f6b95c0 · typeable/oauth2-proxy

.devcontainer/Dockerfile+1−1

compare with master

unifiedsplit

@@ -1,4 +1,4 @@

1−FROM mcr.microsoft.com/vscode/devcontainers/go:1-1.22

1+FROM mcr.microsoft.com/vscode/devcontainers/go:1-1.23

2

3SHELL ["/bin/bash", "-o", "pipefail", "-c"]

4

CHANGELOG.md+2

@@ -8,6 +8,8 @@

8

9## Changes since v7.8.2

10

11+- [#3001](https://github.com/oauth2-proxy/oauth2-proxy/pull/3001) Allow to set non-default authorization request response mode (@stieler-it)

12+

11# V7.8.2

13# V7.8.2

12

14

13## Release Highlights

15## Release Highlights

docs/docs/configuration/alpha_config.md+1

@@ -445,6 +445,7 @@ Provider holds all configuration for a single provider

445| `useSystemTrustStore` | _bool_ | UseSystemTrustStore determines if your custom CA files and the system trust store are used If set to true, your custom CA files and the system trust store are used otherwise only your custom CA files. |

446| `loginURL` | _string_ | LoginURL is the authentication endpoint |

447| `loginURLParameters` | _[[]LoginURLParameter](#loginurlparameter)_ | LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL |

448+| `authRequestResponseMode` | _string_ | AuthRequestResponseMode defines the response mode to request during authorization request |

448| `redeemURL` | _string_ | RedeemURL is the token redemption endpoint |

449| `redeemURL` | _string_ | RedeemURL is the token redemption endpoint |

449| `profileURL` | _string_ | ProfileURL is the profile access endpoint |

450| `profileURL` | _string_ | ProfileURL is the profile access endpoint |

450| `skipClaimsFromProfileURL` | _bool_ | SkipClaimsFromProfileURL allows to skip request to Profile URL for resolving claims not present in id_token default set to 'false' |

451| `skipClaimsFromProfileURL` | _bool_ | SkipClaimsFromProfileURL allows to skip request to Profile URL for resolving claims not present in id_token default set to 'false' |

docs/docs/configuration/overview.md+1

@@ -91,6 +91,7 @@ Provider specific options can be found on their respective subpages.

91| flag: `--jwt-key-file` toml: `jwt_key_file` | string | path to the private key file in PEM format used to sign the JWT so that you can say something like `--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem`: required by login.gov | |

92| flag: `--jwt-key` toml: `jwt_key` | string | private key in PEM format used to sign JWT, so that you can say something like `--jwt-key="${OAUTH2_PROXY_JWT_KEY}"`: required by login.gov | |

pkg/apis/options/legacy_options.go+3

@@ -524,6 +524,7 @@ type LegacyProvider struct {

524 OIDCExtraAudiences []string `flag:"oidc-extra-audience" cfg:"oidc_extra_audiences"`

525 OIDCPublicKeyFiles []string `flag:"oidc-public-key-file" cfg:"oidc_public_key_files"`

526 LoginURL string `flag:"login-url" cfg:"login_url"`

527+ AuthRequestResponseMode string `flag:"auth-request-response-mode" cfg:"auth_request_response_mode"`

527 RedeemURL string `flag:"redeem-url" cfg:"redeem_url"`

528 RedeemURL string `flag:"redeem-url" cfg:"redeem_url"`

528 ProfileURL string `flag:"profile-url" cfg:"profile_url"`

529 ProfileURL string `flag:"profile-url" cfg:"profile_url"`

529 SkipClaimsFromProfileURL bool `flag:"skip-claims-from-profile-url" cfg:"skip_claims_from_profile_url"`

530 SkipClaimsFromProfileURL bool `flag:"skip-claims-from-profile-url" cfg:"skip_claims_from_profile_url"`

@@ -586,6 +587,7 @@ func legacyProviderFlagSet() *pflag.FlagSet {

586 flagSet.String("login-url", "", "Authentication endpoint")

587 flagSet.String("login-url", "", "Authentication endpoint")

587 flagSet.String("redeem-url", "", "Token redemption endpoint")

588 flagSet.String("redeem-url", "", "Token redemption endpoint")

588 flagSet.String("profile-url", "", "Profile access endpoint")

589 flagSet.String("profile-url", "", "Profile access endpoint")

590+ flagSet.String("auth-request-response-mode", "", "Authorization request response mode")

589 flagSet.Bool("skip-claims-from-profile-url", false, "Skip loading missing claims from profile URL")

591 flagSet.Bool("skip-claims-from-profile-url", false, "Skip loading missing claims from profile URL")

590 flagSet.String("resource", "", "The resource that is protected (Azure AD only)")

592 flagSet.String("resource", "", "The resource that is protected (Azure AD only)")

591 flagSet.String("validate-url", "", "Access token validation endpoint")

593 flagSet.String("validate-url", "", "Access token validation endpoint")

@@ -684,6 +686,7 @@ func (l *LegacyProvider) convert() (Providers, error) {

684 AllowedGroups: l.AllowedGroups,

686 AllowedGroups: l.AllowedGroups,

685 CodeChallengeMethod: l.CodeChallengeMethod,

687 CodeChallengeMethod: l.CodeChallengeMethod,

686 BackendLogoutURL: l.BackendLogoutURL,

688 BackendLogoutURL: l.BackendLogoutURL,

689+ AuthRequestResponseMode: l.AuthRequestResponseMode,

687 }

690 }

688

691

689 // This part is out of the switch section for all providers that support OIDC

692 // This part is out of the switch section for all providers that support OIDC

pkg/apis/options/providers.go+2

@@ -68,6 +68,8 @@ type Provider struct {

68 LoginURL string `json:"loginURL,omitempty"`

69 // LoginURLParameters defines the parameters that can be passed from the start URL to the IdP login URL

70 LoginURLParameters []LoginURLParameter `json:"loginURLParameters,omitempty"`

71+ // AuthRequestResponseMode defines the response mode to request during authorization request

72+ AuthRequestResponseMode string `json:"authRequestResponseMode,omitempty"`

71 // RedeemURL is the token redemption endpoint

73 // RedeemURL is the token redemption endpoint

72 RedeemURL string `json:"redeemURL,omitempty"`

74 RedeemURL string `json:"redeemURL,omitempty"`

73 // ProfileURL is the profile access endpoint

75 // ProfileURL is the profile access endpoint

providers/provider_data.go+2

@@ -37,6 +37,8 @@ type ProviderData struct {

37 ClientSecret string

38 ClientSecretFile string

39 Scope string

40+ // The response mode requested from the provider or empty for default ("query")

41+ AuthRequestResponseMode string

40 // The picked CodeChallenge Method or empty if none.

42 // The picked CodeChallenge Method or empty if none.

41 CodeChallengeMethod string

43 CodeChallengeMethod string

42 // Code challenge methods supported by the Provider

44 // Code challenge methods supported by the Provider

providers/provider_default.go+5

@@ -36,6 +36,11 @@ var (

36// codeChallenge and codeChallengeMethod are the PKCE challenge and method to append to the URL params.

37// they will be empty strings if no code challenge should be presented

38func (p *ProviderData) GetLoginURL(redirectURI, state, _ string, extraParams url.Values) string {

39+ // Response mode should only be set if a non default mode is requested

40+ if p.AuthRequestResponseMode != "" {

41+ extraParams.Add("response_mode", p.AuthRequestResponseMode)

42+ }

43+

39 loginURL := makeLoginURL(p, redirectURI, state, extraParams)

44 loginURL := makeLoginURL(p, redirectURI, state, extraParams)

40 return loginURL.String()

45 return loginURL.String()

41}

46}

providers/provider_default_test.go+27

@@ -119,3 +119,30 @@ func TestProviderDataAuthorize(t *testing.T) {

119 })

120 }

121}

122+

123+func TestResponseModeConfigured(t *testing.T) {

124+ p := &ProviderData{

125+ LoginURL: &url.URL{

126+ Scheme: "http",

127+ Host: "my.test.idp",

128+ Path: "/oauth/authorize",

129+ },

130+ AuthRequestResponseMode: "form_post",

131+ }

132+

133+ result := p.GetLoginURL("https://my.test.app/oauth", "", "", url.Values{})

134+ assert.Contains(t, result, "response_mode=form_post")

135+}

136+

137+func TestResponseModeNotConfigured(t *testing.T) {

138+ p := &ProviderData{

139+ LoginURL: &url.URL{

140+ Scheme: "http",

141+ Host: "my.test.idp",

142+ Path: "/oauth/authorize",

143+ },

144+ }

145+

146+ result := p.GetLoginURL("https://my.test.app/oauth", "", "", url.Values{})

147+ assert.NotContains(t, result, "response_mode")

148+}

providers/providers.go+5−4

@@ -74,10 +74,11 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

74

75func newProviderDataFromConfig(providerConfig options.Provider) (*ProviderData, error) {

76 p := &ProviderData{

77+ Scope: providerConfig.Scope,

78+ ClientID: providerConfig.ClientID,

77− Scope: providerConfig.Scope,

79+ ClientSecret: providerConfig.ClientSecret,

78− ClientID: providerConfig.ClientID,

80+ ClientSecretFile: providerConfig.ClientSecretFile,

79− ClientSecret: providerConfig.ClientSecret,

81+ AuthRequestResponseMode: providerConfig.AuthRequestResponseMode,

80− ClientSecretFile: providerConfig.ClientSecretFile,

81 }

82 }

82

83

83 needsVerifier, err := providerRequiresOIDCProviderVerifier(providerConfig.Type)

84 needsVerifier, err := providerRequiresOIDCProviderVerifier(providerConfig.Type)