@@ -1,7 +1,6 @@
11package main
22
33import (
4− "flag"
54 "fmt"
65 "math/rand"
76 "net/http"
@@ -19,17 +18,7 @@ import (
1918
2019func main() {
2120 logger.SetFlags(logger.Lshortfile)
22− flagSet := flag.NewFlagSet("oauth2-proxy", flag.ExitOnError)
23−
24− cookieDomains := StringArray{}
25− emailDomains := StringArray{}
26− whitelistDomains := StringArray{}
27− upstreams := StringArray{}
28− skipAuthRegex := StringArray{}
29− jwtIssuers := StringArray{}
30− googleGroups := StringArray{}
31− redisSentinelConnectionURLs := StringArray{}
32− redisClusterConnectionURLs := StringArray{}
21+ flagSet := pflag.NewFlagSet("oauth2-proxy", pflag.ExitOnError)
3322
3423 config := flagSet.String("config", "", "path to config file")
3524 showVersion := flagSet.Bool("version", false, "print version string")
@@ -42,7 +31,7 @@ func main() {
4231 flagSet.String("tls-key-file", "", "path to private key file")
4332 flagSet.String("redirect-url", "", "the OAuth Redirect URL. ie: \"https://internalapp.yourcompany.com/oauth2/callback\"")
4433 flagSet.Bool("set-xauthrequest", false, "set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)")
45− flagSet.Var(&upstreams, "upstream", "the http url(s) of the upstream endpoint, file:// paths for static files or static://<status_code> for static response. Routing is based on the path")
34+ flagSet.StringSlice("upstream", []string{}, "the http url(s) of the upstream endpoint, file:// paths for static files or static://<status_code> for static response. Routing is based on the path")
4635 flagSet.Bool("pass-basic-auth", true, "pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream")
4736 flagSet.Bool("set-basic-auth", false, "set HTTP Basic Auth information in response (useful in Nginx auth_request mode)")
4837 flagSet.Bool("prefer-email-to-user", false, "Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, eg. htaccess authentication. Used in conjunction with -pass-basic-auth and -pass-user-headers")
@@ -52,17 +41,17 @@ func main() {
5241 flagSet.Bool("pass-host-header", true, "pass the request Host Header to upstream")
5342 flagSet.Bool("pass-authorization-header", false, "pass the Authorization Header to upstream")
5443 flagSet.Bool("set-authorization-header", false, "set Authorization response headers (useful in Nginx auth_request mode)")
55− flagSet.Var(&skipAuthRegex, "skip-auth-regex", "bypass authentication for requests path's that match (may be given multiple times)")
44+ flagSet.StringSlice("skip-auth-regex", []string{}, "bypass authentication for requests path's that match (may be given multiple times)")
5645 flagSet.Bool("skip-provider-button", false, "will skip sign-in-page to directly reach the next step: oauth/start")
5746 flagSet.Bool("skip-auth-preflight", false, "will skip authentication for OPTIONS requests")
5847 flagSet.Bool("ssl-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS providers")
5948 flagSet.Bool("ssl-upstream-insecure-skip-verify", false, "skip validation of certificates presented when using HTTPS upstreams")
6049 flagSet.Duration("flush-interval", time.Duration(1)*time.Second, "period between response flushing when streaming responses")
6150 flagSet.Bool("skip-jwt-bearer-tokens", false, "will skip requests that have verified JWT bearer tokens (default false)")
62− flagSet.Var(&jwtIssuers, "extra-jwt-issuers", "if skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)")
51+ flagSet.StringSlice("extra-jwt-issuers", []string{}, "if skip-jwt-bearer-tokens is set, a list of extra JWT issuer=audience pairs (where the issuer URL has a .well-known/openid-configuration or a .well-known/jwks.json)")
6352
64− flagSet.Var(&emailDomains, "email-domain", "authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email")
65− flagSet.Var(&whitelistDomains, "whitelist-domain", "allowed domains for redirection after authentication. Prefix domain with a . to allow subdomains (eg .example.com)")
53+ flagSet.StringSlice("email-domain", []string{}, "authenticate emails with the specified domain (may be given multiple times). Use * to authenticate any email")
54+ flagSet.StringSlice("whitelist-domain", []string{}, "allowed domains for redirection after authentication. Prefix domain with a . to allow subdomains (eg .example.com)")
6655 flagSet.String("keycloak-group", "", "restrict login to members of this group.")
6756 flagSet.String("azure-tenant", "common", "go to a tenant-specific or common (tenant-independent) endpoint.")
6857 flagSet.String("bitbucket-team", "", "restrict logins to members of this team")
@@ -70,7 +59,7 @@ func main() {
7059 flagSet.String("github-org", "", "restrict logins to members of this organisation")
7160 flagSet.String("github-team", "", "restrict logins to members of this team")
7261 flagSet.String("gitlab-group", "", "restrict logins to members of this group")
73− flagSet.Var(&googleGroups, "google-group", "restrict logins to members of this google group (may be given multiple times).")
62+ flagSet.StringSlice("google-group", []string{}, "restrict logins to members of this google group (may be given multiple times).")
7463 flagSet.String("google-admin-email", "", "the google admin to impersonate for api calls")
7564 flagSet.String("google-service-account-json", "", "the path to the service account json credentials")
7665 flagSet.String("client-id", "", "the OAuth Client ID: ie: \"123456.apps.googleusercontent.com\"")
@@ -88,7 +77,7 @@ func main() {
8877
8978 flagSet.String("cookie-name", "_oauth2_proxy", "the name of the cookie that the oauth_proxy creates")
9079 flagSet.String("cookie-secret", "", "the seed string for secure cookies (optionally base64 encoded)")
91− flagSet.Var(&cookieDomains, "cookie-domain", "Optional cookie domains to force cookies to (ie: `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match).")
80+ flagSet.StringSlice("cookie-domain", []string{}, "Optional cookie domains to force cookies to (ie: `.yourcompany.com`). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match).")
9281 flagSet.String("cookie-path", "/", "an optional cookie path to force cookies to (ie: /poc/)*")
9382 flagSet.Duration("cookie-expire", time.Duration(168)*time.Hour, "expire timeframe for cookie")
9483 flagSet.Duration("cookie-refresh", time.Duration(0), "refresh the cookie after this duration; 0 to disable")
@@ -102,9 +91,9 @@ func main() {
10291 flagSet.String("redis-sentinel-master-name", "", "Redis sentinel master name. Used in conjunction with --redis-use-sentinel")
10392 flagSet.String("redis-ca-path", "", "Redis custom CA path")
10493 flagSet.Bool("redis-insecure-skip-tls-verify", false, "Use insecure TLS connection to redis")
105− flagSet.Var(&redisSentinelConnectionURLs, "redis-sentinel-connection-urls", "List of Redis sentinel connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-sentinel")
94+ flagSet.StringSlice("redis-sentinel-connection-urls", []string{}, "List of Redis sentinel connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-sentinel")
10695 flagSet.Bool("redis-use-cluster", false, "Connect to redis cluster. Must set --redis-cluster-connection-urls to use this feature")
107− flagSet.Var(&redisClusterConnectionURLs, "redis-cluster-connection-urls", "List of Redis cluster connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-cluster")
96+ flagSet.StringSlice("redis-cluster-connection-urls", []string{}, "List of Redis cluster connection URLs (eg redis://HOST[:PORT]). Used in conjunction with --redis-use-cluster")
10897
10998 flagSet.String("logging-filename", "", "File to log requests to, empty for stdout")
11099 flagSet.Int("logging-max-size", 100, "Maximum size in megabytes of the log file before rotation")
@@ -149,10 +138,7 @@ func main() {
149138
150139 flagSet.String("user-id-claim", "email", "which claim contains the user ID")
151140
152− pflagSet := pflag.NewFlagSet("oauth2-proxy", pflag.ExitOnError)
153− pflagSet.AddGoFlagSet(flagSet)
154−
155− pflagSet.Parse(os.Args[1:])
141+ flagSet.Parse(os.Args[1:])
156142
157143 if *showVersion {
158144 fmt.Printf("oauth2-proxy %s (built with %s)\n", VERSION, runtime.Version())
@@ -160,7 +146,7 @@ func main() {
160146 }
161147
162148 opts := NewOptions()
163− err := options.Load(*config, pflagSet, opts)
149+ err := options.Load(*config, flagSet, opts)
164150 if err != nil {
165151 logger.Printf("ERROR: Failed to load config: %v", err)
166152 os.Exit(1)