git.iko.soy/typeable/oauth2-proxy
on master help sign in
Inconsistent code-challenge-method CLI flag and config file naming (#1766)

* Inconsistent code-challenge-method CLI flag and config file naming - Allow previous config option for now to prevent breaking configs Fixes #1667 * Add changelog entry Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

commitfcecbeb13c64a4f599759f9ac9130098d3ca918f authorBraunson <5280764+braunsonm@users.noreply.github.com> dateThu 1 Sep 2022, 05:58 (4 years ago) parentd19182c
4 files changed+18−4
compare with master
unifiedsplit
CHANGELOG.md+6 docs/docs/configuration/alpha_config.md+1−1 pkg/apis/options/legacy_options.go+9−1 pkg/apis/options/providers.go+2−2
CHANGELOG.md+6
@@ -24,10 +24,16 @@ N/A
2424
2525- [#1774](https://github.com/oauth2-proxy/oauth2-proxy/pull/1774) Fix vulnerabilities CVE-2022-27191, CVE-2021-44716 and CVE-2022-29526
2626
27+
28+- [#1667](https://github.com/oauth2-proxy/oauth2-proxy/issues/1667) Rename configuration file flag for PKCE
29+to remain consistent with CLI flags. You should specify `code_challenge_method` in your configuration instead of
30+`force_code_challenge_method`.
31+
2732- [#1708](https://github.com/oauth2-proxy/oauth2-proxy/pull/1708) Enable different CSRF cookies per request (@miguelborges99)
2833 - Add flag "--cookie-csrf-per-request" which activates an algorithm to name CSRF cookies differently per request.
2934 This feature allows parallel callbacks and by default it is disabled.
3035 - Add flag "--cookie-csrf-expire" to define a different expiration time for the CSRF cookie. By default, it is 15 minutes.
36+
3137# V7.3.0
3238
3339## Release Highlights
docs/docs/configuration/alpha_config.md+1−1
@@ -419,7 +419,7 @@ Provider holds all configuration for a single provider
419419| `validateURL` | _string_ | ValidateURL is the access token validation endpoint |
420420| `scope` | _string_ | Scope is the OAuth scope specification |
421421| `allowedGroups` | _[]string_ | AllowedGroups is a list of restrict logins to members of this group |
422−| `force_code_challenge_method` | _string_ | The forced code challenge method |
422+| `code_challenge_method` | _string_ | The code challenge method |
423423
424424### ProviderType
425425#### (`string` alias)
pkg/apis/options/legacy_options.go+9−1
@@ -528,7 +528,9 @@ type LegacyProvider struct {
528528 JWTKeyFile string `flag:"jwt-key-file" cfg:"jwt_key_file"`
529529 PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url"`
530530 // PKCE Code Challenge method to use (either S256 or plain)
531− CodeChallengeMethod string `flag:"code-challenge-method" cfg:"force_code_challenge_method"`
531+ CodeChallengeMethod string `flag:"code-challenge-method" cfg:"code_challenge_method"`
532+ // Provided for legacy reasons, to be dropped in newer version see #1667
533+ ForceCodeChallengeMethod string `flag:"force-code-challenge-method" cfg:"force_code_challenge_method"`
532534}
533535
534536func legacyProviderFlagSet() *pflag.FlagSet {
@@ -574,6 +576,7 @@ func legacyProviderFlagSet() *pflag.FlagSet {
574576 flagSet.String("prompt", "", "OIDC prompt")
575577 flagSet.String("approval-prompt", "force", "OAuth approval_prompt")
576578 flagSet.String("code-challenge-method", "", "use PKCE code challenges with the specified method. Either 'plain' or 'S256'")
579+ flagSet.String("force-code-challenge-method", "", "Deprecated - use --code-challenge-method")
577580
578581 flagSet.String("acr-values", "", "acr values string: optional")
579582 flagSet.String("jwt-key", "", "private key in PEM format used to sign JWT, so that you can say something like -jwt-key=\"${OAUTH2_PROXY_JWT_KEY}\": required by login.gov")
@@ -665,6 +668,11 @@ func (l *LegacyProvider) convert() (Providers, error) {
665668 ExtraAudiences: l.OIDCExtraAudiences,
666669 }
667670
671+ // Support for legacy configuration option
672+ if l.ForceCodeChallengeMethod != "" && l.CodeChallengeMethod == "" {
673+ provider.CodeChallengeMethod = l.ForceCodeChallengeMethod
674+ }
675+
668676 // This part is out of the switch section because azure has a default tenant
669677 // that needs to be added from legacy options
670678 provider.AzureConfig = AzureOptions{
pkg/apis/options/providers.go+2−2
@@ -76,8 +76,8 @@ type Provider struct {
7676 Scope string `json:"scope,omitempty"`
7777 // AllowedGroups is a list of restrict logins to members of this group
7878 AllowedGroups []string `json:"allowedGroups,omitempty"`
79− // The forced code challenge method
80− CodeChallengeMethod string `json:"force_code_challenge_method,omitempty"`
79+ // The code challenge method
80+ CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
8181}
8282
8383// ProviderType is used to enumerate the different provider type options