git.iko.soy/typeable/oauth2-proxy
on master help sign in
Deprecate UserIDClaim in config and docs
eb56f24Nick Meves
CHANGELOG.md+2
compare with master
unifiedsplit
@@ -4,6 +4,7 @@
4
4
5## Important Notes
5## Important Notes
6
6
7+- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) `--user-id-claim` option is deprecated and replaced by `--oidc-email-claim`
7- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled
8- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Gitlab projects needs a Gitlab application with the extra `read_api` enabled
8- [#905](https://github.com/oauth2-proxy/oauth2-proxy/pull/905) Existing sessions from v6.0.0 or earlier are no longer valid. They will trigger a reauthentication.
9- [#905](https://github.com/oauth2-proxy/oauth2-proxy/pull/905) Existing sessions from v6.0.0 or earlier are no longer valid. They will trigger a reauthentication.
9- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) `skip-auth-strip-headers` now applies to all requests, not just those where authentication would be skipped.
10- [#826](https://github.com/oauth2-proxy/oauth2-proxy/pull/826) `skip-auth-strip-headers` now applies to all requests, not just those where authentication would be skipped.
@@ -47,6 +48,7 @@
47- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Add support for Gitlab project based authentication (@factorysh)
48- [#630](https://github.com/oauth2-proxy/oauth2-proxy/pull/630) Add support for Gitlab project based authentication (@factorysh)
48- [#907](https://github.com/oauth2-proxy/oauth2-proxy/pull/907) Introduce alpha configuration option to enable testing of structured configuration (@JoelSpeed)
49- [#907](https://github.com/oauth2-proxy/oauth2-proxy/pull/907) Introduce alpha configuration option to enable testing of structured configuration (@JoelSpeed)
49- [#938](https://github.com/oauth2-proxy/oauth2-proxy/pull/938) Cleanup missed provider renaming refactor methods (@NickMeves)
50- [#938](https://github.com/oauth2-proxy/oauth2-proxy/pull/938) Cleanup missed provider renaming refactor methods (@NickMeves)
51+- [#936](https://github.com/oauth2-proxy/oauth2-proxy/pull/936) Refactor OIDC Provider and support groups from Profile URL (@NickMeves)
50- [#925](https://github.com/oauth2-proxy/oauth2-proxy/pull/925) Fix basic auth legacy header conversion (@JoelSpeed)
52- [#925](https://github.com/oauth2-proxy/oauth2-proxy/pull/925) Fix basic auth legacy header conversion (@JoelSpeed)
51- [#916](https://github.com/oauth2-proxy/oauth2-proxy/pull/916) Add AlphaOptions struct to prepare for alpha config loading (@JoelSpeed)
53- [#916](https://github.com/oauth2-proxy/oauth2-proxy/pull/916) Add AlphaOptions struct to prepare for alpha config loading (@JoelSpeed)
52- [#923](https://github.com/oauth2-proxy/oauth2-proxy/pull/923) Support TLS 1.3 (@aajisaka)
54- [#923](https://github.com/oauth2-proxy/oauth2-proxy/pull/923) Support TLS 1.3 (@aajisaka)
docs/docs/configuration/overview.md+2−2
@@ -74,7 +74,8 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
74| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
74| `--insecure-oidc-skip-issuer-verification` | bool | allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility) | false |
75| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
75| `--oidc-issuer-url` | string | the OpenID Connect issuer URL, e.g. `"https://accounts.google.com"` | |
76| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
76| `--oidc-jwks-url` | string | OIDC JWKS URI for token verification; required if OIDC discovery is disabled | |
77+| `--oidc-email-claim` | string | which OIDC claim contains the user's email | `"email"` |
77−| `--oidc-groups-claim` | string | which claim contains the user groups | `"groups"` |
78+| `--oidc-groups-claim` | string | which OIDC claim contains the user groups | `"groups"` |
78| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
79| `--pass-access-token` | bool | pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with `--set-xauthrequest` this adds the X-Auth-Request-Access-Token header to the response | false |
79| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
80| `--pass-authorization-header` | bool | pass OIDC IDToken to upstream via Authorization Bearer header | false |
80| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
81| `--pass-basic-auth` | bool | pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream | true |
@@ -128,7 +129,6 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
128| `--tls-cert-file` | string | path to certificate file | |
129| `--tls-cert-file` | string | path to certificate file | |
129| `--tls-key-file` | string | path to private key file | |
130| `--tls-key-file` | string | path to private key file | |
130| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
131| `--upstream` | string \| list | the http url(s) of the upstream endpoint, file:// paths for static files or `static://<status_code>` for static response. Routing is based on the path | |
131−| `--user-id-claim` | string | which claim contains the user ID | \["email"\] |
132| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
132| `--allowed-group` | string \| list | restrict logins to members of this group (may be given multiple times) | |
133| `--validate-url` | string | Access token validation endpoint | |
133| `--validate-url` | string | Access token validation endpoint | |
134| `--version` | n/a | print version string | |
134| `--version` | n/a | print version string | |
pkg/apis/options/options.go+7−4
@@ -87,6 +87,7 @@ type Options struct {
87 InsecureOIDCSkipIssuerVerification bool `flag:"insecure-oidc-skip-issuer-verification" cfg:"insecure_oidc_skip_issuer_verification"`
87 InsecureOIDCSkipIssuerVerification bool `flag:"insecure-oidc-skip-issuer-verification" cfg:"insecure_oidc_skip_issuer_verification"`
88 SkipOIDCDiscovery bool `flag:"skip-oidc-discovery" cfg:"skip_oidc_discovery"`
88 SkipOIDCDiscovery bool `flag:"skip-oidc-discovery" cfg:"skip_oidc_discovery"`
89 OIDCJwksURL string `flag:"oidc-jwks-url" cfg:"oidc_jwks_url"`
89 OIDCJwksURL string `flag:"oidc-jwks-url" cfg:"oidc_jwks_url"`
90+ OIDCEmailClaim string `flag:"oidc-email-claim" cfg:"oidc_email_claim"`
90 OIDCGroupsClaim string `flag:"oidc-groups-claim" cfg:"oidc_groups_claim"`
91 OIDCGroupsClaim string `flag:"oidc-groups-claim" cfg:"oidc_groups_claim"`
91 LoginURL string `flag:"login-url" cfg:"login_url"`
92 LoginURL string `flag:"login-url" cfg:"login_url"`
92 RedeemURL string `flag:"redeem-url" cfg:"redeem_url"`
93 RedeemURL string `flag:"redeem-url" cfg:"redeem_url"`
@@ -148,11 +149,12 @@ func NewOptions() *Options {
148 SkipAuthPreflight: false,
149 SkipAuthPreflight: false,
149 Prompt: "", // Change to "login" when ApprovalPrompt officially deprecated
150 Prompt: "", // Change to "login" when ApprovalPrompt officially deprecated
150 ApprovalPrompt: "force",
151 ApprovalPrompt: "force",
151− UserIDClaim: "email",
152 InsecureOIDCAllowUnverifiedEmail: false,
152 InsecureOIDCAllowUnverifiedEmail: false,
153 SkipOIDCDiscovery: false,
153 SkipOIDCDiscovery: false,
154 Logging: loggingDefaults(),
154 Logging: loggingDefaults(),
155+ UserIDClaim: providers.OIDCEmailClaim, // Deprecated: Use OIDCEmailClaim
156+ OIDCEmailClaim: providers.OIDCEmailClaim,
155− OIDCGroupsClaim: "groups",
157+ OIDCGroupsClaim: providers.OIDCGroupsClaim,
156 }
158 }
157}
159}
158
160
@@ -226,7 +228,8 @@ func NewFlagSet() *pflag.FlagSet {
226 flagSet.Bool("insecure-oidc-skip-issuer-verification", false, "Do not verify if issuer matches OIDC discovery URL")
228 flagSet.Bool("insecure-oidc-skip-issuer-verification", false, "Do not verify if issuer matches OIDC discovery URL")
227 flagSet.Bool("skip-oidc-discovery", false, "Skip OIDC discovery and use manually supplied Endpoints")
229 flagSet.Bool("skip-oidc-discovery", false, "Skip OIDC discovery and use manually supplied Endpoints")
228 flagSet.String("oidc-jwks-url", "", "OpenID Connect JWKS URL (ie: https://www.googleapis.com/oauth2/v3/certs)")
230 flagSet.String("oidc-jwks-url", "", "OpenID Connect JWKS URL (ie: https://www.googleapis.com/oauth2/v3/certs)")
229− flagSet.String("oidc-groups-claim", "groups", "which claim contains the user groups")
231+ flagSet.String("oidc-groups-claim", providers.OIDCGroupsClaim, "which OIDC claim contains the user groups")
232+ flagSet.String("oidc-email-claim", providers.OIDCEmailClaim, "which OIDC claim contains the user's email")
230 flagSet.String("login-url", "", "Authentication endpoint")
233 flagSet.String("login-url", "", "Authentication endpoint")
231 flagSet.String("redeem-url", "", "Token redemption endpoint")
234 flagSet.String("redeem-url", "", "Token redemption endpoint")
232 flagSet.String("profile-url", "", "Profile access endpoint")
235 flagSet.String("profile-url", "", "Profile access endpoint")
@@ -243,7 +246,7 @@ func NewFlagSet() *pflag.FlagSet {
243 flagSet.String("pubjwk-url", "", "JWK pubkey access endpoint: required by login.gov")
246 flagSet.String("pubjwk-url", "", "JWK pubkey access endpoint: required by login.gov")
244 flagSet.Bool("gcp-healthchecks", false, "Enable GCP/GKE healthcheck endpoints")
247 flagSet.Bool("gcp-healthchecks", false, "Enable GCP/GKE healthcheck endpoints")
245
248
246− flagSet.String("user-id-claim", "email", "which claim contains the user ID")
249+ flagSet.String("user-id-claim", providers.OIDCEmailClaim, "(DEPRECATED for `oidc-email-claim`) which claim contains the user ID")
247 flagSet.StringSlice("allowed-group", []string{}, "restrict logins to members of this group (may be given multiple times)")
250 flagSet.StringSlice("allowed-group", []string{}, "restrict logins to members of this group (may be given multiple times)")
248
251
249 flagSet.AddFlagSet(cookieFlagSet())
252 flagSet.AddFlagSet(cookieFlagSet())
pkg/validation/options.go+8−4
@@ -235,10 +235,17 @@ func parseProviderInfo(o *options.Options, msgs []string) []string {
235
235
236 // Make the OIDC options available to all providers that support it
236 // Make the OIDC options available to all providers that support it
237 p.AllowUnverifiedEmail = o.InsecureOIDCAllowUnverifiedEmail
237 p.AllowUnverifiedEmail = o.InsecureOIDCAllowUnverifiedEmail
238− p.EmailClaim = o.UserIDClaim
238+ p.EmailClaim = o.OIDCEmailClaim
239 p.GroupsClaim = o.OIDCGroupsClaim
239 p.GroupsClaim = o.OIDCGroupsClaim
240 p.Verifier = o.GetOIDCVerifier()
240 p.Verifier = o.GetOIDCVerifier()
241
241
242+ // TODO (@NickMeves) - Remove This
243+ // Backwards Compatibility for Deprecated UserIDClaim option
244+ if o.OIDCEmailClaim == providers.OIDCEmailClaim &&
245+ o.UserIDClaim != providers.OIDCEmailClaim {
246+ p.EmailClaim = o.UserIDClaim
247+ }
248+
242 p.SetAllowedGroups(o.AllowedGroups)
249 p.SetAllowedGroups(o.AllowedGroups)
243
250
244 provider := providers.New(o.ProviderType, p)
251 provider := providers.New(o.ProviderType, p)
@@ -276,9 +283,6 @@ func parseProviderInfo(o *options.Options, msgs []string) []string {
276 p.SetTeam(o.BitbucketTeam)
283 p.SetTeam(o.BitbucketTeam)
277 p.SetRepository(o.BitbucketRepository)
284 p.SetRepository(o.BitbucketRepository)
278 case *providers.OIDCProvider:
285 case *providers.OIDCProvider:
279− p.AllowUnverifiedEmail = o.InsecureOIDCAllowUnverifiedEmail
280− p.EmailClaim = o.UserIDClaim
281− p.GroupsClaim = o.OIDCGroupsClaim
282 if p.Verifier == nil {
286 if p.Verifier == nil {
283 msgs = append(msgs, "oidc provider requires an oidc issuer URL")
287 msgs = append(msgs, "oidc provider requires an oidc issuer URL")
284 }
288 }
providers/oidc.go+1−1
@@ -42,7 +42,7 @@ func (p *OIDCProvider) Redeem(ctx context.Context, redirectURL, code string) (*s
42 }
42 }
43 token, err := c.Exchange(ctx, code)
43 token, err := c.Exchange(ctx, code)
44 if err != nil {
44 if err != nil {
45− return nil, fmt.Errorf("token exchange failure: %v", err)
45+ return nil, fmt.Errorf("token exchange failed: %v", err)
46 }
46 }
47
47
48 return p.createSession(ctx, token, false)
48 return p.createSession(ctx, token, false)
providers/provider_data.go+6−1
@@ -15,6 +15,11 @@ import (
15 "golang.org/x/oauth2"
15 "golang.org/x/oauth2"
16)
16)
17
17
18+const (
19+ OIDCEmailClaim = "email"
20+ OIDCGroupsClaim = "groups"
21+)
22+
18// ProviderData contains information required to configure all implementations
23// ProviderData contains information required to configure all implementations
19// of OAuth2 providers
24// of OAuth2 providers
20type ProviderData struct {
25type ProviderData struct {
@@ -154,7 +159,7 @@ func (p *ProviderData) buildSessionFromClaims(idToken *oidc.IDToken) (*sessions.
154
159
155 // `email_verified` must be present and explicitly set to `false` to be
160 // `email_verified` must be present and explicitly set to `false` to be
156 // considered unverified.
161 // considered unverified.
157− verifyEmail := (p.EmailClaim == emailClaim) && !p.AllowUnverifiedEmail
162+ verifyEmail := (p.EmailClaim == OIDCEmailClaim) && !p.AllowUnverifiedEmail
158 if verifyEmail && claims.Verified != nil && !*claims.Verified {
163 if verifyEmail && claims.Verified != nil && !*claims.Verified {
159 return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)
164 return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)
160 }
165 }
providers/provider_default.go−2
@@ -13,8 +13,6 @@ import (
13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
13 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
14)
14)
15
15
16−const emailClaim = "email"
17−
18var (
16var (
19 // ErrNotImplemented is returned when a provider did not override a default
17 // ErrNotImplemented is returned when a provider did not override a default
20 // implementation method that doesn't have sensible defaults
18 // implementation method that doesn't have sensible defaults