git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #869 from grnhse/streamline-provider-naming

Streamline Provider Interface & Bearer Session Handlers

commitf6ae15e8c37b15c7cc29332c1f070a06bc503dc7 authorNick Meves <nick.meves@greenhouse.io> dateSat 28 Nov 2020, 10:30 (6 years ago) parent270690957a8ef0
23 files changed+299−228
compare with master
unifiedsplit
CHANGELOG.md+3−2 go.mod+4−3 go.sum+69 oauthproxy.go+51−61 oauthproxy_test.go+1−1 pkg/apis/middleware/session.go+46−12 pkg/middleware/jwt_session.go+16−57 pkg/middleware/jwt_session_test.go+54−39 pkg/validation/options.go+5−6 providers/digitalocean.go+1−1 providers/facebook.go+1−1 providers/github.go+2−2 providers/gitlab.go+2−2 providers/gitlab_test.go+6−6 providers/google.go+1−1 providers/internal_util_test.go+1−1 providers/linkedin.go+1−1 providers/oidc.go+9−5 providers/oidc_test.go+8−14 providers/provider_data.go+2 providers/provider_default.go+8−7 providers/provider_default_test.go+5−2 providers/providers.go+3−4
CHANGELOG.md+3−2
@@ -43,11 +43,12 @@
4343
4444## Changes since v6.1.1
4545
46−- [#925](https://github.com/oauth2-proxy/oauth2-rpoxy/pull/925) Fix basic auth legacy header conversion (@JoelSpeed)
47−- [#916](https://github.com/oauth2-proxy/oauth2-rpoxy/pull/916) Add AlphaOptions struct to prepare for alpha config loading (@JoelSpeed)
46+- [#925](https://github.com/oauth2-proxy/oauth2-proxy/pull/925) Fix basic auth legacy header conversion (@JoelSpeed)
47+- [#916](https://github.com/oauth2-proxy/oauth2-proxy/pull/916) Add AlphaOptions struct to prepare for alpha config loading (@JoelSpeed)
4848- [#923](https://github.com/oauth2-proxy/oauth2-proxy/pull/923) Support TLS 1.3 (@aajisaka)
4949- [#918](https://github.com/oauth2-proxy/oauth2-proxy/pull/918) Fix log header output (@JoelSpeed)
5050- [#911](https://github.com/oauth2-proxy/oauth2-proxy/pull/911) Validate provider type on startup.
51+- [#869](https://github.com/oauth2-proxy/oauth2-proxy/pull/869) Streamline provider interface method names and signatures (@NickMeves)
5152- [#906](https://github.com/oauth2-proxy/oauth2-proxy/pull/906) Set up v6.1.x versioned documentation as default documentation (@JoelSpeed)
5253- [#905](https://github.com/oauth2-proxy/oauth2-proxy/pull/905) Remove v5 legacy sessions support (@NickMeves)
5354- [#904](https://github.com/oauth2-proxy/oauth2-proxy/pull/904) Set `skip-auth-strip-headers` to `true` by default (@NickMeves)
go.mod+4−3
@@ -19,15 +19,16 @@ require (
1919 github.com/onsi/gomega v1.10.2
2020 github.com/pierrec/lz4 v2.5.2+incompatible
2121 github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
22− github.com/spf13/pflag v1.0.3
22+ github.com/spf13/pflag v1.0.5
2323 github.com/spf13/viper v1.6.3
2424 github.com/stretchr/testify v1.6.1
2525 github.com/vmihailenco/msgpack/v4 v4.3.11
2626 github.com/yhat/wsutil v0.0.0-20170731153501-1d66fa95c997
27− golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2
28− golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7
27+ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
28+ golang.org/x/net v0.0.0-20200707034311-ab3426394381
2929 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
3030 google.golang.org/api v0.20.0
3131 gopkg.in/natefinch/lumberjack.v2 v2.0.0
3232 gopkg.in/square/go-jose.v2 v2.4.1
33+ k8s.io/apimachinery v0.19.3
3334)
go.sum+69
@@ -8,7 +8,10 @@ github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ
88github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
99github.com/FZambia/sentinel v1.0.0 h1:KJ0ryjKTZk5WMp0dXvSdNqp3lFaW1fNFuEYfrkLOYIc=
1010github.com/FZambia/sentinel v1.0.0/go.mod h1:ytL1Am/RLlAoAXG6Kj5LNuw/TRRQrv2rt2FT26vP5gI=
11+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
1112github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
13+github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
14+github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
1215github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
1316github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
1417github.com/alicebob/gopher-json v0.0.0-20180125190556-5a6b3ba71ee6/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
@@ -48,36 +51,52 @@ github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZm
4851github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
4952github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
5053github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
54+github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
55+github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
56+github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
57+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
5158github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
5259github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
60+github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
5361github.com/frankban/quicktest v1.10.0 h1:Gfh+GAJZOAoKZsIZeZbdn2JF10kN1XHNvjsvQK8gVkE=
5462github.com/frankban/quicktest v1.10.0/go.mod h1:ui7WezCLWMWxVWr1GETZY3smRy0G4KWq9vcPtJmFl7Y=
5563github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
5664github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
5765github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
66+github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
5867github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
5968github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
6069github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
6170github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
71+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
72+github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
73+github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
74+github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
75+github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
76+github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
6277github.com/go-redis/redis/v8 v8.2.3 h1:eNesND+DWt/sjQOtPFxAbQkTIXaXX00qNLxjVWkZ70k=
6378github.com/go-redis/redis/v8 v8.2.3/go.mod h1:ysgGY09J/QeDYbu3HikWEIPCwaeOkuNoTgKayTEaEOw=
6479github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
6580github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
6681github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
82+github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
6783github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
6884github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
6985github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
86+github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
7087github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
7188github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
7289github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
7390github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
7491github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
92+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
7593github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
7694github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
7795github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
7896github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
7997github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
8098github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
99+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
81100github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
82101github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
83102github.com/gomodule/redigo v1.7.1-0.20190322064113-39e2c31b7ca3/go.mod h1:B4C85qUVwatsJoIUNIfCRsp7qO0iAmpGFZ4EELWSbC4=
@@ -92,6 +111,7 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
92111github.com/google/go-cmp v0.5.1 h1:JFrFEBb2xKufg6XkJsJr+WbKb4FQlURi5RUcBveYu9k=
93112github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
94113github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
114+github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
95115github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
96116github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
97117github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
@@ -99,6 +119,7 @@ github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
99119github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
100120github.com/googleapis/gax-go/v2 v2.0.5 h1:sjZBwGj9Jlw33ImPtvFviGYvseOtDM7hkSKB7+Tv3SM=
101121github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
122+github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg=
102123github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
103124github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
104125github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
@@ -112,7 +133,9 @@ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
112133github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
113134github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
114135github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
136+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
115137github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
138+github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
116139github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
117140github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
118141github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
@@ -120,6 +143,7 @@ github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7V
120143github.com/justinas/alice v1.2.0 h1:+MHSA/vccVCF4Uq37S42jwlkvI2Xzl7zTPCN5BnZNVo=
121144github.com/justinas/alice v1.2.0/go.mod h1:fN5HRH/reO/zrUflLfTN43t3vXvKzvZIENsNEe7i7qA=
122145github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
146+github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
123147github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
124148github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
125149github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
@@ -131,6 +155,7 @@ github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
131155github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
132156github.com/magiconair/properties v1.8.1 h1:ZC2Vc7/ZFkGmsVC9KvOjumD+G5lXy2RtTKyzRKO2BQ4=
133157github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
158+github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
134159github.com/matryer/is v1.2.0 h1:92UTHpy8CDwaJ08GqLDzhhuixiBUUD1p3AU6PHddz4A=
135160github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
136161github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
@@ -139,16 +164,23 @@ github.com/mbland/hmacauth v0.0.0-20170912233209-44256dfd4bfa/go.mod h1:8vxFeeg+
139164github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
140165github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
141166github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
167+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
142168github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
143169github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
170+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
144171github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
172+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
145173github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78=
146174github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
147175github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
176+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
148177github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
178+github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
149179github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
150180github.com/onsi/ginkgo v1.14.1 h1:jMU0WaQrP0a/YAEq8eJmJKjBoMs+pClEr1vDMlM/Do4=
151181github.com/onsi/ginkgo v1.14.1/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
182+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
183+github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
152184github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
153185github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
154186github.com/onsi/gomega v1.10.2 h1:aY/nuoWlKJud2J6U0E3NWsjlg+0GtwXxgEqthRdzlcs=
@@ -158,6 +190,7 @@ github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/9
158190github.com/pierrec/lz4 v2.5.2+incompatible h1:WCjObylUIOlKy/+7Abdn34TLIkXiA4UWUMhxq9m9ZXI=
159191github.com/pierrec/lz4 v2.5.2+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
160192github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
193+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
161194github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
162195github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
163196github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 h1:J9b7z+QKAmPf4YLrFg6oQUotqHQeUNWwkvo7jZp1GLU=
@@ -186,14 +219,18 @@ github.com/spf13/cast v1.3.0 h1:oget//CVOEoFewqQxwr0Ej5yjygnqGkvggSE/gB35Q8=
186219github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
187220github.com/spf13/jwalterweatherman v1.0.0 h1:XHEdyB+EcvlqZamSM4ZOMGlc93t6AcsBEu9Gc1vn7yk=
188221github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
222+github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
189223github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazDkg=
190224github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
225+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
226+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
191227github.com/spf13/viper v1.6.3 h1:pDDu1OyEDTKzpJwdq4TiuLyMsUgRa/BT5cn5O62NoHs=
192228github.com/spf13/viper v1.6.3/go.mod h1:jUMtyi0/lB5yZH/FjyGAoH7IMNrIhlBf6pXZmbMDvzw=
193229github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
194230github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
195231github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
196232github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
233+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
197234github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
198235github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
199236github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -223,6 +260,8 @@ go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
223260golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
224261golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2 h1:VklqNMn3ovrHsnt90PveolxSbWFaJdECFbxSq0Mqo2M=
225262golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
263+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
264+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
226265golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
227266golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
228267golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
@@ -237,12 +276,16 @@ golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73r
237276golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
238277golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
239278golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
279+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
240280golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
241281golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
242282golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
243283golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
284+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
244285golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 h1:AeiKBIuRw3UomYXSbLy0Mc2dDLfdtbT/IVn4keq83P0=
245286golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
287+golang.org/x/net v0.0.0-20200707034311-ab3426394381 h1:VXak5I6aEWmAXeQjA+QSZzlgNrpq9mjcfDemuexIKsU=
288+golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
246289golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
247290golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
248291golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -260,6 +303,7 @@ golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5h
260303golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
261304golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
262305golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
306+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
263307golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
264308golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
265309golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -267,14 +311,20 @@ golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7w
267311golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
268312golang.org/x/sys v0.0.0-20200519105757-fe76b779f299 h1:DYfZAGf2WMFjMxbgTjaC+2HC7NkNAQs+6Q8b9WEB/F4=
269313golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
314+golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4 h1:5/PjkGUjvEU5Gl6BxmvKRPpqo2uNMv4rcHBMwzk/st8=
315+golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
270316golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
271317golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
272318golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
273319golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
320+golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
321+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
274322golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
275323golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
276324golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
277325golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
326+golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
327+golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
278328golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
279329golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
280330golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
@@ -296,6 +346,8 @@ google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRn
296346google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
297347google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55 h1:gSJIx1SDwno+2ElGhA4+qG2zF97qiUzTM+rQ0klBOcE=
298348google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
349+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013 h1:+kGHl1aib/qcwaRi1CbqBZ1rk19r85MNUf8HaBghugY=
350+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
299351google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
300352google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
301353google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
@@ -306,13 +358,20 @@ google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ
306358google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
307359google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
308360google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
361+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
309362google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
310363google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
364+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
365+google.golang.org/protobuf v1.24.0 h1:UhZDfRO8JRQru4/+LlLE0BRKGF8L+PICnvYZmx/fEGA=
366+google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
311367gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
312368gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
313369gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
314370gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
371+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
372+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
315373gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
374+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
316375gopkg.in/ini.v1 v1.51.0 h1:AQvPpx3LzTDM0AjnIRlVFwFFGC+npRopjZxLJj6gdno=
317376gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
318377gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
@@ -326,6 +385,7 @@ gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bl
326385gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
327386gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
328387gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
388+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
329389gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
330390gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
331391gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
@@ -333,3 +393,12 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
333393honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
334394honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
335395honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
396+k8s.io/apimachinery v0.19.3 h1:bpIQXlKjB4cB/oNpnNnV+BybGPR7iP5oYpsOTEJ4hgc=
397+k8s.io/apimachinery v0.19.3/go.mod h1:DnPGDnARWFvYa3pMHgSxtbZb7gpzzAZ1pTfaUNDVlmA=
398+k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
399+k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
400+k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
401+k8s.io/kube-openapi v0.0.0-20200805222855-6aeccd4b50c6/go.mod h1:UuqjUnNftUyPE5H64/qeyjQoUZhGpeFDVdxjTeEVN2o=
402+sigs.k8s.io/structured-merge-diff/v4 v4.0.1/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
403+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
404+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
oauthproxy.go+51−61
@@ -13,7 +13,6 @@ import (
1313 "strings"
1414 "time"
1515
16− "github.com/coreos/go-oidc"
1716 "github.com/justinas/alice"
1817 ipapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/ip"
1918 middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
@@ -78,36 +77,34 @@ type OAuthProxy struct {
7877 AuthOnlyPath string
7978 UserInfoPath string
8079
81− allowedRoutes []allowedRoute
82− redirectURL *url.URL // the url to receive requests at
83− whitelistDomains []string
84− provider providers.Provider
85− providerNameOverride string
86− sessionStore sessionsapi.SessionStore
87− ProxyPrefix string
88− SignInMessage string
89− basicAuthValidator basic.Validator
90− displayHtpasswdForm bool
91− serveMux http.Handler
92− SetXAuthRequest bool
93− PassBasicAuth bool
94− SetBasicAuth bool
95− SkipProviderButton bool
96− PassUserHeaders bool
97− BasicAuthPassword string
98− PassAccessToken bool
99− SetAuthorization bool
100− PassAuthorization bool
101− PreferEmailToUser bool
102− skipAuthPreflight bool
103− skipJwtBearerTokens bool
104− mainJwtBearerVerifier *oidc.IDTokenVerifier
105− extraJwtBearerVerifiers []*oidc.IDTokenVerifier
106− templates *template.Template
107− realClientIPParser ipapi.RealClientIPParser
108− trustedIPs *ip.NetSet
109− Banner string
110− Footer string
80+ allowedRoutes []allowedRoute
81+ redirectURL *url.URL // the url to receive requests at
82+ whitelistDomains []string
83+ provider providers.Provider
84+ providerNameOverride string
85+ sessionStore sessionsapi.SessionStore
86+ ProxyPrefix string
87+ SignInMessage string
88+ basicAuthValidator basic.Validator
89+ displayHtpasswdForm bool
90+ serveMux http.Handler
91+ SetXAuthRequest bool
92+ PassBasicAuth bool
93+ SetBasicAuth bool
94+ SkipProviderButton bool
95+ PassUserHeaders bool
96+ BasicAuthPassword string
97+ PassAccessToken bool
98+ SetAuthorization bool
99+ PassAuthorization bool
100+ PreferEmailToUser bool
101+ skipAuthPreflight bool
102+ skipJwtBearerTokens bool
103+ templates *template.Template
104+ realClientIPParser ipapi.RealClientIPParser
105+ trustedIPs *ip.NetSet
106+ Banner string
107+ Footer string
111108
112109 sessionChain alice.Chain
113110 headersChain alice.Chain
@@ -202,25 +199,23 @@ func NewOAuthProxy(opts *options.Options, validator func(string) bool) (*OAuthPr
202199 AuthOnlyPath: fmt.Sprintf("%s/auth", opts.ProxyPrefix),
203200 UserInfoPath: fmt.Sprintf("%s/userinfo", opts.ProxyPrefix),
204201
205− ProxyPrefix: opts.ProxyPrefix,
206− provider: opts.GetProvider(),
207− providerNameOverride: opts.ProviderName,
208− sessionStore: sessionStore,
209− serveMux: upstreamProxy,
210− redirectURL: redirectURL,
211− allowedRoutes: allowedRoutes,
212− whitelistDomains: opts.WhitelistDomains,
213− skipAuthPreflight: opts.SkipAuthPreflight,
214− skipJwtBearerTokens: opts.SkipJwtBearerTokens,
215− mainJwtBearerVerifier: opts.GetOIDCVerifier(),
216− extraJwtBearerVerifiers: opts.GetJWTBearerVerifiers(),
217− realClientIPParser: opts.GetRealClientIPParser(),
218− SkipProviderButton: opts.SkipProviderButton,
219− templates: templates,
220− trustedIPs: trustedIPs,
221− Banner: opts.Banner,
222− Footer: opts.Footer,
223− SignInMessage: buildSignInMessage(opts),
202+ ProxyPrefix: opts.ProxyPrefix,
203+ provider: opts.GetProvider(),
204+ providerNameOverride: opts.ProviderName,
205+ sessionStore: sessionStore,
206+ serveMux: upstreamProxy,
207+ redirectURL: redirectURL,
208+ allowedRoutes: allowedRoutes,
209+ whitelistDomains: opts.WhitelistDomains,
210+ skipAuthPreflight: opts.SkipAuthPreflight,
211+ skipJwtBearerTokens: opts.SkipJwtBearerTokens,
212+ realClientIPParser: opts.GetRealClientIPParser(),
213+ SkipProviderButton: opts.SkipProviderButton,
214+ templates: templates,
215+ trustedIPs: trustedIPs,
216+ Banner: opts.Banner,
217+ Footer: opts.Footer,
218+ SignInMessage: buildSignInMessage(opts),
224219
225220 basicAuthValidator: basicAuthValidator,
226221 displayHtpasswdForm: basicAuthValidator != nil && opts.DisplayHtpasswdForm,
@@ -266,18 +261,13 @@ func buildSessionChain(opts *options.Options, sessionStore sessionsapi.SessionSt
266261 chain := alice.New()
267262
268263 if opts.SkipJwtBearerTokens {
269− sessionLoaders := []middlewareapi.TokenToSessionLoader{}
270− if opts.GetOIDCVerifier() != nil {
271− sessionLoaders = append(sessionLoaders, middlewareapi.TokenToSessionLoader{
272− Verifier: opts.GetOIDCVerifier(),
273− TokenToSession: opts.GetProvider().CreateSessionStateFromBearerToken,
274− })
264+ sessionLoaders := []middlewareapi.TokenToSessionFunc{
265+ opts.GetProvider().CreateSessionFromToken,
275266 }
276267
277268 for _, verifier := range opts.GetJWTBearerVerifiers() {
278− sessionLoaders = append(sessionLoaders, middlewareapi.TokenToSessionLoader{
279− Verifier: verifier,
280− })
269+ sessionLoaders = append(sessionLoaders,
270+ middlewareapi.CreateTokenToSessionFunc(verifier.Verify))
281271 }
282272
283273 chain = chain.Append(middleware.NewJwtSessionLoader(sessionLoaders))
@@ -291,7 +281,7 @@ func buildSessionChain(opts *options.Options, sessionStore sessionsapi.SessionSt
291281 SessionStore: sessionStore,
292282 RefreshPeriod: opts.Cookie.Refresh,
293283 RefreshSessionIfNeeded: opts.GetProvider().RefreshSessionIfNeeded,
294− ValidateSessionState: opts.GetProvider().ValidateSessionState,
284+ ValidateSessionState: opts.GetProvider().ValidateSession,
295285 }))
296286
297287 return chain
@@ -416,7 +406,7 @@ func (p *OAuthProxy) enrichSessionState(ctx context.Context, s *sessionsapi.Sess
416406 }
417407 }
418408
419− return p.provider.EnrichSessionState(ctx, s)
409+ return p.provider.EnrichSession(ctx, s)
420410}
421411
422412// MakeCSRFCookie creates a cookie for CSRF
oauthproxy_test.go+1−1
@@ -400,7 +400,7 @@ func (tp *TestProvider) GetEmailAddress(_ context.Context, _ *sessions.SessionSt
400400 return tp.EmailAddress, nil
401401}
402402
403−func (tp *TestProvider) ValidateSessionState(_ context.Context, _ *sessions.SessionState) bool {
403+func (tp *TestProvider) ValidateSession(_ context.Context, _ *sessions.SessionState) bool {
404404 return tp.ValidToken
405405}
406406
pkg/apis/middleware/session.go+46−12
@@ -2,23 +2,57 @@ package middleware
22
33import (
44 "context"
5+ "fmt"
56
67 "github.com/coreos/go-oidc"
78 sessionsapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
89)
910
10−// TokenToSessionFunc takes a rawIDToken and an idToken and converts it into a
11−// SessionState.
12−type TokenToSessionFunc func(ctx context.Context, rawIDToken string, idToken *oidc.IDToken) (*sessionsapi.SessionState, error)
11+// TokenToSessionFunc takes a raw ID Token and converts it into a SessionState.
12+type TokenToSessionFunc func(ctx context.Context, token string) (*sessionsapi.SessionState, error)
1313
14−// TokenToSessionLoader pairs a token verifier with the correct converter function
15−// to convert the ID Token to a SessionState.
16−type TokenToSessionLoader struct {
17− // Verfier is used to verify that the ID Token was signed by the claimed issuer
18− // and that the token has not been tampered with.
19− Verifier *oidc.IDTokenVerifier
14+// VerifyFunc takes a raw bearer token and verifies it returning the converted
15+// oidc.IDToken representation of the token.
16+type VerifyFunc func(ctx context.Context, token string) (*oidc.IDToken, error)
2017
21− // TokenToSession converts a rawIDToken and an idToken to a SessionState.
22− // (Optional) If not set a default basic implementation is used.
23− TokenToSession TokenToSessionFunc
18+// CreateTokenToSessionFunc provides a handler that is a default implementation
19+// for converting a JWT into a session.
20+func CreateTokenToSessionFunc(verify VerifyFunc) TokenToSessionFunc {
21+ return func(ctx context.Context, token string) (*sessionsapi.SessionState, error) {
22+ var claims struct {
23+ Subject string `json:"sub"`
24+ Email string `json:"email"`
25+ Verified *bool `json:"email_verified"`
26+ PreferredUsername string `json:"preferred_username"`
27+ }
28+
29+ idToken, err := verify(ctx, token)
30+ if err != nil {
31+ return nil, err
32+ }
33+
34+ if err := idToken.Claims(&claims); err != nil {
35+ return nil, fmt.Errorf("failed to parse bearer token claims: %v", err)
36+ }
37+
38+ if claims.Email == "" {
39+ claims.Email = claims.Subject
40+ }
41+
42+ if claims.Verified != nil && !*claims.Verified {
43+ return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)
44+ }
45+
46+ newSession := &sessionsapi.SessionState{
47+ Email: claims.Email,
48+ User: claims.Subject,
49+ PreferredUsername: claims.PreferredUsername,
50+ AccessToken: token,
51+ IDToken: token,
52+ RefreshToken: "",
53+ ExpiresOn: &idToken.Expiry,
54+ }
55+
56+ return newSession, nil
57+ }
2458}
pkg/middleware/jwt_session.go+16−57
@@ -1,30 +1,21 @@
11package middleware
22
33import (
4− "context"
4+ "errors"
55 "fmt"
66 "net/http"
77 "regexp"
88
9− "github.com/coreos/go-oidc"
109 "github.com/justinas/alice"
1110 middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
1211 sessionsapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
1312 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
13+ k8serrors "k8s.io/apimachinery/pkg/util/errors"
1414)
1515
16−const jwtRegexFormat = `^eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$`
17−
18−func NewJwtSessionLoader(sessionLoaders []middlewareapi.TokenToSessionLoader) alice.Constructor {
19− for i, loader := range sessionLoaders {
20− if loader.TokenToSession == nil {
21− sessionLoaders[i] = middlewareapi.TokenToSessionLoader{
22− Verifier: loader.Verifier,
23− TokenToSession: createSessionStateFromBearerToken,
24− }
25− }
26− }
16+const jwtRegexFormat = `^ey[IJ][a-zA-Z0-9_-]*\.ey[IJ][a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+$`
2717
18+func NewJwtSessionLoader(sessionLoaders []middlewareapi.TokenToSessionFunc) alice.Constructor {
2819 js := &jwtSessionLoader{
2920 jwtRegex: regexp.MustCompile(jwtRegexFormat),
3021 sessionLoaders: sessionLoaders,
@@ -36,7 +27,7 @@ func NewJwtSessionLoader(sessionLoaders []middlewareapi.TokenToSessionLoader) al
3627// Authorization headers.
3728type jwtSessionLoader struct {
3829 jwtRegex *regexp.Regexp
39− sessionLoaders []middlewareapi.TokenToSessionLoader
30+ sessionLoaders []middlewareapi.TokenToSessionFunc
4031}
4132
4233// loadSession attempts to load a session from a JWT stored in an Authorization
@@ -75,24 +66,27 @@ func (j *jwtSessionLoader) getJwtSession(req *http.Request) (*sessionsapi.Sessio
7566 return nil, nil
7667 }
7768
78− rawBearerToken, err := j.findBearerTokenFromHeader(auth)
69+ token, err := j.findTokenFromHeader(auth)
7970 if err != nil {
8071 return nil, err
8172 }
8273
74+ // This leading error message only occurs if all session loaders fail
75+ errs := []error{errors.New("unable to verify bearer token")}
8376 for _, loader := range j.sessionLoaders {
84− bearerToken, err := loader.Verifier.Verify(req.Context(), rawBearerToken)
85− if err == nil {
86− // The token was verified, convert it to a session
87− return loader.TokenToSession(req.Context(), rawBearerToken, bearerToken)
77+ session, err := loader(req.Context(), token)
78+ if err != nil {
79+ errs = append(errs, err)
80+ continue
8881 }
82+ return session, nil
8983 }
9084
91− return nil, fmt.Errorf("unable to verify jwt token: %q", req.Header.Get("Authorization"))
85+ return nil, k8serrors.NewAggregate(errs)
9286}
9387
94−// findBearerTokenFromHeader finds a valid JWT token from the Authorization header of a given request.
95−func (j *jwtSessionLoader) findBearerTokenFromHeader(header string) (string, error) {
88+// findTokenFromHeader finds a valid JWT token from the Authorization header of a given request.
89+func (j *jwtSessionLoader) findTokenFromHeader(header string) (string, error) {
9690 tokenType, token, err := splitAuthHeader(header)
9791 if err != nil {
9892 return "", err
@@ -132,38 +126,3 @@ func (j *jwtSessionLoader) getBasicToken(token string) (string, error) {
132126
133127 return "", fmt.Errorf("invalid basic auth token found in authorization header")
134128}
135−
136−// createSessionStateFromBearerToken is a default implementation for converting
137−// a JWT into a session state.
138−func createSessionStateFromBearerToken(ctx context.Context, rawIDToken string, idToken *oidc.IDToken) (*sessionsapi.SessionState, error) {
139− var claims struct {
140− Subject string `json:"sub"`
141− Email string `json:"email"`
142− Verified *bool `json:"email_verified"`
143− PreferredUsername string `json:"preferred_username"`
144− }
145−
146− if err := idToken.Claims(&claims); err != nil {
147− return nil, fmt.Errorf("failed to parse bearer token claims: %v", err)
148− }
149−
150− if claims.Email == "" {
151− claims.Email = claims.Subject
152− }
153−
154− if claims.Verified != nil && !*claims.Verified {
155− return nil, fmt.Errorf("email in id_token (%s) isn't verified", claims.Email)
156− }
157−
158− newSession := &sessionsapi.SessionState{
159− Email: claims.Email,
160− User: claims.Subject,
161− PreferredUsername: claims.PreferredUsername,
162− AccessToken: rawIDToken,
163− IDToken: rawIDToken,
164− RefreshToken: "",
165− ExpiresOn: &idToken.Expiry,
166− }
167−
168− return newSession, nil
169−}
pkg/middleware/jwt_session_test.go+54−39
@@ -20,12 +20,13 @@ import (
2020 . "github.com/onsi/ginkgo"
2121 . "github.com/onsi/ginkgo/extensions/table"
2222 . "github.com/onsi/gomega"
23+ k8serrors "k8s.io/apimachinery/pkg/util/errors"
2324)
2425
2526type noOpKeySet struct {
2627}
2728
28−func (noOpKeySet) VerifySignature(ctx context.Context, jwt string) (payload []byte, err error) {
29+func (noOpKeySet) VerifySignature(_ context.Context, jwt string) (payload []byte, err error) {
2930 splitStrings := strings.Split(jwt, ".")
3031 payloadString := splitStrings[1]
3132 return base64.RawURLEncoding.DecodeString(payloadString)
@@ -73,13 +74,18 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
7374 const validToken = "eyJfoobar.eyJfoobar.12345asdf"
7475
7576 Context("JwtSessionLoader", func() {
76− var verifier *oidc.IDTokenVerifier
77+ var verifier middlewareapi.VerifyFunc
7778 const nonVerifiedToken = validToken
7879
7980 BeforeEach(func() {
80− keyset := noOpKeySet{}
81− verifier = oidc.NewVerifier("https://issuer.example.com", keyset,
82− &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
81+ verifier = oidc.NewVerifier(
82+ "https://issuer.example.com",
83+ noOpKeySet{},
84+ &oidc.Config{
85+ ClientID: "https://test.myapp.com",
86+ SkipExpiryCheck: true,
87+ },
88+ ).Verify
8389 })
8490
8591 type jwtSessionLoaderTableInput struct {
@@ -102,10 +108,8 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
102108
103109 rw := httptest.NewRecorder()
104110
105− sessionLoaders := []middlewareapi.TokenToSessionLoader{
106− {
107− Verifier: verifier,
108− },
111+ sessionLoaders := []middlewareapi.TokenToSessionFunc{
112+ middlewareapi.CreateTokenToSessionFunc(verifier),
109113 }
110114
111115 // Create the handler with a next handler that will capture the session
@@ -167,17 +171,19 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
167171 const nonVerifiedToken = validToken
168172
169173 BeforeEach(func() {
170− keyset := noOpKeySet{}
171− verifier := oidc.NewVerifier("https://issuer.example.com", keyset,
172− &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
174+ verifier := oidc.NewVerifier(
175+ "https://issuer.example.com",
176+ noOpKeySet{},
177+ &oidc.Config{
178+ ClientID: "https://test.myapp.com",
179+ SkipExpiryCheck: true,
180+ },
181+ ).Verify
173182
174183 j = &jwtSessionLoader{
175184 jwtRegex: regexp.MustCompile(jwtRegexFormat),
176− sessionLoaders: []middlewareapi.TokenToSessionLoader{
177− {
178− Verifier: verifier,
179− TokenToSession: createSessionStateFromBearerToken,
180− },
185+ sessionLoaders: []middlewareapi.TokenToSessionFunc{
186+ middlewareapi.CreateTokenToSessionFunc(verifier),
181187 },
182188 }
183189 })
@@ -218,8 +224,11 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
218224 }),
219225 Entry("Bearer <nonVerifiedToken>", getJWTSessionTableInput{
220226 authorizationHeader: fmt.Sprintf("Bearer %s", nonVerifiedToken),
221− expectedErr: errors.New("unable to verify jwt token: \"Bearer eyJfoobar.eyJfoobar.12345asdf\""),
222− expectedSession: nil,
227+ expectedErr: k8serrors.NewAggregate([]error{
228+ errors.New("unable to verify bearer token"),
229+ errors.New("oidc: malformed jwt: illegal base64 data at input byte 8"),
230+ }),
231+ expectedSession: nil,
223232 }),
224233 Entry("Bearer <verifiedToken>", getJWTSessionTableInput{
225234 authorizationHeader: fmt.Sprintf("Bearer %s", verifiedToken),
@@ -228,8 +237,11 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
228237 }),
229238 Entry("Basic Base64(<nonVerifiedToken>:) (No password)", getJWTSessionTableInput{
230239 authorizationHeader: "Basic ZXlKZm9vYmFyLmV5SmZvb2Jhci4xMjM0NWFzZGY6",
231− expectedErr: errors.New("unable to verify jwt token: \"Basic ZXlKZm9vYmFyLmV5SmZvb2Jhci4xMjM0NWFzZGY6\""),
232− expectedSession: nil,
240+ expectedErr: k8serrors.NewAggregate([]error{
241+ errors.New("unable to verify bearer token"),
242+ errors.New("oidc: malformed jwt: illegal base64 data at input byte 8"),
243+ }),
244+ expectedSession: nil,
233245 }),
234246 Entry("Basic Base64(<verifiedToken>:x-oauth-basic) (Sentinel password)", getJWTSessionTableInput{
235247 authorizationHeader: fmt.Sprintf("Basic %s", verifiedTokenXOAuthBasicBase64),
@@ -239,7 +251,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
239251 )
240252 })
241253
242− Context("findBearerTokenFromHeader", func() {
254+ Context("findTokenFromHeader", func() {
243255 var j *jwtSessionLoader
244256
245257 BeforeEach(func() {
@@ -256,7 +268,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
256268
257269 DescribeTable("with a header",
258270 func(in findBearerTokenFromHeaderTableInput) {
259− token, err := j.findBearerTokenFromHeader(in.header)
271+ token, err := j.findTokenFromHeader(in.header)
260272 if in.expectedErr != nil {
261273 Expect(err).To(MatchError(in.expectedErr))
262274 } else {
@@ -381,7 +393,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
381393 )
382394 })
383395
384− Context("createSessionStateFromBearerToken", func() {
396+ Context("CreateTokenToSessionFunc", func() {
385397 ctx := context.Background()
386398 expiresFuture := time.Now().Add(time.Duration(5) * time.Minute)
387399 verified := true
@@ -393,7 +405,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
393405 jwt.StandardClaims
394406 }
395407
396− type createSessionStateTableInput struct {
408+ type tokenToSessionTableInput struct {
397409 idToken idTokenClaims
398410 expectedErr error
399411 expectedUser string
@@ -402,12 +414,19 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
402414 }
403415
404416 DescribeTable("when creating a session from an IDToken",
405− func(in createSessionStateTableInput) {
406− verifier := oidc.NewVerifier(
407− "https://issuer.example.com",
408− noOpKeySet{},
409− &oidc.Config{ClientID: "asdf1234"},
410− )
417+ func(in tokenToSessionTableInput) {
418+ verifier := func(ctx context.Context, token string) (*oidc.IDToken, error) {
419+ oidcVerifier := oidc.NewVerifier(
420+ "https://issuer.example.com",
421+ noOpKeySet{},
422+ &oidc.Config{ClientID: "asdf1234"},
423+ )
424+
425+ idToken, err := oidcVerifier.Verify(ctx, token)
426+ Expect(err).ToNot(HaveOccurred())
427+
428+ return idToken, nil
429+ }
411430
412431 key, err := rsa.GenerateKey(rand.Reader, 2048)
413432 Expect(err).ToNot(HaveOccurred())
@@ -415,11 +434,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
415434 rawIDToken, err := jwt.NewWithClaims(jwt.SigningMethodRS256, in.idToken).SignedString(key)
416435 Expect(err).ToNot(HaveOccurred())
417436
418− // Pass to a dummy Verifier to get an oidc.IDToken from the rawIDToken for our actual test below
419− idToken, err := verifier.Verify(context.Background(), rawIDToken)
420− Expect(err).ToNot(HaveOccurred())
421−
422− session, err := createSessionStateFromBearerToken(ctx, rawIDToken, idToken)
437+ session, err := middlewareapi.CreateTokenToSessionFunc(verifier)(ctx, rawIDToken)
423438 if in.expectedErr != nil {
424439 Expect(err).To(MatchError(in.expectedErr))
425440 Expect(session).To(BeNil())
@@ -435,7 +450,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
435450 Expect(session.RefreshToken).To(BeEmpty())
436451 Expect(session.PreferredUsername).To(BeEmpty())
437452 },
438− Entry("with no email", createSessionStateTableInput{
453+ Entry("with no email", tokenToSessionTableInput{
439454 idToken: idTokenClaims{
440455 StandardClaims: jwt.StandardClaims{
441456 Audience: "asdf1234",
@@ -452,7 +467,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
452467 expectedEmail: "123456789",
453468 expectedExpires: &expiresFuture,
454469 }),
455− Entry("with a verified email", createSessionStateTableInput{
470+ Entry("with a verified email", tokenToSessionTableInput{
456471 idToken: idTokenClaims{
457472 StandardClaims: jwt.StandardClaims{
458473 Audience: "asdf1234",
@@ -471,7 +486,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
471486 expectedEmail: "foo@example.com",
472487 expectedExpires: &expiresFuture,
473488 }),
474− Entry("with a non-verified email", createSessionStateTableInput{
489+ Entry("with a non-verified email", tokenToSessionTableInput{
475490 idToken: idTokenClaims{
476491 StandardClaims: jwt.StandardClaims{
477492 Audience: "asdf1234",
pkg/validation/options.go+5−6
@@ -233,6 +233,9 @@ func parseProviderInfo(o *options.Options, msgs []string) []string {
233233 p.ValidateURL, msgs = parseURL(o.ValidateURL, "validate", msgs)
234234 p.ProtectedResource, msgs = parseURL(o.ProtectedResource, "resource", msgs)
235235
236+ // Make the OIDC Verifier accessible to all providers that can support it
237+ p.Verifier = o.GetOIDCVerifier()
238+
236239 p.SetAllowedGroups(o.AllowedGroups)
237240
238241 provider := providers.New(o.ProviderType, p)
@@ -273,18 +276,14 @@ func parseProviderInfo(o *options.Options, msgs []string) []string {
273276 p.AllowUnverifiedEmail = o.InsecureOIDCAllowUnverifiedEmail
274277 p.UserIDClaim = o.UserIDClaim
275278 p.GroupsClaim = o.OIDCGroupsClaim
276− if o.GetOIDCVerifier() == nil {
279+ if p.Verifier == nil {
277280 msgs = append(msgs, "oidc provider requires an oidc issuer URL")
278− } else {
279− p.Verifier = o.GetOIDCVerifier()
280281 }
281282 case *providers.GitLabProvider:
282283 p.AllowUnverifiedEmail = o.InsecureOIDCAllowUnverifiedEmail
283284 p.Groups = o.GitLabGroup
284285
285− if o.GetOIDCVerifier() != nil {
286− p.Verifier = o.GetOIDCVerifier()
287− } else {
286+ if p.Verifier == nil {
288287 // Initialize with default verifier for gitlab.com
289288 ctx := context.Background()
290289
providers/digitalocean.go+1−1
@@ -83,6 +83,6 @@ func (p *DigitalOceanProvider) GetEmailAddress(ctx context.Context, s *sessions.
8383}
8484
8585// ValidateSessionState validates the AccessToken
86−func (p *DigitalOceanProvider) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
86+func (p *DigitalOceanProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
8787 return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))
8888}
providers/facebook.go+1−1
@@ -89,6 +89,6 @@ func (p *FacebookProvider) GetEmailAddress(ctx context.Context, s *sessions.Sess
8989}
9090
9191// ValidateSessionState validates the AccessToken
92−func (p *FacebookProvider) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
92+func (p *FacebookProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
9393 return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))
9494}
providers/github.go+2−2
@@ -103,7 +103,7 @@ func (p *GitHubProvider) SetUsers(users []string) {
103103}
104104
105105// EnrichSessionState updates the User & Email after the initial Redeem
106−func (p *GitHubProvider) EnrichSessionState(ctx context.Context, s *sessions.SessionState) error {
106+func (p *GitHubProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
107107 err := p.getEmail(ctx, s)
108108 if err != nil {
109109 return err
@@ -112,7 +112,7 @@ func (p *GitHubProvider) EnrichSessionState(ctx context.Context, s *sessions.Ses
112112}
113113
114114// ValidateSessionState validates the AccessToken
115−func (p *GitHubProvider) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
115+func (p *GitHubProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
116116 return validateToken(ctx, p, s.AccessToken, makeGitHubHeader(s.AccessToken))
117117}
118118
providers/gitlab.go+2−2
@@ -188,13 +188,13 @@ func (p *GitLabProvider) createSessionState(ctx context.Context, token *oauth2.T
188188}
189189
190190// ValidateSessionState checks that the session's IDToken is still valid
191−func (p *GitLabProvider) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
191+func (p *GitLabProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
192192 _, err := p.Verifier.Verify(ctx, s.IDToken)
193193 return err == nil
194194}
195195
196196// GetEmailAddress returns the Account email address
197−func (p *GitLabProvider) EnrichSessionState(ctx context.Context, s *sessions.SessionState) error {
197+func (p *GitLabProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
198198 // Retrieve user info
199199 userInfo, err := p.getUserInfo(ctx, s)
200200 if err != nil {
providers/gitlab_test.go+6−6
@@ -64,7 +64,7 @@ func TestGitLabProviderBadToken(t *testing.T) {
6464 p := testGitLabProvider(bURL.Host)
6565
6666 session := &sessions.SessionState{AccessToken: "unexpected_gitlab_access_token"}
67− err := p.EnrichSessionState(context.Background(), session)
67+ err := p.EnrichSession(context.Background(), session)
6868 assert.Error(t, err)
6969}
7070
@@ -76,7 +76,7 @@ func TestGitLabProviderUnverifiedEmailDenied(t *testing.T) {
7676 p := testGitLabProvider(bURL.Host)
7777
7878 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
79− err := p.EnrichSessionState(context.Background(), session)
79+ err := p.EnrichSession(context.Background(), session)
8080 assert.Error(t, err)
8181}
8282
@@ -89,7 +89,7 @@ func TestGitLabProviderUnverifiedEmailAllowed(t *testing.T) {
8989 p.AllowUnverifiedEmail = true
9090
9191 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
92− err := p.EnrichSessionState(context.Background(), session)
92+ err := p.EnrichSession(context.Background(), session)
9393 assert.NoError(t, err)
9494 assert.Equal(t, "foo@bar.com", session.Email)
9595}
@@ -103,7 +103,7 @@ func TestGitLabProviderUsername(t *testing.T) {
103103 p.AllowUnverifiedEmail = true
104104
105105 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
106− err := p.EnrichSessionState(context.Background(), session)
106+ err := p.EnrichSession(context.Background(), session)
107107 assert.NoError(t, err)
108108 assert.Equal(t, "FooBar", session.User)
109109}
@@ -118,7 +118,7 @@ func TestGitLabProviderGroupMembershipValid(t *testing.T) {
118118 p.Groups = []string{"foo"}
119119
120120 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
121− err := p.EnrichSessionState(context.Background(), session)
121+ err := p.EnrichSession(context.Background(), session)
122122 assert.NoError(t, err)
123123 assert.Equal(t, "FooBar", session.User)
124124}
@@ -133,6 +133,6 @@ func TestGitLabProviderGroupMembershipMissing(t *testing.T) {
133133 p.Groups = []string{"baz"}
134134
135135 session := &sessions.SessionState{AccessToken: "gitlab_access_token"}
136− err := p.EnrichSessionState(context.Background(), session)
136+ err := p.EnrichSession(context.Background(), session)
137137 assert.Error(t, err)
138138}
providers/google.go+1−1
@@ -179,7 +179,7 @@ func (p *GoogleProvider) Redeem(ctx context.Context, redirectURL, code string) (
179179
180180// EnrichSessionState checks the listed Google Groups configured and adds any
181181// that the user is a member of to session.Groups.
182−func (p *GoogleProvider) EnrichSessionState(ctx context.Context, s *sessions.SessionState) error {
182+func (p *GoogleProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {
183183 // TODO (@NickMeves) - Move to pure EnrichSessionState logic and stop
184184 // reusing legacy `groupValidator`.
185185 //
providers/internal_util_test.go+1−1
@@ -32,7 +32,7 @@ func (tp *ValidateSessionStateTestProvider) GetEmailAddress(ctx context.Context,
3232
3333// Note that we're testing the internal validateToken() used to implement
3434// several Provider's ValidateSessionState() implementations
35−func (tp *ValidateSessionStateTestProvider) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
35+func (tp *ValidateSessionStateTestProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
3636 return false
3737}
3838
providers/linkedin.go+1−1
@@ -94,6 +94,6 @@ func (p *LinkedInProvider) GetEmailAddress(ctx context.Context, s *sessions.Sess
9494}
9595
9696// ValidateSessionState validates the AccessToken
97−func (p *LinkedInProvider) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
97+func (p *LinkedInProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
9898 return validateToken(ctx, p, s.AccessToken, makeLinkedInHeader(s.AccessToken))
9999}
providers/oidc.go+9−5
@@ -22,7 +22,6 @@ const emailClaim = "email"
2222type OIDCProvider struct {
2323 *ProviderData
2424
25− Verifier *oidc.IDTokenVerifier
2625 AllowUnverifiedEmail bool
2726 UserIDClaim string
2827 GroupsClaim string
@@ -175,14 +174,19 @@ func (p *OIDCProvider) createSessionState(ctx context.Context, token *oauth2.Tok
175174 return newSession, nil
176175}
177176
178−func (p *OIDCProvider) CreateSessionStateFromBearerToken(ctx context.Context, rawIDToken string, idToken *oidc.IDToken) (*sessions.SessionState, error) {
177+func (p *OIDCProvider) CreateSessionFromToken(ctx context.Context, token string) (*sessions.SessionState, error) {
178+ idToken, err := p.Verifier.Verify(ctx, token)
179+ if err != nil {
180+ return nil, err
181+ }
182+
179183 newSession, err := p.createSessionStateInternal(ctx, idToken, nil)
180184 if err != nil {
181185 return nil, err
182186 }
183187
184− newSession.AccessToken = rawIDToken
185− newSession.IDToken = rawIDToken
188+ newSession.AccessToken = token
189+ newSession.IDToken = token
186190 newSession.RefreshToken = ""
187191 newSession.ExpiresOn = &idToken.Expiry
188192
@@ -221,7 +225,7 @@ func (p *OIDCProvider) createSessionStateInternal(ctx context.Context, idToken *
221225}
222226
223227// ValidateSessionState checks that the session's IDToken is still valid
224−func (p *OIDCProvider) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
228+func (p *OIDCProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
225229 _, err := p.Verifier.Verify(ctx, s.IDToken)
226230 return err == nil
227231}
providers/oidc_test.go+8−14
@@ -144,16 +144,17 @@ func newOIDCProvider(serverURL *url.URL) *OIDCProvider {
144144 Scheme: serverURL.Scheme,
145145 Host: serverURL.Host,
146146 Path: "/api"},
147− Scope: "openid profile offline_access"}
148−
149− p := &OIDCProvider{
150− ProviderData: providerData,
147+ Scope: "openid profile offline_access",
151148 Verifier: oidc.NewVerifier(
152149 "https://issuer.example.com",
153150 fakeKeySetStub{},
154151 &oidc.Config{ClientID: clientID},
155152 ),
156− UserIDClaim: "email",
153+ }
154+
155+ p := &OIDCProvider{
156+ ProviderData: providerData,
157+ UserIDClaim: "email",
157158 }
158159
159160 return p
@@ -298,7 +299,7 @@ func TestOIDCProviderRefreshSessionIfNeededWithIdToken(t *testing.T) {
298299 assert.Equal(t, refreshToken, existingSession.RefreshToken)
299300}
300301
301−func TestCreateSessionStateFromBearerToken(t *testing.T) {
302+func TestOIDCProviderCreateSessionFromToken(t *testing.T) {
302303 const profileURLEmail = "janed@me.com"
303304
304305 testCases := map[string]struct {
@@ -347,14 +348,7 @@ func TestCreateSessionStateFromBearerToken(t *testing.T) {
347348 rawIDToken, err := newSignedTestIDToken(tc.IDToken)
348349 assert.NoError(t, err)
349350
350− keyset := fakeKeySetStub{}
351− verifier := oidc.NewVerifier("https://issuer.example.com", keyset,
352− &oidc.Config{ClientID: "https://test.myapp.com", SkipExpiryCheck: true})
353−
354− idToken, err := verifier.Verify(context.Background(), rawIDToken)
355− assert.NoError(t, err)
356−
357− ss, err := provider.CreateSessionStateFromBearerToken(context.Background(), rawIDToken, idToken)
351+ ss, err := provider.CreateSessionFromToken(context.Background(), rawIDToken)
358352 assert.NoError(t, err)
359353
360354 assert.Equal(t, tc.ExpectedUser, ss.User)
providers/provider_data.go+2
@@ -5,6 +5,7 @@ import (
55 "io/ioutil"
66 "net/url"
77
8+ "github.com/coreos/go-oidc"
89 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
910)
1011
@@ -26,6 +27,7 @@ type ProviderData struct {
2627 ClientSecretFile string
2728 Scope string
2829 Prompt string
30+ Verifier *oidc.IDTokenVerifier
2931
3032 // Universal Group authorization data structure
3133 // any provider can set to consume
providers/provider_default.go+8−7
@@ -8,8 +8,7 @@ import (
88 "net/url"
99 "time"
1010
11− "github.com/coreos/go-oidc"
12−
11+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
1312 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
1413 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
1514)
@@ -94,7 +93,7 @@ func (p *ProviderData) GetEmailAddress(_ context.Context, _ *sessions.SessionSta
9493
9594// EnrichSessionState is called after Redeem to allow providers to enrich session fields
9695// such as User, Email, Groups with provider specific API calls.
97−func (p *ProviderData) EnrichSessionState(_ context.Context, _ *sessions.SessionState) error {
96+func (p *ProviderData) EnrichSession(_ context.Context, _ *sessions.SessionState) error {
9897 return nil
9998}
10099
@@ -115,7 +114,7 @@ func (p *ProviderData) Authorize(_ context.Context, s *sessions.SessionState) (b
115114}
116115
117116// ValidateSessionState validates the AccessToken
118−func (p *ProviderData) ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool {
117+func (p *ProviderData) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {
119118 return validateToken(ctx, p, s.AccessToken, nil)
120119}
121120
@@ -125,8 +124,10 @@ func (p *ProviderData) RefreshSessionIfNeeded(_ context.Context, _ *sessions.Ses
125124 return false, nil
126125}
127126
128−// CreateSessionStateFromBearerToken should be implemented to allow providers
129−// to convert ID tokens into sessions
130−func (p *ProviderData) CreateSessionStateFromBearerToken(_ context.Context, _ string, _ *oidc.IDToken) (*sessions.SessionState, error) {
127+// CreateSessionFromToken converts Bearer IDTokens into sessions
128+func (p *ProviderData) CreateSessionFromToken(ctx context.Context, token string) (*sessions.SessionState, error) {
129+ if p.Verifier != nil {
130+ return middleware.CreateTokenToSessionFunc(p.Verifier.Verify)(ctx, token)
131+ }
131132 return nil, ErrNotImplemented
132133}
providers/provider_default_test.go+5−2
@@ -49,10 +49,13 @@ func TestAcrValuesConfigured(t *testing.T) {
4949 assert.Contains(t, result, "acr_values=testValue")
5050}
5151
52−func TestEnrichSessionState(t *testing.T) {
52+func TestProviderDataEnrichSession(t *testing.T) {
53+ g := NewWithT(t)
5354 p := &ProviderData{}
5455 s := &sessions.SessionState{}
55− assert.NoError(t, p.EnrichSessionState(context.Background(), s))
56+
57+ err := p.EnrichSession(context.Background(), s)
58+ g.Expect(err).ToNot(HaveOccurred())
5659}
5760
5861func TestProviderDataAuthorize(t *testing.T) {
providers/providers.go+3−4
@@ -3,7 +3,6 @@ package providers
33import (
44 "context"
55
6− "github.com/coreos/go-oidc"
76 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
87)
98
@@ -13,12 +12,12 @@ type Provider interface {
1312 // DEPRECATED: Migrate to EnrichSessionState
1413 GetEmailAddress(ctx context.Context, s *sessions.SessionState) (string, error)
1514 Redeem(ctx context.Context, redirectURI, code string) (*sessions.SessionState, error)
16− EnrichSessionState(ctx context.Context, s *sessions.SessionState) error
15+ EnrichSession(ctx context.Context, s *sessions.SessionState) error
1716 Authorize(ctx context.Context, s *sessions.SessionState) (bool, error)
18− ValidateSessionState(ctx context.Context, s *sessions.SessionState) bool
17+ ValidateSession(ctx context.Context, s *sessions.SessionState) bool
1918 GetLoginURL(redirectURI, finalRedirect string) string
2019 RefreshSessionIfNeeded(ctx context.Context, s *sessions.SessionState) (bool, error)
21− CreateSessionStateFromBearerToken(ctx context.Context, rawIDToken string, idToken *oidc.IDToken) (*sessions.SessionState, error)
20+ CreateSessionFromToken(ctx context.Context, token string) (*sessions.SessionState, error)
2221}
2322
2423// New provides a new Provider based on the configured provider string