git.iko.soy/typeable/oauth2-proxy
on master help sign in
Inconsistent code-challenge-method CLI flag and config file naming (#1766)
fcecbebBraunson
CHANGELOG.md+6
compare with master
unifiedsplit
@@ -24,10 +24,16 @@ N/A
24
24
25- [#1774](https://github.com/oauth2-proxy/oauth2-proxy/pull/1774) Fix vulnerabilities CVE-2022-27191, CVE-2021-44716 and CVE-2022-29526
25- [#1774](https://github.com/oauth2-proxy/oauth2-proxy/pull/1774) Fix vulnerabilities CVE-2022-27191, CVE-2021-44716 and CVE-2022-29526
26
26
27+
28+- [#1667](https://github.com/oauth2-proxy/oauth2-proxy/issues/1667) Rename configuration file flag for PKCE
29+to remain consistent with CLI flags. You should specify `code_challenge_method` in your configuration instead of
30+`force_code_challenge_method`.
31+
27- [#1708](https://github.com/oauth2-proxy/oauth2-proxy/pull/1708) Enable different CSRF cookies per request (@miguelborges99)
32- [#1708](https://github.com/oauth2-proxy/oauth2-proxy/pull/1708) Enable different CSRF cookies per request (@miguelborges99)
28 - Add flag "--cookie-csrf-per-request" which activates an algorithm to name CSRF cookies differently per request.
33 - Add flag "--cookie-csrf-per-request" which activates an algorithm to name CSRF cookies differently per request.
29 This feature allows parallel callbacks and by default it is disabled.
34 This feature allows parallel callbacks and by default it is disabled.
30 - Add flag "--cookie-csrf-expire" to define a different expiration time for the CSRF cookie. By default, it is 15 minutes.
35 - Add flag "--cookie-csrf-expire" to define a different expiration time for the CSRF cookie. By default, it is 15 minutes.
36+
31# V7.3.0
37# V7.3.0
32
38
33## Release Highlights
39## Release Highlights
docs/docs/configuration/alpha_config.md+1−1
@@ -419,7 +419,7 @@ Provider holds all configuration for a single provider
419| `validateURL` | _string_ | ValidateURL is the access token validation endpoint |
419| `validateURL` | _string_ | ValidateURL is the access token validation endpoint |
420| `scope` | _string_ | Scope is the OAuth scope specification |
420| `scope` | _string_ | Scope is the OAuth scope specification |
421| `allowedGroups` | _[]string_ | AllowedGroups is a list of restrict logins to members of this group |
421| `allowedGroups` | _[]string_ | AllowedGroups is a list of restrict logins to members of this group |
422−| `force_code_challenge_method` | _string_ | The forced code challenge method |
422+| `code_challenge_method` | _string_ | The code challenge method |
423
423
424### ProviderType
424### ProviderType
425#### (`string` alias)
425#### (`string` alias)
pkg/apis/options/legacy_options.go+9−1
@@ -528,7 +528,9 @@ type LegacyProvider struct {
528 JWTKeyFile string `flag:"jwt-key-file" cfg:"jwt_key_file"`
528 JWTKeyFile string `flag:"jwt-key-file" cfg:"jwt_key_file"`
529 PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url"`
529 PubJWKURL string `flag:"pubjwk-url" cfg:"pubjwk_url"`
530 // PKCE Code Challenge method to use (either S256 or plain)
530 // PKCE Code Challenge method to use (either S256 or plain)
531− CodeChallengeMethod string `flag:"code-challenge-method" cfg:"force_code_challenge_method"`
531+ CodeChallengeMethod string `flag:"code-challenge-method" cfg:"code_challenge_method"`
532+ // Provided for legacy reasons, to be dropped in newer version see #1667
533+ ForceCodeChallengeMethod string `flag:"force-code-challenge-method" cfg:"force_code_challenge_method"`
532}
534}
533
535
534func legacyProviderFlagSet() *pflag.FlagSet {
536func legacyProviderFlagSet() *pflag.FlagSet {
@@ -574,6 +576,7 @@ func legacyProviderFlagSet() *pflag.FlagSet {
574 flagSet.String("prompt", "", "OIDC prompt")
576 flagSet.String("prompt", "", "OIDC prompt")
575 flagSet.String("approval-prompt", "force", "OAuth approval_prompt")
577 flagSet.String("approval-prompt", "force", "OAuth approval_prompt")
576 flagSet.String("code-challenge-method", "", "use PKCE code challenges with the specified method. Either 'plain' or 'S256'")
578 flagSet.String("code-challenge-method", "", "use PKCE code challenges with the specified method. Either 'plain' or 'S256'")
579+ flagSet.String("force-code-challenge-method", "", "Deprecated - use --code-challenge-method")
577
580
578 flagSet.String("acr-values", "", "acr values string: optional")
581 flagSet.String("acr-values", "", "acr values string: optional")
579 flagSet.String("jwt-key", "", "private key in PEM format used to sign JWT, so that you can say something like -jwt-key=\"${OAUTH2_PROXY_JWT_KEY}\": required by login.gov")
582 flagSet.String("jwt-key", "", "private key in PEM format used to sign JWT, so that you can say something like -jwt-key=\"${OAUTH2_PROXY_JWT_KEY}\": required by login.gov")
@@ -665,6 +668,11 @@ func (l *LegacyProvider) convert() (Providers, error) {
665 ExtraAudiences: l.OIDCExtraAudiences,
668 ExtraAudiences: l.OIDCExtraAudiences,
666 }
669 }
667
670
671+ // Support for legacy configuration option
672+ if l.ForceCodeChallengeMethod != "" && l.CodeChallengeMethod == "" {
673+ provider.CodeChallengeMethod = l.ForceCodeChallengeMethod
674+ }
675+
668 // This part is out of the switch section because azure has a default tenant
676 // This part is out of the switch section because azure has a default tenant
669 // that needs to be added from legacy options
677 // that needs to be added from legacy options
670 provider.AzureConfig = AzureOptions{
678 provider.AzureConfig = AzureOptions{
pkg/apis/options/providers.go+2−2
@@ -76,8 +76,8 @@ type Provider struct {
76 Scope string `json:"scope,omitempty"`
76 Scope string `json:"scope,omitempty"`
77 // AllowedGroups is a list of restrict logins to members of this group
77 // AllowedGroups is a list of restrict logins to members of this group
78 AllowedGroups []string `json:"allowedGroups,omitempty"`
78 AllowedGroups []string `json:"allowedGroups,omitempty"`
79− // The forced code challenge method
79+ // The code challenge method
80− CodeChallengeMethod string `json:"force_code_challenge_method,omitempty"`
80+ CodeChallengeMethod string `json:"code_challenge_method,omitempty"`
81}
81}
82
82
83// ProviderType is used to enumerate the different provider type options
83// ProviderType is used to enumerate the different provider type options