OauthProxy) SignInPage(rw http.ResponseWriter, req *http.Request, code

205 t := struct {

210 t := struct {

206 SignInMessage string

211 SignInMessage string

207 Htpasswd bool

212 Htpasswd bool

213+ Redirect string

208 }{

214 }{

209 SignInMessage: p.SignInMessage,

215 SignInMessage: p.SignInMessage,

210 Htpasswd: p.HtpasswdFile != nil,

216 Htpasswd: p.HtpasswdFile != nil,

217+ Redirect: req.URL.RequestURI(),

211 }

218 }

212 templates.ExecuteTemplate(rw, "sign_in.html", t)

219 templates.ExecuteTemplate(rw, "sign_in.html", t)

213}

220}

@@ -239,39 +246,46 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {

239

246

240 var ok bool

247 var ok bool

241 var user string

248 var user string

249+ redirect := req.FormValue("rd")

250+

251+ if redirect == "" {

252+ redirect = "/"

253+ }

254+

242 if req.URL.Path == signInPath {

255 if req.URL.Path == signInPath {

243 user, ok = p.ManualSignIn(rw, req)

256 user, ok = p.ManualSignIn(rw, req)

244 if ok {

257 if ok {

245 p.SetCookie(rw, req, user)

258 p.SetCookie(rw, req, user)

246− http.Redirect(rw, req, "/", 302)

259+ http.Redirect(rw, req, redirect, 302)

247 } else {

260 } else {

248 p.SignInPage(rw, req, 200)

261 p.SignInPage(rw, req, 200)

249 }

262 }

250 return

263 return

251 }

264 }

252 if req.URL.Path == oauthStartPath {

265 if req.URL.Path == oauthStartPath {

266+ // get the ?rd= value

267+ err := req.ParseForm()

268+ if err != nil {

269+ p.ErrorPage(rw, 500, "Internal Error", err.Error())

270+ return

271+ }

253− http.Redirect(rw, req, p.GetLoginURL(), 302)

272+ http.Redirect(rw, req, p.GetLoginURL(redirect), 302)

254 return

273 return

255 }

274 }

256 if req.URL.Path == oauthCallbackPath {

275 if req.URL.Path == oauthCallbackPath {

257 // finish the oauth cycle

276 // finish the oauth cycle

258− reqParams, err := url.ParseQuery(req.URL.RawQuery)

277+ err := req.ParseForm()

259 if err != nil {

278 if err != nil {

260 p.ErrorPage(rw, 500, "Internal Error", err.Error())

279 p.ErrorPage(rw, 500, "Internal Error", err.Error())

261 return

280 return

262 }

281 }

263− errorString, ok := reqParams["error"]

282+ errorString := req.Form.Get("error")

264− if ok && len(errorString) == 1 {

283+ if errorString != "" {

265− p.ErrorPage(rw, 403, "Permission Denied", errorString[0])

284+ p.ErrorPage(rw, 403, "Permission Denied", errorString)

266− return

267− }

268− code, ok := reqParams["code"]

269− if !ok || len(code) != 1 {

270− p.ErrorPage(rw, 500, "Internal Error", "Invalid API response")

271 return

285 return

272 }

286 }

273

287

274− token, err := p.redeemCode(code[0])

288+ token, err := p.redeemCode(req.Form.Get("code"))

275 if err != nil {

289 if err != nil {

276 log.Printf("error redeeming code %s", err.Error())

290 log.Printf("error redeeming code %s", err.Error())

277 p.ErrorPage(rw, 500, "Internal Error", err.Error())

291 p.ErrorPage(rw, 500, "Internal Error", err.Error())

@@ -285,11 +299,16 @@ func (p *OauthProxy) ServeHTTP(rw http.ResponseWriter, req *http.Request) {

285 return

299 return

286 }

300 }

287

301

302+ redirect := req.Form.Get("state")

303+ if redirect == "" {

304+ redirect = "/"

305+ }

306+

288 // set cookie, or deny

307 // set cookie, or deny

289 if p.Validator(email) {

308 if p.Validator(email) {

290 log.Printf("authenticating %s completed", email)

309 log.Printf("authenticating %s completed", email)

291 p.SetCookie(rw, req, email)

310 p.SetCookie(rw, req, email)

292− http.Redirect(rw, req, "/", 302)

311+ http.Redirect(rw, req, redirect, 302)

293 return

312 return

294 } else {

313 } else {

295 p.ErrorPage(rw, 403, "Permission Denied", "Invalid Account")

314 p.ErrorPage(rw, 403, "Permission Denied", "Invalid Account")

templates.go+2

@@ -12,12 +12,14 @@ func getTemplates() *template.Template {

12<head><title>Sign In</title></head>

13<body>

14 <form method="GET" action="/oauth2/start">

15+ <input type="hidden" name="rd" value="{{.Redirect}}">

15 <button type="submit">Sign In w/ Google</button>

16 <button type="submit">Sign In w/ Google</button>

16 {{.SignInMessage}}

17 {{.SignInMessage}}

17 </form>

18 </form>

18 {{ if .Htpasswd }}

19 {{ if .Htpasswd }}

19 <fieldset>

20 <fieldset>

20 <form method="POST" action="/oauth2/sign_in">

21 <form method="POST" action="/oauth2/sign_in">

22+ <input type="hidden" name="rd" value="{{.Redirect}}">

21 <label>Username: <input type="text" name="username" size="10"></label><br/>

23 <label>Username: <input type="text" name="username" size="10"></label><br/>

22 <label>Password: <input type="password" name="password" size="10"></label><br/>

24 <label>Password: <input type="password" name="password" size="10"></label><br/>

23 <button type="submit">Sign In</button>

25 <button type="submit">Sign In</button>