git.iko.soy/typeable/oauth2-proxy
on master help sign in
option for skipping OAuth provider SSL verification
commitdcf62d06df186058a5b0e9f7be7dda492007b6a8 authorJehiah Czebotar <jehiah@gmail.com> dateWed 29 Mar 2017, 10:57 (10 years ago) parentbb9b607
4 files changed+23−9
compare with master
unifiedsplit
README.md+1 contrib/oauth2_proxy.cfg.example+4 main.go+1 options.go+17−9
README.md+1
@@ -200,6 +200,7 @@ Usage of oauth2_proxy:
200200 -signature-key="": GAP-Signature request signature key (algorithm:secretkey)
201201 -skip-auth-regex=: bypass authentication for requests path's that match (may be given multiple times)
202202 -skip-provider-button=false: will skip sign-in-page to directly reach the next step: oauth/start
203+ -ssl-insecure-skip-verify: skip validation of certificates presented when using HTTPS
203204 -tls-cert="": path to certificate file
204205 -tls-key="": path to private key file
205206 -upstream=: the http url(s) of the upstream endpoint or file:// paths for static files. Routing is based on the path
contrib/oauth2_proxy.cfg.example+4
@@ -54,6 +54,10 @@
5454## optional directory with custom sign_in.html and error.html
5555# custom_templates_dir = ""
5656
57+## skip SSL checking for HTTPS requests
58+# ssl_insecure_skip_verify = false
59+
60+
5761## Cookie Settings
5862## Name - the cookie name
5963## Secret - the seed string for secure cookies; should be 16, 24, or 32 bytes
main.go+1
@@ -38,6 +38,7 @@ func main() {
3838 flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")
3939 flagSet.Var(&skipAuthRegex, "skip-auth-regex", "bypass authentication for requests path's that match (may be given multiple times)")
4040 flagSet.Bool("skip-provider-button", false, "will skip sign-in-page to directly reach the next step: oauth/start")
41+ flagSet.Bool("ssl-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS")
4142
4243 flagSet.Var(&emailDomains, "email-domain", "authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email")
4344 flagSet.String("azure-tenant", "common", "go to a tenant-specific or common (tenant-independent) endpoint.")
options.go+17−9
@@ -2,6 +2,7 @@ package main
22
33import (
44 "crypto"
5+ "crypto/tls"
56 "encoding/base64"
67 "fmt"
78 "net/http"
@@ -47,14 +48,15 @@ type Options struct {
4748 CookieSecure bool `flag:"cookie-secure" cfg:"cookie_secure"`
4849 CookieHttpOnly bool `flag:"cookie-httponly" cfg:"cookie_httponly"`
4950
50− Upstreams []string `flag:"upstream" cfg:"upstreams"`
51− SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex"`
52− PassBasicAuth bool `flag:"pass-basic-auth" cfg:"pass_basic_auth"`
53− BasicAuthPassword string `flag:"basic-auth-password" cfg:"basic_auth_password"`
54− PassAccessToken bool `flag:"pass-access-token" cfg:"pass_access_token"`
55− PassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header"`
56− SkipProviderButton bool `flag:"skip-provider-button" cfg:"skip_provider_button"`
57− PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers"`
51+ Upstreams []string `flag:"upstream" cfg:"upstreams"`
52+ SkipAuthRegex []string `flag:"skip-auth-regex" cfg:"skip_auth_regex"`
53+ PassBasicAuth bool `flag:"pass-basic-auth" cfg:"pass_basic_auth"`
54+ BasicAuthPassword string `flag:"basic-auth-password" cfg:"basic_auth_password"`
55+ PassAccessToken bool `flag:"pass-access-token" cfg:"pass_access_token"`
56+ PassHostHeader bool `flag:"pass-host-header" cfg:"pass_host_header"`
57+ SkipProviderButton bool `flag:"skip-provider-button" cfg:"skip_provider_button"`
58+ PassUserHeaders bool `flag:"pass-user-headers" cfg:"pass_user_headers"`
59+ SSLInsecureSkipVerify bool `flag:"ssl-insecure-skip-verify" cfg:"ssl_insecure_skip_verify"`
5860
5961 // These options allow for other providers besides Google, with
6062 // potential overrides.
@@ -99,7 +101,6 @@ func NewOptions() *Options {
99101 PassUserHeaders: true,
100102 PassAccessToken: false,
101103 PassHostHeader: true,
102− SkipProviderButton: false,
103104 ApprovalPrompt: "force",
104105 RequestLogging: true,
105106 }
@@ -205,6 +206,13 @@ func (o *Options) Validate() error {
205206 msgs = parseSignatureKey(o, msgs)
206207 msgs = validateCookieName(o, msgs)
207208
209+ if o.SSLInsecureSkipVerify {
210+ insecureTransport := &http.Transport{
211+ TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
212+ }
213+ http.DefaultClient = &http.Client{Transport: insecureTransport}
214+ }
215+
208216 if len(msgs) != 0 {
209217 return fmt.Errorf("Invalid configuration:\n %s",
210218 strings.Join(msgs, "\n "))