d77119b · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Merging changes

commitd77119be55ac38f7443ce7350954145b8336d9d5 authorMisterWil <wilrader@gmail.com> dateFri 12 Apr 2019, 09:26 (8 years ago) parent1f15631

5 files changed+19−76

compare with master

unifiedsplit

Gopkg.lock+1 logging_handler.go+3 main.go+5−9 oauthproxy.go+2−19 options.go+8−48

Gopkg.lock+1

@@ -222,6 +222,7 @@

222222 "github.com/mreiferson/go-options",

223223 "github.com/stretchr/testify/assert",

224224 "github.com/stretchr/testify/require",

225+ "github.com/yhat/wsutil",

225226 "golang.org/x/crypto/bcrypt",

226227 "golang.org/x/net/websocket",

227228 "golang.org/x/oauth2",

logging_handler.go+3

@@ -4,6 +4,9 @@

44package main

66import (

7+ "bufio"

8+ "errors"

9+ "net"

710 "net/http"

811 "time"

912

main.go+5−9

@@ -3,7 +3,6 @@ package main

33import (

44 "flag"

55 "fmt"

6− "log"

76 "math/rand"

87 "net/http"

98 "os"

@@ -13,6 +12,7 @@ import (

1312

1413 "github.com/BurntSushi/toml"

1514 options "github.com/mreiferson/go-options"

15+ "github.com/pusher/oauth2_proxy/logger"

1616)

1717

1818func main() {

@@ -20,7 +20,7 @@ func main() {

2020 flagSet := flag.NewFlagSet("oauth2_proxy", flag.ExitOnError)

2121

2222 emailDomains := StringArray{}

23− whitelistDomains := StringArray{}

23+ whitelistandardomains := StringArray{}

2424 upstreams := StringArray{}

2525 skipAuthRegex := StringArray{}

2626 googleGroups := StringArray{}

@@ -49,7 +49,7 @@ func main() {

4949 flagSet.Duration("flush-interval", time.Duration(1)*time.Second, "period between response flushing when streaming responses")

5050

5151 flagSet.Var(&emailDomains, "email-domain", "authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email")

52− flagSet.Var(&whitelistDomains, "whitelist-domain", "allowed domains for redirection after authentication. Prefix domain with a . to allow subdomains (eg .example.com)")

52+ flagSet.Var(&whitelistandardomains, "whitelist-domain", "allowed domains for redirection after authentication. Prefix domain with a . to allow subdomains (eg .example.com)")

5353 flagSet.String("azure-tenant", "common", "go to a tenant-specific or common (tenant-independent) endpoint.")

5454 flagSet.String("github-org", "", "restrict logins to members of this organisation")

5555 flagSet.String("github-team", "", "restrict logins to members of this team")

@@ -158,16 +158,12 @@ func main() {

158158

159159 var handler http.Handler

160160 if opts.GCPHealthChecks {

161− handler = gcpHealthcheck(LoggingHandler(os.Stdout, oauthproxy, opts.RequestLogging, opts.RequestLoggingFormat))

161+ handler = gcpHealthcheck(LoggingHandler(oauthproxy))

162162 } else {

163− handler = LoggingHandler(os.Stdout, oauthproxy, opts.RequestLogging, opts.RequestLoggingFormat)

163+ handler = LoggingHandler(oauthproxy)

164164 }

165165 s := &Server{

166−<<<<<<< HEAD

167166 Handler: handler,

168−=======

169− Handler: LoggingHandler(oauthproxy),

170−>>>>>>> Auth and standard logging with file rolling

171167 Opts: opts,

172168 }

173169 s.ListenAndServe()

oauthproxy.go+2−19

@@ -185,23 +185,10 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

185185 path := u.Path

186186 switch u.Scheme {

187187 case httpScheme, httpsScheme:

188−<<<<<<< HEAD

189− log.Printf("mapping path %q => upstream %q", path, u)

188+ logger.Printf("mapping path %q => upstream %q", path, u)

190189 proxy := NewWebSocketOrRestReverseProxy(u, opts, auth)

191190 serveMux.Handle(path, proxy)

192191

193−=======

194− u.Path = ""

195− logger.Printf("mapping path %q => upstream %q", path, u)

196− proxy := NewReverseProxy(u, opts.FlushInterval)

197− if !opts.PassHostHeader {

198− setProxyUpstreamHostHeader(proxy, u)

199− } else {

200− setProxyDirector(proxy)

201− }

202− serveMux.Handle(path,

203− &UpstreamProxy{u.Host, proxy, auth})

204−>>>>>>> Auth and standard logging with file rolling

205192 case "file":

206193 if u.Fragment != "" {

207194 path = u.Fragment

@@ -228,11 +215,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

228215 refresh = fmt.Sprintf("after %s", opts.CookieRefresh)

229216 }

230217

231−<<<<<<< HEAD

232− log.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domain:%s path:%s refresh:%s", opts.CookieName, opts.CookieSecure, opts.CookieHTTPOnly, opts.CookieExpire, opts.CookieDomain, opts.CookiePath, refresh)

233−=======

234− logger.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domain:%s refresh:%s", opts.CookieName, opts.CookieSecure, opts.CookieHTTPOnly, opts.CookieExpire, opts.CookieDomain, refresh)

235−>>>>>>> Auth and standard logging with file rolling

218+ logger.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domain:%s path:%s refresh:%s", opts.CookieName, opts.CookieSecure, opts.CookieHTTPOnly, opts.CookieExpire, opts.CookieDomain, opts.CookiePath, refresh)

236219

237220 var cipher *cookie.Cipher

238221 if opts.PassAccessToken || opts.SetAuthorization || opts.PassAuthorization || (opts.CookieRefresh != time.Duration(0)) {

options.go+8−48

@@ -18,7 +18,7 @@ import (

1818 "github.com/mbland/hmacauth"

1919 "github.com/pusher/oauth2_proxy/logger"

2020 "github.com/pusher/oauth2_proxy/providers"

21− lumberjack "gopkg.in/natefinch/lumberjack.v2"

21+ "gopkg.in/natefinch/lumberjack.v2"

2222)

2323

2424// Options holds Configuration Options that can be set by Command Line Flag,

@@ -74,7 +74,6 @@ type Options struct {

7474

7575 // These options allow for other providers besides Google, with

7676 // potential overrides.

77−<<<<<<< HEAD

7877 Provider string `flag:"provider" cfg:"provider" env:"OAUTH2_PROXY_PROVIDER"`

7978 OIDCIssuerURL string `flag:"oidc-issuer-url" cfg:"oidc_issuer_url" env:"OAUTH2_PROXY_OIDC_ISSUER_URL"`

8079 SkipOIDCDiscovery bool `flag:"skip-oidc-discovery" cfg:"skip_oidc_discovery" env:"OAUTH2_SKIP_OIDC_DISCOVERY"`

@@ -87,25 +86,6 @@ type Options struct {

8786 Scope string `flag:"scope" cfg:"scope" env:"OAUTH2_PROXY_SCOPE"`

8887 ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt" env:"OAUTH2_PROXY_APPROVAL_PROMPT"`

8988

90− RequestLogging bool `flag:"request-logging" cfg:"request_logging" env:"OAUTH2_PROXY_REQUEST_LOGGING"`

91− RequestLoggingFormat string `flag:"request-logging-format" cfg:"request_logging_format" env:"OAUTH2_PROXY_REQUEST_LOGGING_FORMAT"`

92−

93− SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`

94− AcrValues string `flag:"acr-values" cfg:"acr_values" env:"OAUTH2_PROXY_ACR_VALUES"`

95− JWTKey string `flag:"jwt-key" cfg:"jwt_key" env:"OAUTH2_PROXY_JWT_KEY"`

96− PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url" env:"OAUTH2_PROXY_PUBJWK_URL"`

97− GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks" env:"OAUTH2_PROXY_GCP_HEALTHCHECKS"`

98−=======

99− Provider string `flag:"provider" cfg:"provider"`

100− OIDCIssuerURL string `flag:"oidc-issuer-url" cfg:"oidc_issuer_url"`

101− LoginURL string `flag:"login-url" cfg:"login_url"`

102− RedeemURL string `flag:"redeem-url" cfg:"redeem_url"`

103− ProfileURL string `flag:"profile-url" cfg:"profile_url"`

104− ProtectedResource string `flag:"resource" cfg:"resource"`

105− ValidateURL string `flag:"validate-url" cfg:"validate_url"`

106− Scope string `flag:"scope" cfg:"scope"`

107− ApprovalPrompt string `flag:"approval-prompt" cfg:"approval_prompt"`

108−

10989 // Configuration values for logging

11090 LoggingFilename string `flag:"logging-filename" cfg:"logging_filename"`

11191 LoggingMaxSize int `flag:"logging-max-size" cfg:"logging_max_size"`

@@ -120,8 +100,11 @@ type Options struct {

120100 AuthLogging bool `flag:"auth-logging" cfg:"auth_logging"`

121101 AuthLoggingFormat string `flag:"auth-logging-format" cfg:"auth_logging_format"`

122102

123− SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`

124−>>>>>>> Auth and standard logging with file rolling

103+ SignatureKey string `flag:"signature-key" cfg:"signature_key" env:"OAUTH2_PROXY_SIGNATURE_KEY"`

104+ AcrValues string `flag:"acr-values" cfg:"acr_values" env:"OAUTH2_PROXY_ACR_VALUES"`

105+ JWTKey string `flag:"jwt-key" cfg:"jwt_key" env:"OAUTH2_PROXY_JWT_KEY"`

106+ PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url" env:"OAUTH2_PROXY_PUBJWK_URL"`

107+ GCPHealthChecks bool `flag:"gcp-healthchecks" cfg:"gcp_healthchecks" env:"OAUTH2_PROXY_GCP_HEALTHCHECKS"`

125108

126109 // internal values that are set after config validation

127110 redirectURL *url.URL

@@ -141,31 +124,8 @@ type SignatureData struct {

141124// NewOptions constructs a new Options with defaulted values

142125func NewOptions() *Options {

143126 return &Options{

144−<<<<<<< HEAD

145− ProxyPrefix: "/oauth2",

146− ProxyWebSockets: true,

147− HTTPAddress: "127.0.0.1:4180",

148− HTTPSAddress: ":443",

149− DisplayHtpasswdForm: true,

150− CookieName: "_oauth2_proxy",

151− CookieSecure: true,

152− CookieHTTPOnly: true,

153− CookieExpire: time.Duration(168) * time.Hour,

154− CookieRefresh: time.Duration(0),

155− SetXAuthRequest: false,

156− SkipAuthPreflight: false,

157− PassBasicAuth: true,

158− PassUserHeaders: true,

159− PassAccessToken: false,

160− PassHostHeader: true,

161− SetAuthorization: false,

162− PassAuthorization: false,

163− ApprovalPrompt: "force",

164− RequestLogging: true,

165− SkipOIDCDiscovery: false,

166− RequestLoggingFormat: defaultRequestLoggingFormat,

167−=======

168127 ProxyPrefix: "/oauth2",

128+ ProxyWebSockets: true,

169129 HTTPAddress: "127.0.0.1:4180",

170130 HTTPSAddress: ":443",

171131 DisplayHtpasswdForm: true,

@@ -183,6 +143,7 @@ func NewOptions() *Options {

183143 SetAuthorization: false,

184144 PassAuthorization: false,

185145 ApprovalPrompt: "force",

146+ SkipOIDCDiscovery: false,

186147 LoggingFilename: "",

187148 LoggingMaxSize: 100,

188149 LoggingMaxAge: 7,

@@ -195,7 +156,6 @@ func NewOptions() *Options {

195156 RequestLoggingFormat: logger.DefaultRequestLoggingFormat,

196157 AuthLogging: true,

197158 AuthLoggingFormat: logger.DefaultAuthLoggingFormat,

198−>>>>>>> Auth and standard logging with file rolling

199159 }

200160}

201161