@@ -3,6 +3,8 @@ package options
33import (
44 "time"
55
6+ . "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options/testutil"
7+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/util/ptr"
68 . "github.com/onsi/ginkgo/v2"
79 . "github.com/onsi/gomega"
810)
@@ -15,8 +17,8 @@ var _ = Describe("Legacy Options", func() {
1517 legacyOpts := NewLegacyOptions()
1618
1719 // Set upstreams and related options to test their conversion
18− flushInterval := Duration(5 * time.Second)
19− timeout := Duration(5 * time.Second)
20+ flushInterval := 5 * time.Second
21+ timeout := 5 * time.Second
2022 legacyOpts.LegacyUpstreams.FlushInterval = time.Duration(flushInterval)
2123 legacyOpts.LegacyUpstreams.Timeout = time.Duration(timeout)
2224 legacyOpts.LegacyUpstreams.PassHostHeader = true
@@ -26,7 +28,6 @@ var _ = Describe("Legacy Options", func() {
2628 legacyOpts.LegacyProvider.ClientID = "oauth-proxy"
2729 legacyOpts.LegacyUpstreams.DisableKeepAlives = false
2830
29− truth := true
3031 staticCode := 204
3132 opts.UpstreamServers = UpstreamConfig{
3233 Upstreams: []Upstream{
@@ -35,35 +36,35 @@ var _ = Describe("Legacy Options", func() {
3536 Path: "/baz",
3637 URI: "http://foo.bar/baz",
3738 FlushInterval: &flushInterval,
38− InsecureSkipTLSVerify: true,
39− PassHostHeader: &truth,
40− ProxyWebSockets: &truth,
39+ InsecureSkipTLSVerify: ptr.To(true),
40+ PassHostHeader: ptr.To(true),
41+ ProxyWebSockets: ptr.To(true),
4142 Timeout: &timeout,
42− DisableKeepAlives: legacyOpts.LegacyUpstreams.DisableKeepAlives,
43+ DisableKeepAlives: &legacyOpts.LegacyUpstreams.DisableKeepAlives,
4344 },
4445 {
4546 ID: "/bar",
4647 Path: "/bar",
4748 URI: "file:///var/lib/website",
4849 FlushInterval: &flushInterval,
49− InsecureSkipTLSVerify: true,
50− PassHostHeader: &truth,
51− ProxyWebSockets: &truth,
50+ InsecureSkipTLSVerify: ptr.To(true),
51+ PassHostHeader: ptr.To(true),
52+ ProxyWebSockets: ptr.To(true),
5253 Timeout: &timeout,
53− DisableKeepAlives: legacyOpts.LegacyUpstreams.DisableKeepAlives,
54+ DisableKeepAlives: &legacyOpts.LegacyUpstreams.DisableKeepAlives,
5455 },
5556 {
5657 ID: "static://204",
5758 Path: "/",
5859 URI: "",
59− Static: true,
60+ Static: ptr.To(true),
6061 StaticCode: &staticCode,
6162 FlushInterval: nil,
62− InsecureSkipTLSVerify: false,
63+ InsecureSkipTLSVerify: ptr.To(false),
6364 PassHostHeader: nil,
6465 ProxyWebSockets: nil,
6566 Timeout: nil,
66− DisableKeepAlives: legacyOpts.LegacyUpstreams.DisableKeepAlives,
67+ DisableKeepAlives: &legacyOpts.LegacyUpstreams.DisableKeepAlives,
6768 },
6869 },
6970 }
@@ -71,7 +72,7 @@ var _ = Describe("Legacy Options", func() {
7172 opts.InjectRequestHeaders = []Header{
7273 {
7374 Name: "X-Forwarded-Groups",
74− PreserveRequestValue: false,
75+ PreserveRequestValue: ptr.To(false),
7576 Values: []HeaderValue{
7677 {
7778 ClaimSource: &ClaimSource{
@@ -82,7 +83,7 @@ var _ = Describe("Legacy Options", func() {
8283 },
8384 {
8485 Name: "X-Forwarded-User",
85− PreserveRequestValue: false,
86+ PreserveRequestValue: ptr.To(false),
8687 Values: []HeaderValue{
8788 {
8889 ClaimSource: &ClaimSource{
@@ -93,7 +94,7 @@ var _ = Describe("Legacy Options", func() {
9394 },
9495 {
9596 Name: "X-Forwarded-Email",
96− PreserveRequestValue: false,
97+ PreserveRequestValue: ptr.To(false),
9798 Values: []HeaderValue{
9899 {
99100 ClaimSource: &ClaimSource{
@@ -104,7 +105,7 @@ var _ = Describe("Legacy Options", func() {
104105 },
105106 {
106107 Name: "X-Forwarded-Preferred-Username",
107− PreserveRequestValue: false,
108+ PreserveRequestValue: ptr.To(false),
108109 Values: []HeaderValue{
109110 {
110111 ClaimSource: &ClaimSource{
@@ -121,18 +122,21 @@ var _ = Describe("Legacy Options", func() {
121122 BindAddress: "127.0.0.1:4180",
122123 }
123124
124− opts.Providers[0].ClientID = "oauth-proxy"
125125 opts.Providers[0].ID = "google=oauth-proxy"
126− opts.Providers[0].OIDCConfig.InsecureSkipNonce = true
126+ opts.Providers[0].ClientID = "oauth-proxy"
127127 opts.Providers[0].OIDCConfig.AudienceClaims = []string{"aud"}
128128 opts.Providers[0].OIDCConfig.ExtraAudiences = []string{}
129+ opts.Providers[0].OIDCConfig.InsecureSkipNonce = ptr.To(true)
130+ opts.Providers[0].OIDCConfig.InsecureSkipIssuerVerification = ptr.To(false)
129131 opts.Providers[0].LoginURLParameters = []LoginURLParameter{
130132 {Name: "approval_prompt", Default: []string{"force"}},
131133 }
132134
133135 converted, err := legacyOpts.ToOptions()
136+ opts.EnsureDefaults()
137+
134138 Expect(err).ToNot(HaveOccurred())
135− Expect(converted).To(Equal(opts))
139+ Expect(converted).To(EqualOpts(opts))
136140 })
137141 })
138142
@@ -147,8 +151,8 @@ var _ = Describe("Legacy Options", func() {
147151 skipVerify := true
148152 passHostHeader := false
149153 proxyWebSockets := true
150− flushInterval := Duration(5 * time.Second)
151− timeout := Duration(5 * time.Second)
154+ flushInterval := 5 * time.Second
155+ timeout := 5 * time.Second
152156 disableKeepAlives := true
153157
154158 // Test cases and expected outcomes
@@ -157,12 +161,12 @@ var _ = Describe("Legacy Options", func() {
157161 ID: "/baz",
158162 Path: "/baz",
159163 URI: validHTTP,
160− InsecureSkipTLSVerify: skipVerify,
164+ InsecureSkipTLSVerify: &skipVerify,
161165 PassHostHeader: &passHostHeader,
162166 ProxyWebSockets: &proxyWebSockets,
163167 FlushInterval: &flushInterval,
164168 Timeout: &timeout,
165− DisableKeepAlives: disableKeepAlives,
169+ DisableKeepAlives: &disableKeepAlives,
166170 }
167171
168172 // Test cases and expected outcomes
@@ -171,12 +175,12 @@ var _ = Describe("Legacy Options", func() {
171175 ID: "/",
172176 Path: "/",
173177 URI: emptyPathHTTP,
174− InsecureSkipTLSVerify: skipVerify,
178+ InsecureSkipTLSVerify: &skipVerify,
175179 PassHostHeader: &passHostHeader,
176180 ProxyWebSockets: &proxyWebSockets,
177181 FlushInterval: &flushInterval,
178182 Timeout: &timeout,
179− DisableKeepAlives: disableKeepAlives,
183+ DisableKeepAlives: &disableKeepAlives,
180184 }
181185
182186 validFileWithFragment := "file:///var/lib/website#/bar"
@@ -184,12 +188,12 @@ var _ = Describe("Legacy Options", func() {
184188 ID: "/bar",
185189 Path: "/bar",
186190 URI: "file:///var/lib/website",
187− InsecureSkipTLSVerify: skipVerify,
191+ InsecureSkipTLSVerify: &skipVerify,
188192 PassHostHeader: &passHostHeader,
189193 ProxyWebSockets: &proxyWebSockets,
190194 FlushInterval: &flushInterval,
191195 Timeout: &timeout,
192− DisableKeepAlives: disableKeepAlives,
196+ DisableKeepAlives: &disableKeepAlives,
193197 }
194198
195199 validStatic := "static://204"
@@ -198,14 +202,14 @@ var _ = Describe("Legacy Options", func() {
198202 ID: validStatic,
199203 Path: "/",
200204 URI: "",
201− Static: true,
205+ Static: ptr.To(true),
202206 StaticCode: &validStaticCode,
203− InsecureSkipTLSVerify: false,
207+ InsecureSkipTLSVerify: ptr.To(false),
204208 PassHostHeader: nil,
205209 ProxyWebSockets: nil,
206210 FlushInterval: nil,
207211 Timeout: nil,
208− DisableKeepAlives: false,
212+ DisableKeepAlives: ptr.To(false),
209213 }
210214
211215 invalidStatic := "static://abc"
@@ -214,14 +218,14 @@ var _ = Describe("Legacy Options", func() {
214218 ID: invalidStatic,
215219 Path: "/",
216220 URI: "",
217− Static: true,
221+ Static: ptr.To(true),
218222 StaticCode: &invalidStaticCode,
219− InsecureSkipTLSVerify: false,
223+ InsecureSkipTLSVerify: ptr.To(false),
220224 PassHostHeader: nil,
221225 ProxyWebSockets: nil,
222226 FlushInterval: nil,
223227 Timeout: nil,
224− DisableKeepAlives: false,
228+ DisableKeepAlives: ptr.To(false),
225229 }
226230
227231 invalidHTTP := ":foo"
@@ -308,13 +312,13 @@ var _ = Describe("Legacy Options", func() {
308312 }
309313
310314 withPreserveRequestValue := func(h Header, preserve bool) Header {
311− h.PreserveRequestValue = preserve
315+ h.PreserveRequestValue = &preserve
312316 return h
313317 }
314318
315319 xForwardedUser := Header{
316320 Name: "X-Forwarded-User",
317− PreserveRequestValue: false,
321+ PreserveRequestValue: ptr.To(false),
318322 Values: []HeaderValue{
319323 {
320324 ClaimSource: &ClaimSource{
@@ -326,7 +330,7 @@ var _ = Describe("Legacy Options", func() {
326330
327331 xForwardedEmail := Header{
328332 Name: "X-Forwarded-Email",
329− PreserveRequestValue: false,
333+ PreserveRequestValue: ptr.To(false),
330334 Values: []HeaderValue{
331335 {
332336 ClaimSource: &ClaimSource{
@@ -338,7 +342,7 @@ var _ = Describe("Legacy Options", func() {
338342
339343 xForwardedGroups := Header{
340344 Name: "X-Forwarded-Groups",
341− PreserveRequestValue: false,
345+ PreserveRequestValue: ptr.To(false),
342346 Values: []HeaderValue{
343347 {
344348 ClaimSource: &ClaimSource{
@@ -350,7 +354,7 @@ var _ = Describe("Legacy Options", func() {
350354
351355 xForwardedPreferredUsername := Header{
352356 Name: "X-Forwarded-Preferred-Username",
353− PreserveRequestValue: false,
357+ PreserveRequestValue: ptr.To(false),
354358 Values: []HeaderValue{
355359 {
356360 ClaimSource: &ClaimSource{
@@ -362,7 +366,7 @@ var _ = Describe("Legacy Options", func() {
362366
363367 basicAuthHeader := Header{
364368 Name: "Authorization",
365− PreserveRequestValue: false,
369+ PreserveRequestValue: ptr.To(false),
366370 Values: []HeaderValue{
367371 {
368372 ClaimSource: &ClaimSource{
@@ -378,7 +382,7 @@ var _ = Describe("Legacy Options", func() {
378382
379383 xForwardedUserWithEmail := Header{
380384 Name: "X-Forwarded-User",
381− PreserveRequestValue: false,
385+ PreserveRequestValue: ptr.To(false),
382386 Values: []HeaderValue{
383387 {
384388 ClaimSource: &ClaimSource{
@@ -390,7 +394,7 @@ var _ = Describe("Legacy Options", func() {
390394
391395 xForwardedAccessToken := Header{
392396 Name: "X-Forwarded-Access-Token",
393− PreserveRequestValue: false,
397+ PreserveRequestValue: ptr.To(false),
394398 Values: []HeaderValue{
395399 {
396400 ClaimSource: &ClaimSource{
@@ -402,7 +406,7 @@ var _ = Describe("Legacy Options", func() {
402406
403407 basicAuthHeaderWithEmail := Header{
404408 Name: "Authorization",
405− PreserveRequestValue: false,
409+ PreserveRequestValue: ptr.To(false),
406410 Values: []HeaderValue{
407411 {
408412 ClaimSource: &ClaimSource{
@@ -418,7 +422,7 @@ var _ = Describe("Legacy Options", func() {
418422
419423 xAuthRequestUser := Header{
420424 Name: "X-Auth-Request-User",
421− PreserveRequestValue: false,
425+ PreserveRequestValue: ptr.To(false),
422426 Values: []HeaderValue{
423427 {
424428 ClaimSource: &ClaimSource{
@@ -430,7 +434,7 @@ var _ = Describe("Legacy Options", func() {
430434
431435 xAuthRequestEmail := Header{
432436 Name: "X-Auth-Request-Email",
433− PreserveRequestValue: false,
437+ PreserveRequestValue: ptr.To(false),
434438 Values: []HeaderValue{
435439 {
436440 ClaimSource: &ClaimSource{
@@ -442,7 +446,7 @@ var _ = Describe("Legacy Options", func() {
442446
443447 xAuthRequestGroups := Header{
444448 Name: "X-Auth-Request-Groups",
445− PreserveRequestValue: false,
449+ PreserveRequestValue: ptr.To(false),
446450 Values: []HeaderValue{
447451 {
448452 ClaimSource: &ClaimSource{
@@ -454,7 +458,7 @@ var _ = Describe("Legacy Options", func() {
454458
455459 xAuthRequestPreferredUsername := Header{
456460 Name: "X-Auth-Request-Preferred-Username",
457− PreserveRequestValue: false,
461+ PreserveRequestValue: ptr.To(false),
458462 Values: []HeaderValue{
459463 {
460464 ClaimSource: &ClaimSource{
@@ -466,7 +470,7 @@ var _ = Describe("Legacy Options", func() {
466470
467471 xAuthRequestAccessToken := Header{
468472 Name: "X-Auth-Request-Access-Token",
469− PreserveRequestValue: false,
473+ PreserveRequestValue: ptr.To(false),
470474 Values: []HeaderValue{
471475 {
472476 ClaimSource: &ClaimSource{
@@ -478,7 +482,7 @@ var _ = Describe("Legacy Options", func() {
478482
479483 authorizationHeader := Header{
480484 Name: "Authorization",
481− PreserveRequestValue: false,
485+ PreserveRequestValue: ptr.To(false),
482486 Values: []HeaderValue{
483487 {
484488 ClaimSource: &ClaimSource{
@@ -943,37 +947,51 @@ var _ = Describe("Legacy Options", func() {
943947 {Name: "approval_prompt", Default: []string{"force"}},
944948 }
945949
946− defaultProvider := Provider{
947− ID: "google=" + clientID,
948− ClientID: clientID,
949− Type: "google",
950− LoginURLParameters: defaultURLParams,
950+ defaultOIDCOptions := OIDCOptions{
951+ SkipDiscovery: ptr.To(false),
952+ InsecureSkipNonce: ptr.To(false),
953+ InsecureAllowUnverifiedEmail: ptr.To(false),
954+ InsecureSkipIssuerVerification: ptr.To(false),
955+ }
956+
957+ defaultGoogleOptions := GoogleOptions{
958+ UseOrganizationID: ptr.To(false),
959+ UseApplicationDefaultCredentials: ptr.To(false),
951960 }
961+
952962 defaultLegacyProvider := LegacyProvider{
953963 ClientID: clientID,
954964 ProviderType: "google",
955965 }
956966
957− defaultProviderWithPrompt := Provider{
958− ID: "google=" + clientID,
959− ClientID: clientID,
960− Type: "google",
961− LoginURLParameters: []LoginURLParameter{
962− {Name: "prompt", Default: []string{"switch_user"}},
963− },
967+ defaultProvider := Provider{
968+ ID: "google=" + clientID,
969+ ClientID: clientID,
970+ Type: "google",
971+ OIDCConfig: defaultOIDCOptions,
972+ GoogleConfig: defaultGoogleOptions,
973+ LoginURLParameters: defaultURLParams,
974+ UseSystemTrustStore: ptr.To(false),
975+ SkipClaimsFromProfileURL: ptr.To(false),
964976 }
977+
965978 defaultLegacyProviderWithPrompt := LegacyProvider{
966979 ClientID: clientID,
967980 ProviderType: "google",
968981 Prompt: "switch_user",
969982 }
970983
971− displayNameProvider := Provider{
972− ID: "displayName",
973− Name: "displayName",
974− ClientID: clientID,
975− Type: "google",
976− LoginURLParameters: defaultURLParams,
984+ defaultProviderWithPrompt := Provider{
985+ ID: "google=" + clientID,
986+ ClientID: clientID,
987+ Type: "google",
988+ OIDCConfig: defaultOIDCOptions,
989+ GoogleConfig: defaultGoogleOptions,
990+ LoginURLParameters: []LoginURLParameter{
991+ {Name: "prompt", Default: []string{"switch_user"}},
992+ },
993+ UseSystemTrustStore: ptr.To(false),
994+ SkipClaimsFromProfileURL: ptr.To(false),
977995 }
978996
979997 displayNameLegacyProvider := LegacyProvider{
@@ -982,16 +1000,33 @@ var _ = Describe("Legacy Options", func() {
9821000 ProviderType: "google",
9831001 }
9841002
1003+ displayNameProvider := Provider{
1004+ ID: "displayName",
1005+ Name: "displayName",
1006+ ClientID: clientID,
1007+ Type: "google",
1008+ OIDCConfig: defaultOIDCOptions,
1009+ GoogleConfig: defaultGoogleOptions,
1010+ LoginURLParameters: defaultURLParams,
1011+ UseSystemTrustStore: ptr.To(false),
1012+ SkipClaimsFromProfileURL: ptr.To(false),
1013+ }
1014+
9851015 internalConfigProvider := Provider{
986− ID: "google=" + clientID,
987− ClientID: clientID,
988− Type: "google",
1016+ ID: "google=" + clientID,
1017+ ClientID: clientID,
1018+ Type: "google",
1019+ OIDCConfig: defaultOIDCOptions,
9891020 GoogleConfig: GoogleOptions{
990− AdminEmail: "email@email.com",
991− ServiceAccountJSON: "test.json",
992− Groups: []string{"1", "2"},
1021+ AdminEmail: "email@email.com",
1022+ ServiceAccountJSON: "test.json",
1023+ Groups: []string{"1", "2"},
1024+ UseOrganizationID: ptr.To(false),
1025+ UseApplicationDefaultCredentials: ptr.To(false),
9931026 },
994− LoginURLParameters: defaultURLParams,
1027+ LoginURLParameters: defaultURLParams,
1028+ UseSystemTrustStore: ptr.To(false),
1029+ SkipClaimsFromProfileURL: ptr.To(false),
9951030 }
9961031
9971032 internalConfigLegacyProvider := LegacyProvider{