git.iko.soy/typeable/oauth2-proxy
on master help sign in
Add id_token refresh to Google provider (#83)
eacba4eGabor Lekeny
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -4,6 +4,7 @@
4
4
5- [#68](https://github.com/pusher/oauth2_proxy/pull/68) forward X-Auth-Access-Token header (@davidholsgrove)
5- [#68](https://github.com/pusher/oauth2_proxy/pull/68) forward X-Auth-Access-Token header (@davidholsgrove)
6- [#41](https://github.com/pusher/oauth2_proxy/pull/41) Added option to manually specify OIDC endpoints instead of relying on discovery
6- [#41](https://github.com/pusher/oauth2_proxy/pull/41) Added option to manually specify OIDC endpoints instead of relying on discovery
7+- [#83](https://github.com/pusher/oauth2_proxy/pull/83) Add `id_token` refresh to Google provider (@leki75)
7
8
8# v3.1.0
9# v3.1.0
9
10
providers/google.go+6−3
@@ -16,7 +16,7 @@ import (
16
16
17 "golang.org/x/oauth2"
17 "golang.org/x/oauth2"
18 "golang.org/x/oauth2/google"
18 "golang.org/x/oauth2/google"
19− "google.golang.org/api/admin/directory/v1"
19+ admin "google.golang.org/api/admin/directory/v1"
20 "google.golang.org/api/googleapi"
20 "google.golang.org/api/googleapi"
21)
21)
22
22
@@ -260,7 +260,7 @@ func (p *GoogleProvider) RefreshSessionIfNeeded(s *SessionState) (bool, error) {
260 return false, nil
260 return false, nil
261 }
261 }
262
262
263− newToken, duration, err := p.redeemRefreshToken(s.RefreshToken)
263+ newToken, newIDToken, duration, err := p.redeemRefreshToken(s.RefreshToken)
264 if err != nil {
264 if err != nil {
265 return false, err
265 return false, err
266 }
266 }
@@ -272,12 +272,13 @@ func (p *GoogleProvider) RefreshSessionIfNeeded(s *SessionState) (bool, error) {
272
272
273 origExpiration := s.ExpiresOn
273 origExpiration := s.ExpiresOn
274 s.AccessToken = newToken
274 s.AccessToken = newToken
275+ s.IDToken = newIDToken
275 s.ExpiresOn = time.Now().Add(duration).Truncate(time.Second)
276 s.ExpiresOn = time.Now().Add(duration).Truncate(time.Second)
276 log.Printf("refreshed access token %s (expired on %s)", s, origExpiration)
277 log.Printf("refreshed access token %s (expired on %s)", s, origExpiration)
277 return true, nil
278 return true, nil
278}
279}
279
280
280−func (p *GoogleProvider) redeemRefreshToken(refreshToken string) (token string, expires time.Duration, err error) {
281+func (p *GoogleProvider) redeemRefreshToken(refreshToken string) (token string, idToken string, expires time.Duration, err error) {
281 // https://developers.google.com/identity/protocols/OAuth2WebServer#refresh
282 // https://developers.google.com/identity/protocols/OAuth2WebServer#refresh
282 params := url.Values{}
283 params := url.Values{}
283 params.Add("client_id", p.ClientID)
284 params.Add("client_id", p.ClientID)
@@ -310,12 +311,14 @@ func (p *GoogleProvider) redeemRefreshToken(refreshToken string) (token string,
310 var data struct {
311 var data struct {
311 AccessToken string `json:"access_token"`
312 AccessToken string `json:"access_token"`
312 ExpiresIn int64 `json:"expires_in"`
313 ExpiresIn int64 `json:"expires_in"`
314+ IDToken string `json:"id_token"`
313 }
315 }
314 err = json.Unmarshal(body, &data)
316 err = json.Unmarshal(body, &data)
315 if err != nil {
317 if err != nil {
316 return
318 return
317 }
319 }
318 token = data.AccessToken
320 token = data.AccessToken
321+ idToken = data.IDToken
319 expires = time.Duration(data.ExpiresIn) * time.Second
322 expires = time.Duration(data.ExpiresIn) * time.Second
320 return
323 return
321}
324}