git.iko.soy/typeable/oauth2-proxy
on master help sign in
Deprecate UserIDClaim in config and docs
commiteb56f24d6dba6170fde7ec74731e105ac57d947f authorNick Meves <nick.meves@greenhouse.io> dateSat 28 Nov 2020, 12:33 (6 years ago) parent74ac427
7 files changed+26−14
compare with master
unifiedsplit
CHANGELOG.md+2 docs/docs/configuration/overview.md+2−2 pkg/apis/options/options.go+7−4 pkg/validation/options.go+8−4 providers/oidc.go+1−1 providers/provider_data.go+6−1 providers/provider_default.go−2
CHANGELOG.md+2
@@ -4,6 +4,7 @@
44
55## Important Notes
66
7+- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) `--user-id-claim` option is deprecated and replaced by `--oidc-email-claim`
78- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled
89- [#905](https://github.com/oauth2-proxy/oauth2-proxy/pull/905) Existing sessions from v6.0.0 or earlier are no longer valid. They will trigger a reauthentication.
910- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) `skip-auth-strip-headers` now applies to all requests, not just those where authentication would be skipped.
@@ -47,6 +48,7 @@
4748- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Add support for Gitlab project based authentication (@factorysh)
4849- [#907](https://github.com/oauth2-proxy/oauth2-proxy/pull/907) Introduce alpha configuration option to enable testing of structured configuration (@JoelSpeed)
4950- [#938](https://github.com/oauth2-proxy/oauth2-proxy/pull/938) Cleanup missed provider renaming refactor methods (@NickMeves)
51+- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) Refactor OIDC Provider and support groups from Profile URL (@NickMeves)
5052- [#925](https://github.com/oauth2-proxy/oauth2-proxy/pull/925) Fix basic auth legacy header conversion (@JoelSpeed)
5153- [#916](https://github.com/oauth2-proxy/oauth2-proxy/pull/916) Add AlphaOptions struct to prepare for alpha config loading (@JoelSpeed)
5254- [#923](https://github.com/oauth2-proxy/oauth2-proxy/pull/923) Support TLS 1.3 (@aajisaka)
docs/docs/configuration/overview.md+2−2
@@ -74,7 +74,8 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
7474| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
7575| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
7676| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
77−| `--oidc-groups-claim` | string | which claim contains the user groups | `"groups"` |
77+| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
78+| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
7879| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
7980| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
8081| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
@@ -128,7 +129,6 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
128129| `--tls-cert-file` | string | path to certificate file | |
129130| `--tls-key-file` | string | path to private key file | |
130131| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
131−| `--user-id-claim` | string | which claim contains the user ID | \["email"\] |
132132| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
133133| `--validate-url` | string | Access token validation endpoint | |
134134| `--version` | n/a | print version string | |
pkg/apis/options/options.go+7−4
@@ -87,6 +87,7 @@ type Options struct {
8787 InsecureOIDCSkipIssuerVerification bool `flag:"insecure-oidc-skip-issuer-verification" cfg:"insecure_oidc_skip_issuer_verification"`
8888 SkipOIDCDiscovery bool `flag:"skip-oidc-discovery" cfg:"skip_oidc_discovery"`
8989 OIDCJwksURL string `flag:"oidc-jwks-url" cfg:"oidc_jwks_url"`
90+ OIDCEmailClaim string `flag:"oidc-email-claim" cfg:"oidc_email_claim"`
9091 OIDCGroupsClaim string `flag:"oidc-groups-claim" cfg:"oidc_groups_claim"`
9192 LoginURL string `flag:"login-url" cfg:"login_url"`
9293 RedeemURL string `flag:"redeem-url" cfg:"redeem_url"`
@@ -148,11 +149,12 @@ func NewOptions() *Options {
148149 SkipAuthPreflight: false,
149150 Prompt: "", // Change to "login" when ApprovalPrompt officially deprecated
150151 ApprovalPrompt: "force",
151− UserIDClaim: "email",
152152 InsecureOIDCAllowUnverifiedEmail: false,
153153 SkipOIDCDiscovery: false,
154154 Logging: loggingDefaults(),
155− OIDCGroupsClaim: "groups",
155+ UserIDClaim: providers.OIDCEmailClaim, // Deprecated: Use OIDCEmailClaim
156+ OIDCEmailClaim: providers.OIDCEmailClaim,
157+ OIDCGroupsClaim: providers.OIDCGroupsClaim,
156158 }
157159}
158160
@@ -226,7 +228,8 @@ func NewFlagSet() *pflag.FlagSet {
226228 flagSet.Bool("insecure-oidc-skip-issuer-verification", false, "Do not verify if issuer matches OIDC discovery URL")
227229 flagSet.Bool("skip-oidc-discovery", false, "Skip OIDC discovery and use manually supplied Endpoints")
228230 flagSet.String("oidc-jwks-url", "", "OpenID Connect JWKS URL (ie: https://www.googleapis.com/oauth2/v3/certs)")
229− flagSet.String("oidc-groups-claim", "groups", "which claim contains the user groups")
231+ flagSet.String("oidc-groups-claim", providers.OIDCGroupsClaim, "which OIDC claim contains the user groups")
232+ flagSet.String("oidc-email-claim", providers.OIDCEmailClaim, "which OIDC claim contains the user's email")
230233 flagSet.String("login-url", "", "Authentication endpoint")
231234 flagSet.String("redeem-url", "", "Token redemption endpoint")
232235 flagSet.String("profile-url", "", "Profile access endpoint")
@@ -243,7 +246,7 @@ func NewFlagSet() *pflag.FlagSet {
243246 flagSet.String("pubjwk-url", "", "JWK pubkey access endpoint: required by login.gov")
244247 flagSet.Bool("gcp-healthchecks", false, "Enable GCP/GKE healthcheck endpoints")
245248
246− flagSet.String("user-id-claim", "email", "which claim contains the user ID")
249+ flagSet.String("user-id-claim", providers.OIDCEmailClaim, "(DEPRECATED for `oidc-email-claim`) which claim contains the user ID")
247250 flagSet.StringSlice("allowed-group", []string{}, "restrict logins to members of this group (may be given multiple times)")
248251
249252 flagSet.AddFlagSet(cookieFlagSet())
pkg/validation/options.go+8−4
@@ -235,10 +235,17 @@ func parseProviderInfo(o *options.Options, msgs []string) []string {
235235
236236 // Make the OIDC options available to all providers that support it
237237 p.AllowUnverifiedEmail = o.InsecureOIDCAllowUnverifiedEmail
238− p.EmailClaim = o.UserIDClaim
238+ p.EmailClaim = o.OIDCEmailClaim
239239 p.GroupsClaim = o.OIDCGroupsClaim
240240 p.Verifier = o.GetOIDCVerifier()
241241
242+ // TODO (@NickMeves) - Remove This
243+ // Backwards Compatibility for Deprecated UserIDClaim option
244+ if o.OIDCEmailClaim == providers.OIDCEmailClaim &&
245+ o.UserIDClaim != providers.OIDCEmailClaim {
246+ p.EmailClaim = o.UserIDClaim
247+ }
248+
242249 p.SetAllowedGroups(o.AllowedGroups)
243250
244251 provider := providers.New(o.ProviderType, p)
@@ -276,9 +283,6 @@ func parseProviderInfo(o *options.Options, msgs []string) []string {
276283 p.SetTeam(o.BitbucketTeam)
277284 p.SetRepository(o.BitbucketRepository)
278285 case *providers.OIDCProvider:
279− p.AllowUnverifiedEmail = o.InsecureOIDCAllowUnverifiedEmail
280− p.EmailClaim = o.UserIDClaim
281− p.GroupsClaim = o.OIDCGroupsClaim
282286 if p.Verifier == nil {
283287 msgs = append(msgs, "oidc provider requires an oidc issuer URL")
284288 }
providers/oidc.go+1−1
@@ -42,7 +42,7 @@ func (p *OIDCProvider) Redeem(ctx context.Context, redirectURL, code string) (*s
4242 }
4343 token, err := c.Exchange(ctx, code)
4444 if err != nil {
45− return nil, fmt.Errorf("token exchange failure: %v", err)
45+ return nil, fmt.Errorf("token exchange failed: %v", err)
4646 }
4747
4848 return p.createSession(ctx, token, false)
providers/provider_data.go+6−1
@@ -15,6 +15,11 @@ import (
1515 "golang.org/x/oauth2"
1616)
1717
18+const (
19+ OIDCEmailClaim = "email"
20+ OIDCGroupsClaim = "groups"
21+)
22+
1823// ProviderData contains information required to configure all implementations
1924// of OAuth2 providers
2025type ProviderData struct {
@@ -154,7 +159,7 @@ func (p *ProviderData) buildSessionFromClaims(idToken *oidc.IDToken) (*sessions.
154159
155160 // `email_verified` must be present and explicitly set to `false` to be
156161 // considered unverified.
157− verifyEmail := (p.EmailClaim == emailClaim) && !p.AllowUnverifiedEmail
162+ verifyEmail := (p.EmailClaim == OIDCEmailClaim) && !p.AllowUnverifiedEmail
158163 if verifyEmail && claims.Verified != nil && !*claims.Verified {
159164 return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)
160165 }
providers/provider_default.go−2
@@ -13,8 +13,6 @@ import (
1313 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
1414)
1515
16−const emailClaim = "email"
17−
1816var (
1917 // ErrNotImplemented is returned when a provider did not override a default
2018 // implementation method that doesn't have sensible defaults