d78aa13 · typeable/oauth2-proxy

.travis.yml+2−1

compare with master

unifiedsplit

@@ -3,10 +3,11 @@ go:

3 - 1.3.3

4 - 1.4.2

5script:

6− - curl -s https://raw.githubusercontent.com/pote/gpm/v1.3.1/bin/gpm > gpm

6+ - curl -s https://raw.githubusercontent.com/pote/gpm/v1.3.2/bin/gpm > gpm

7 - chmod +x gpm

8 - ./gpm install

9 - ./test.sh

10+sudo: false

10notifications:

11notifications:

11 email: false

12 email: false

12

13

README.md+2−3

@@ -17,7 +17,7 @@ to validate accounts by email, domain or group.

17

18## Installation

19

20−1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) (current release is `v1.1.1`) or build with `$ go get github.com/bitly/oauth2_proxy` which will put the binary in `$GOROOT/bin`

20+1. Download [Prebuilt Binary](https://github.com/bitly/oauth2_proxy/releases) (current release is `v2.0`) or build with `$ go get github.com/bitly/oauth2_proxy` which will put the binary in `$GOROOT/bin`

212. Select a Provider and Register an OAuth Application with a Provider

223. Configure OAuth2 Proxy using config file, command line options, or environment variables

234. Configure SSL or Deploy behind a SSL endpoint (example provided for Nginx)

@@ -99,8 +99,7 @@ Usage of oauth2_proxy:

99 -cookie-domain="": an optional cookie domain to force cookies to (ie: .yourcompany.com)*

100 -cookie-expire=168h0m0s: expire timeframe for cookie

101 -cookie-httponly=true: set HttpOnly cookie flag

102− -cookie-https-only=true: set secure (HTTPS) cookies (deprecated. use --cookie-secure setting)

103− -cookie-key="_oauth2proxy": the name of the cookie that the oauth_proxy creates

102+ -cookie-key="_oauth2_proxy": the name of the cookie that the oauth_proxy creates

104 -cookie-refresh=0: refresh the cookie when less than this much time remains before expiration; 0 to disable

103 -cookie-refresh=0: refresh the cookie when less than this much time remains before expiration; 0 to disable

105 -cookie-secret="": the seed string for secure cookies

104 -cookie-secret="": the seed string for secure cookies

106 -cookie-secure=true: set secure (HTTPS) cookie flag

105 -cookie-secure=true: set secure (HTTPS) cookie flag

contrib/oauth2_proxy.cfg.example+2−2

@@ -54,7 +54,7 @@

54# custom_templates_dir = ""

55

56## Cookie Settings

57−## Key - the cookie name

57+## Name - the cookie name

58## Secret - the seed string for secure cookies; should be 16, 24, or 32 bytes

59## for use with an AES cipher when cookie_refresh or pass_access_token

60## is set

@@ -65,7 +65,7 @@

65## Refresh revalidated the OAuth token to ensure it is still valid. ie: 24h

66## Secure - secure cookies are only sent by the browser of a HTTPS connection (recommended)

67## HttpOnly - httponly cookies are not readable by javascript (recommended)

68−# cookie_key = "_oauth2proxy"

68+# cookie_name = "_oauth2_proxy"

69# cookie_secret = ""

70# cookie_domain = ""

71# cookie_expire = "168h"

dist.sh+1−1

@@ -18,7 +18,7 @@ goversion=$(go version | awk '{print $3}')

18echo "... running tests"

19./test.sh || exit 1

20

21−for os in linux darwin; do

21+for os in windows linux darwin; do

22 echo "... building v$version for $os/$arch"

23 BUILD=$(mktemp -d -t oauth2_proxy)

24 TARGET="oauth2_proxy-$version.$os-$arch.$goversion"

main.go+2−3

@@ -46,12 +46,11 @@ func main() {

46 flagSet.String("custom-templates-dir", "", "path to custom html templates")

47 flagSet.String("proxy-prefix", "/oauth2", "the url root path that this proxy should be nested under (e.g. /<oauth2>/sign_in)")

48

49− flagSet.String("cookie-key", "_oauth2proxy", "the name of the cookie that the oauth_proxy creates")

49+ flagSet.String("cookie-name", "_oauth2_proxy", "the name of the cookie that the oauth_proxy creates")

50 flagSet.String("cookie-secret", "", "the seed string for secure cookies")

51 flagSet.String("cookie-domain", "", "an optional cookie domain to force cookies to (ie: .yourcompany.com)*")

52 flagSet.Duration("cookie-expire", time.Duration(168)*time.Hour, "expire timeframe for cookie")

53− flagSet.Duration("cookie-refresh", time.Duration(0)*time.Hour, "refresh the cookie when less than this much time remains before expiration; 0 to disable")

53+ flagSet.Duration("cookie-refresh", time.Duration(0), "refresh the cookie when less than this much time remains before expiration; 0 to disable")

54− flagSet.Bool("cookie-https-only", true, "set secure (HTTPS) cookies (deprecated. use --cookie-secure setting)")

55 flagSet.Bool("cookie-secure", true, "set secure (HTTPS) cookie flag")

54 flagSet.Bool("cookie-secure", true, "set secure (HTTPS) cookie flag")

56 flagSet.Bool("cookie-httponly", true, "set HttpOnly cookie flag")

55 flagSet.Bool("cookie-httponly", true, "set HttpOnly cookie flag")

57

56

oauthproxy.go+6−10

@@ -21,7 +21,7 @@ import (

21

22type OauthProxy struct {

23 CookieSeed string

24− CookieKey string

24+ CookieName string

25 CookieDomain string

26 CookieSecure bool

27 CookieHttpOnly bool

@@ -109,12 +109,8 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {

109 if domain == "" {

110 domain = "<default>"

111 }

112− if !opts.CookieHttpsOnly {

113− log.Printf("Warning: cookie-https-only setting is deprecated and will be removed in a future version. use cookie-secure")

114− opts.CookieSecure = opts.CookieHttpsOnly

115− }

116

112

117− log.Printf("Cookie settings: name:%s secure (https):%v httponly:%v expiry:%s domain:%s", opts.CookieKey, opts.CookieSecure, opts.CookieHttpOnly, opts.CookieExpire, domain)

113+ log.Printf("Cookie settings: name:%s secure(https):%v httponly:%v expiry:%s domain:%s", opts.CookieName, opts.CookieSecure, opts.CookieHttpOnly, opts.CookieExpire, domain)

118

114

119 var aes_cipher cipher.Block

115 var aes_cipher cipher.Block

120 if opts.PassAccessToken || (opts.CookieRefresh != time.Duration(0)) {

116 if opts.PassAccessToken || (opts.CookieRefresh != time.Duration(0)) {

@@ -127,7 +123,7 @@ func NewOauthProxy(opts *Options, validator func(string) bool) *OauthProxy {

127 }

123 }

128

124

129 return &OauthProxy{

125 return &OauthProxy{

130− CookieKey: opts.CookieKey,

126+ CookieName: opts.CookieName,

131 CookieSeed: opts.CookieSecret,

127 CookieSeed: opts.CookieSecret,

132 CookieDomain: opts.CookieDomain,

128 CookieDomain: opts.CookieDomain,

133 CookieSecure: opts.CookieSecure,

129 CookieSecure: opts.CookieSecure,

@@ -208,11 +204,11 @@ func (p *OauthProxy) MakeCookie(req *http.Request, value string, expiration time

208 }

204 }

209

205

210 if value != "" {

206 if value != "" {

211− value = signedCookieValue(p.CookieSeed, p.CookieKey, value)

207+ value = signedCookieValue(p.CookieSeed, p.CookieName, value)

212 }

208 }

213

209

214 return &http.Cookie{

210 return &http.Cookie{

215− Name: p.CookieKey,

211+ Name: p.CookieName,

216 Value: value,

212 Value: value,

217 Path: "/",

213 Path: "/",

218 Domain: domain,

214 Domain: domain,

@@ -233,7 +229,7 @@ func (p *OauthProxy) SetCookie(rw http.ResponseWriter, req *http.Request, val st

233func (p *OauthProxy) ProcessCookie(rw http.ResponseWriter, req *http.Request) (email, user, access_token string, ok bool) {

229func (p *OauthProxy) ProcessCookie(rw http.ResponseWriter, req *http.Request) (email, user, access_token string, ok bool) {

234 var value string

230 var value string

235 var timestamp time.Time

231 var timestamp time.Time

236− cookie, err := req.Cookie(p.CookieKey)

232+ cookie, err := req.Cookie(p.CookieName)

237 if err == nil {

233 if err == nil {

238 value, timestamp, ok = validateCookie(cookie, p.CookieSeed)

234 value, timestamp, ok = validateCookie(cookie, p.CookieSeed)

239 if ok {

235 if ok {

oauthproxy_test.go+3−3

@@ -193,9 +193,9 @@ func (pat_test *PassAccessTokenTest) getCallbackEndpoint() (http_code int,

193}

194

195func (pat_test *PassAccessTokenTest) getRootEndpoint(cookie string) (http_code int, access_token string) {

196− cookie_key := pat_test.proxy.CookieKey

196+ cookieName := pat_test.proxy.CookieName

197 var value string

198− key_prefix := cookie_key + "="

198+ key_prefix := cookieName + "="

199

200 for _, field := range strings.Split(cookie, "; ") {

201 value = strings.TrimPrefix(field, key_prefix)

@@ -214,7 +214,7 @@ func (pat_test *PassAccessTokenTest) getRootEndpoint(cookie string) (http_code i

214 return 0, ""

215 }

216 req.AddCookie(&http.Cookie{

217− Name: cookie_key,

217+ Name: cookieName,

218 Value: value,

219 Path: "/",

220 Expires: time.Now().Add(time.Duration(24)),

options.go+8−10

@@ -29,14 +29,13 @@ type Options struct {

29 DisplayHtpasswdForm bool `flag:"display-htpasswd-form" cfg:"display_htpasswd_form"`

30 CustomTemplatesDir string `flag:"custom-templates-dir" cfg:"custom_templates_dir"`

31

32− CookieKey string `flag:"cookie-key" cfg:"cookie_key" env:"OAUTH2_PROXY_COOKIE_KEY"`

32+ CookieName string `flag:"cookie-name" cfg:"cookie_name" env:"OAUTH2_PROXY_COOKIE_NAME"`

33− CookieSecret string `flag:"cookie-secret" cfg:"cookie_secret" env:"OAUTH2_PROXY_COOKIE_SECRET"`

33+ CookieSecret string `flag:"cookie-secret" cfg:"cookie_secret" env:"OAUTH2_PROXY_COOKIE_SECRET"`

34− CookieDomain string `flag:"cookie-domain" cfg:"cookie_domain" env:"OAUTH2_PROXY_COOKIE_DOMAIN"`

34+ CookieDomain string `flag:"cookie-domain" cfg:"cookie_domain" env:"OAUTH2_PROXY_COOKIE_DOMAIN"`

35− CookieExpire time.Duration `flag:"cookie-expire" cfg:"cookie_expire" env:"OAUTH2_PROXY_COOKIE_EXPIRE"`

35+ CookieExpire time.Duration `flag:"cookie-expire" cfg:"cookie_expire" env:"OAUTH2_PROXY_COOKIE_EXPIRE"`

36− CookieRefresh time.Duration `flag:"cookie-refresh" cfg:"cookie_refresh" env:"OAUTH2_PROXY_COOKIE_REFRESH"`

36+ CookieRefresh time.Duration `flag:"cookie-refresh" cfg:"cookie_refresh" env:"OAUTH2_PROXY_COOKIE_REFRESH"`

37− CookieHttpsOnly bool `flag:"cookie-https-only" cfg:"cookie_https_only"` // deprecated use cookie-secure

38− CookieSecure bool `flag:"cookie-secure" cfg:"cookie_secure"`

37+ CookieSecure bool `flag:"cookie-secure" cfg:"cookie_secure"`

39− CookieHttpOnly bool `flag:"cookie-httponly" cfg:"cookie_httponly"`

38+ CookieHttpOnly bool `flag:"cookie-httponly" cfg:"cookie_httponly"`

40

39

41 Upstreams []string `flag:"upstream" cfg:"upstreams"`

40 Upstreams []string `flag:"upstream" cfg:"upstreams"`

42 SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex"`

41 SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex"`

@@ -68,8 +67,7 @@ func NewOptions() *Options {

68 HttpAddress: "127.0.0.1:4180",

67 HttpAddress: "127.0.0.1:4180",

69 HttpsAddress: ":443",

68 HttpsAddress: ":443",

70 DisplayHtpasswdForm: true,

69 DisplayHtpasswdForm: true,

71− CookieKey: "_oauthproxy",

70+ CookieName: "_oauth2_proxy",

72− CookieHttpsOnly: true,

73 CookieSecure: true,

71 CookieSecure: true,

74 CookieHttpOnly: true,

72 CookieHttpOnly: true,

75 CookieExpire: time.Duration(168) * time.Hour,

73 CookieExpire: time.Duration(168) * time.Hour,

version.go+1−1

@@ -1,3 +1,3 @@

1package main

2

3−const VERSION = "1.1.1"

3+const VERSION = "2.0"