fbee5ea · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Initialise SessionStore in Options

commitfbee5eae161b71ee7d8c5e370644fe0e1397bb84 authorJoel Speed <Joel.speed@hotmail.co.uk> dateTue 7 May 2019, 14:27 (7 years ago) parent17e97ab

6 files changed+48−11

compare with master

unifiedsplit

oauthproxy.go+9−7 options.go+16 pkg/apis/options/sessions.go+5−2 pkg/sessions/cookie/session_store.go+1−1 pkg/sessions/session_store.go+2 pkg/sessions/session_store_test.go+15−1

oauthproxy.go+9−7

@@ -16,7 +16,7 @@ import (

1616 "github.com/mbland/hmacauth"

1717 "github.com/pusher/oauth2_proxy/cookie"

1818 "github.com/pusher/oauth2_proxy/logger"

19− "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

19+ sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

2020 "github.com/pusher/oauth2_proxy/providers"

2121 "github.com/yhat/wsutil"

2222)

@@ -75,6 +75,7 @@ type OAuthProxy struct {

7575 redirectURL *url.URL // the url to receive requests at

7676 whitelistDomains []string

7777 provider providers.Provider

78+ sessionStore sessionsapi.SessionStore

7879 ProxyPrefix string

7980 SignInMessage string

8081 HtpasswdFile *HtpasswdFile

@@ -249,6 +250,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {

249250

250251 ProxyPrefix: opts.ProxyPrefix,

251252 provider: opts.provider,

253+ sessionStore: opts.sessionStore,

252254 serveMux: serveMux,

253255 redirectURL: redirectURL,

254256 whitelistDomains: opts.WhitelistDomains,

@@ -293,7 +295,7 @@ func (p *OAuthProxy) displayCustomLoginForm() bool {

293295 return p.HtpasswdFile != nil && p.DisplayHtpasswdForm

294296}

295297

296−func (p *OAuthProxy) redeemCode(host, code string) (s *sessions.SessionState, err error) {

298+func (p *OAuthProxy) redeemCode(host, code string) (s *sessionsapi.SessionState, err error) {

297299 if code == "" {

298300 return nil, errors.New("missing code")

299301 }

@@ -485,7 +487,7 @@ func (p *OAuthProxy) SetSessionCookie(rw http.ResponseWriter, req *http.Request,

485487}

486488

487489// LoadCookiedSession reads the user's authentication details from the request

488−func (p *OAuthProxy) LoadCookiedSession(req *http.Request) (*sessions.SessionState, time.Duration, error) {

490+func (p *OAuthProxy) LoadCookiedSession(req *http.Request) (*sessionsapi.SessionState, time.Duration, error) {

489491 var age time.Duration

490492 c, err := loadCookie(req, p.CookieName)

491493 if err != nil {

@@ -507,7 +509,7 @@ func (p *OAuthProxy) LoadCookiedSession(req *http.Request) (*sessions.SessionSta

507509}

508510

509511// SaveSession creates a new session cookie value and sets this on the response

510−func (p *OAuthProxy) SaveSession(rw http.ResponseWriter, req *http.Request, s *sessions.SessionState) error {

512+func (p *OAuthProxy) SaveSession(rw http.ResponseWriter, req *http.Request, s *sessionsapi.SessionState) error {

511513 value, err := p.provider.CookieForSession(s, p.CookieCipher)

512514 if err != nil {

513515 return err

@@ -694,7 +696,7 @@ func (p *OAuthProxy) SignIn(rw http.ResponseWriter, req *http.Request) {

694696

695697 user, ok := p.ManualSignIn(rw, req)

696698 if ok {

697− session := &sessions.SessionState{User: user}

699+ session := &sessionsapi.SessionState{User: user}

698700 p.SaveSession(rw, req, session)

699701 http.Redirect(rw, req, redirect, 302)

700702 } else {

@@ -945,7 +947,7 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) int

945947

946948// CheckBasicAuth checks the requests Authorization header for basic auth

947949// credentials and authenticates these against the proxies HtpasswdFile

948−func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*sessions.SessionState, error) {

950+func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*sessionsapi.SessionState, error) {

949951 if p.HtpasswdFile == nil {

950952 return nil, nil

951953 }

@@ -967,7 +969,7 @@ func (p *OAuthProxy) CheckBasicAuth(req *http.Request) (*sessions.SessionState,

967969 }

968970 if p.HtpasswdFile.Validate(pair[0], pair[1]) {

969971 logger.PrintAuthf(pair[0], req, logger.AuthSuccess, "Authenticated via basic auth and HTpasswd File")

970− return &sessions.SessionState{User: pair[0]}, nil

972+ return &sessionsapi.SessionState{User: pair[0]}, nil

971973 }

972974 logger.PrintAuthf(pair[0], req, logger.AuthFailure, "Invalid authentication via basic auth: not in Htpasswd File")

973975 return nil, nil

options.go+16

@@ -19,6 +19,8 @@ import (

1919 "github.com/mbland/hmacauth"

2020 "github.com/pusher/oauth2_proxy/logger"

2121 "github.com/pusher/oauth2_proxy/pkg/apis/options"

22+ sessionsapi "github.com/pusher/oauth2_proxy/pkg/apis/sessions"

23+ "github.com/pusher/oauth2_proxy/pkg/sessions"

2224 "github.com/pusher/oauth2_proxy/providers"

2325 "gopkg.in/natefinch/lumberjack.v2"

2426)

@@ -111,6 +113,7 @@ type Options struct {

111113 proxyURLs []*url.URL

112114 CompiledRegex []*regexp.Regexp

113115 provider providers.Provider

116+ sessionStore sessionsapi.SessionStore

114117 signatureData *SignatureData

115118 oidcVerifier *oidc.IDTokenVerifier

116119}

@@ -136,6 +139,9 @@ func NewOptions() *Options {

136139 CookieExpire: time.Duration(168) * time.Hour,

137140 CookieRefresh: time.Duration(0),

138141 },

142+ SessionOptions: options.SessionOptions{

143+ Type: "cookie",

144+ },

139145 SetXAuthRequest: false,

140146 SkipAuthPreflight: false,

141147 PassBasicAuth: true,

@@ -283,9 +289,19 @@ func (o *Options) Validate() error {

283289 "pass_access_token == true or "+

284290 "cookie_refresh != 0, but is %d bytes.%s",

285291 len(secretBytes(o.CookieSecret)), suffix))

292+ } else {

293+ // Enable encryption in the session store

294+ o.EnableCipher = true

286295 }

287296 }

288297

298+ sessionStore, err := sessions.NewSessionStore(&o.SessionOptions, &o.CookieOptions)

299+ if err != nil {

300+ msgs = append(msgs, fmt.Sprintf("error initialising session storage: %v", err))

301+ } else {

302+ o.sessionStore = sessionStore

303+ }

304+

289305 if o.CookieRefresh >= o.CookieExpire {

290306 msgs = append(msgs, fmt.Sprintf(

291307 "cookie_refresh (%s) must be less than "+

pkg/apis/options/sessions.go+5−2

@@ -2,7 +2,8 @@ package options

33// SessionOptions contains configuration options for the SessionStore providers.

44type SessionOptions struct {

5− Type string `flag:"session-store-type" cfg:"session_store_type" env:"OAUTH2_PROXY_SESSION_STORE_TYPE"`

5+ Type string `flag:"session-store-type" cfg:"session_store_type" env:"OAUTH2_PROXY_SESSION_STORE_TYPE"`

6+ EnableCipher bool // Allow the user to choose encryption or not

67 CookieStoreOptions

78}

@@ -11,4 +12,6 @@ type SessionOptions struct {

1112var CookieSessionStoreType = "cookie"

1213

1314// CookieStoreOptions contains configuration options for the CookieSessionStore.

14−type CookieStoreOptions struct{}

15+type CookieStoreOptions struct {

16+ EnableCipher bool // Allow the user to choose encryption or not

17+}

pkg/sessions/cookie/session_store.go+1−1

@@ -126,7 +126,7 @@ func (s *SessionStore) makeCookie(req *http.Request, name string, value string,

126126// the configuration given

127127func NewCookieSessionStore(opts options.CookieStoreOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) {

128128 var cipher *cookie.Cipher

129− if len(cookieOpts.CookieSecret) > 0 {

129+ if opts.EnableCipher {

130130 var err error

131131 cipher, err = cookie.NewCipher(utils.SecretBytes(cookieOpts.CookieSecret))

132132 if err != nil {

pkg/sessions/session_store.go+2

@@ -12,6 +12,8 @@ import (

1212func NewSessionStore(opts *options.SessionOptions, cookieOpts *options.CookieOptions) (sessions.SessionStore, error) {

1313 switch opts.Type {

1414 case options.CookieSessionStoreType:

15+ // Ensure EnableCipher is propogated from the parent option

16+ opts.CookieStoreOptions.EnableCipher = opts.EnableCipher

1517 return cookie.NewCookieSessionStore(opts.CookieStoreOptions, cookieOpts)

1618 default:

1719 return nil, fmt.Errorf("unknown session store type '%s'", opts.Type)

pkg/sessions/session_store_test.go+15−1

@@ -181,12 +181,13 @@ var _ = Describe("NewSessionStore", func() {

181181 SessionStoreInterfaceTests()

182182 })

183183

184− Context("with a cookie-secret set", func() {

184+ Context("with encryption enabled", func() {

185185 BeforeEach(func() {

186186 secret := make([]byte, 32)

187187 _, err := rand.Read(secret)

188188 Expect(err).ToNot(HaveOccurred())

189189 cookieOpts.CookieSecret = base64.URLEncoding.EncodeToString(secret)

190+ opts.EnableCipher = true

190191

191192 ss, err = sessions.NewSessionStore(opts, cookieOpts)

192193 Expect(err).ToNot(HaveOccurred())

@@ -194,6 +195,19 @@ var _ = Describe("NewSessionStore", func() {

194195

195196 SessionStoreInterfaceTests()

196197 })

198+

199+ Context("with encryption enabled, but no secret", func() {

200+ BeforeEach(func() {

201+ opts.EnableCipher = true

202+ })

203+

204+ It("returns an error", func() {

205+ ss, err := sessions.NewSessionStore(opts, cookieOpts)

206+ Expect(err).To(HaveOccurred())

207+ Expect(err.Error()).To(Equal("unable to create cipher: crypto/aes: invalid key size 0"))

208+ Expect(ss).To(BeNil())

209+ })

210+ })

197211 }

198212

199213 BeforeEach(func() {