127f087...master · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

45 files changed+1073−422

since splitsnapshots

unifiedsplit

.github/renovate.json5+9

@@ -46,6 +46,15 @@

4646 depNameTemplate: "alpine",

4747 datasourceTemplate: "docker",

4848 },

49+ {

50+ customType: "regex",

51+ fileMatch: [

52+ "^Makefile",

53+ ],

54+ matchStrings: [

55+ "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+?GOLANGCILINT_VERSION \\?= (?<currentValue>.*)\\s",

56+ ],

57+ },

4958 {

5059 customType: "regex",

5160 fileMatch: ["(^|/)\\.github/workflows/[^/]+\\.ya?ml$"],

.github/workflows/ci.yml+8−14

@@ -19,7 +19,7 @@ jobs:

1919 runs-on: ubuntu-latest

2020 steps:

2121 - name: Check out code

22− uses: actions/checkout@v6

22+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

2323 with:

2424 fetch-depth: 0

2525

@@ -30,17 +30,11 @@ jobs:

3030 id: go-version

3131

3232 - name: Set up Go

33− uses: actions/setup-go@v6

33+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

3434 with:

3535 go-version: ${{ steps.go-version.outputs.version }}

3636 check-latest: true

3737

38− - name: Install golangci-lint

39− uses: golangci/golangci-lint-action@v9

40− with:

41− install-only: true

42− version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint

43−

4438 - name: Verify Code Generation

4539 run: |

4640 make verify-generate

@@ -74,14 +68,14 @@ jobs:

7468

7569 - name: Upload Coverage Report

7670 if: github.event_name == 'push'

77− uses: qltysh/qlty-action/coverage@v2

71+ uses: qltysh/qlty-action/coverage@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0

7872 with:

7973 oidc: true

8074 files: lcov.info

8175

8276 - name: Run Trivy vulnerability scanner

8377 if: (!startsWith(github.head_ref, 'release'))

84− uses: aquasecurity/trivy-action@0.35.0

78+ uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0

8579 with:

8680 scan-type: 'rootfs'

8781 scan-ref: './oauth2-proxy'

@@ -93,7 +87,7 @@ jobs:

9387

9488 - name: Upload Trivy scan results

9589 if: (!startsWith(github.head_ref, 'release'))

96− uses: github/codeql-action/upload-sarif@v4

90+ uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

9791 with:

9892 sarif_file: 'trivy-results.sarif'

9993

@@ -101,16 +95,16 @@ jobs:

10195 runs-on: ubuntu-latest

10296 steps:

10397 - name: Check out code

104− uses: actions/checkout@v6

98+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

10599 with:

106100 fetch-depth: 0

107101

108102 - name: Set up QEMU

109− uses: docker/setup-qemu-action@v3

103+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

110104

111105 - name: Set up Docker Buildx

112106 id: buildx

113− uses: docker/setup-buildx-action@v3

107+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

114108

115109 - name: Docker Build

116110 if: (!startsWith(github.head_ref, 'release'))

.github/workflows/codeql.yml+4−4

@@ -32,18 +32,18 @@ jobs:

3232

3333 steps:

3434 - name: Checkout repository

35− uses: actions/checkout@v6

35+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

3636

3737 # Initializes the CodeQL tools for scanning.

3838 - name: Initialize CodeQL

39− uses: github/codeql-action/init@v3

39+ uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

4040 with:

4141 languages: go

4242

4343 # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).

4444 # If this step fails, then you should remove it and run the build manually (see below)

4545 - name: Autobuild

46− uses: github/codeql-action/autobuild@v3

46+ uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

4747

4848 # ℹ️ Command-line programs to run using the OS shell.

4949 # 📚 https://git.io/JvXDl

@@ -57,4 +57,4 @@ jobs:

5757 # make release

5858

5959 - name: Perform CodeQL Analysis

60− uses: github/codeql-action/analyze@v3

60+ uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

.github/workflows/create-release.yml+2−2

@@ -17,7 +17,7 @@ jobs:

1717 runs-on: ubuntu-latest

1818 steps:

1919 - name: Check out code

20− uses: actions/checkout@v6

20+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

2121 with:

2222 ref: master

2323 fetch-depth: 0

@@ -54,7 +54,7 @@ jobs:

5454 git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"

5555

5656 - name: Setup node

57− uses: actions/setup-node@v6

57+ uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

5858 with:

5959 node-version-file: docs/package.json

6060

.github/workflows/docs.yml+7−7

@@ -14,13 +14,13 @@ jobs:

1414 if: github.event_name == 'pull_request'

1515 runs-on: ubuntu-latest

1616 steps:

17− - uses: actions/checkout@v6

17+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

1818

1919 - name: Setup Pages

2020 id: pages

21− uses: actions/configure-pages@v5

21+ uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

2222

23− - uses: actions/setup-node@v6

23+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

2424 with:

2525 # renovate: datasource=node-version depName=node

2626 node-version: 24

@@ -35,9 +35,9 @@ jobs:

3535 if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'

3636 runs-on: ubuntu-latest

3737 steps:

38− - uses: actions/checkout@v6

38+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

3939

40− - uses: actions/setup-node@v6

40+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

4141 with:

4242 # renovate: datasource=node-version depName=node

4343 node-version: 24

@@ -49,7 +49,7 @@ jobs:

4949 npm run build

5050

5151 - name: Upload artifact

52− uses: actions/upload-pages-artifact@v3

52+ uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0

5353 with:

5454 path: ./docs/build

5555

@@ -65,4 +65,4 @@ jobs:

6565 steps:

6666 - name: Deploy to GitHub Pages

6767 id: deployment

68− uses: actions/deploy-pages@v4

68+ uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/labeler.yml+1−1

@@ -9,7 +9,7 @@ jobs:

99 pull-requests: write

1010 runs-on: ubuntu-latest

1111 steps:

12− - uses: actions/labeler@v6

12+ - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0

1313 with:

1414 sync-labels: true

1515 dot: true

.github/workflows/nightly.yml+4−4

@@ -12,21 +12,21 @@ jobs:

1212 if: github.repository == 'oauth2-proxy/oauth2-proxy'

1313 steps:

1414 - name: Check out code

15− uses: actions/checkout@v6

15+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

1616 with:

1717 ref: master

1818 fetch-depth: 0

1919 fetch-tags: true

2020

2121 - name: Set up QEMU

22− uses: docker/setup-qemu-action@v3

22+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

2323

2424 - name: Set up Docker Buildx

2525 id: buildx

26− uses: docker/setup-buildx-action@v3

26+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

2727

2828 - name: Login to quay.io

29− uses: docker/login-action@v3

29+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

3030 with:

3131 registry: quay.io/oauth2-proxy

3232 username: ${{ secrets.REGISTRY_USERNAME_NIGHTLY }}

.github/workflows/publish-release.yml+7−13

@@ -20,7 +20,7 @@ jobs:

2020 tag: ${{ steps.tag.outputs.version }}

2121 steps:

2222 - name: Check out code

23− uses: actions/checkout@v6

23+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

2424 with:

2525 ref: ${{ github.event.pull_request.merge_commit_sha }}

2626 fetch-depth: 0

@@ -50,17 +50,11 @@ jobs:

5050 id: go-version

5151

5252 - name: Set up Go

53− uses: actions/setup-go@v6

53+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

5454 with:

5555 go-version: ${{ steps.go-version.outputs.version }}

5656 check-latest: true

5757

58− - name: Install golangci-lint

59− uses: golangci/golangci-lint-action@v9

60− with:

61− install-only: true

62− version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint

63−

6458 - name: Get go dependencies

6559 run: |

6660 go mod download

@@ -70,7 +64,7 @@ jobs:

7064

7165 # Upload artifacts in case of workflow failure

7266 - name: Upload Artifacts

73− uses: actions/upload-artifact@v7

67+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

7468 with:

7569 name: oauth2-proxy-artifacts

7670 path: |

@@ -106,21 +100,21 @@ jobs:

106100 runs-on: ubuntu-latest

107101 steps:

108102 - name: Check out code

109− uses: actions/checkout@v6

103+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

110104 with:

111105 ref: ${{ needs.publish.outputs.tag }}

112106 fetch-depth: 0

113107 fetch-tags: true

114108

115109 - name: Set up QEMU

116− uses: docker/setup-qemu-action@v3

110+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

117111

118112 - name: Set up Docker Buildx

119113 id: buildx

120− uses: docker/setup-buildx-action@v3

114+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

121115

122116 - name: Login to quay.io

123− uses: docker/login-action@v3

117+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

124118 with:

125119 registry: quay.io/oauth2-proxy

126120 username: ${{ secrets.REGISTRY_USERNAME }}

.github/workflows/stale.yml+1−1

@@ -10,7 +10,7 @@ jobs:

1010 runs-on: ubuntu-latest

1111

1212 steps:

13− - uses: actions/stale@v10

13+ - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0

1414 with:

1515 repo-token: ${{ secrets.GITHUB_TOKEN }}

1616 days-before-stale: 180

CHANGELOG.md+27

@@ -6,8 +6,35 @@

77## Breaking Changes

9+## Changes since v7.15.4

10+

11+# V7.15.4

12+

13+## Release Highlights

14+

15+- 🔵 Golang version upgrade to v1.26.7

16+ - Upgrade of all dependencies to their latest versions

17+- 🕵️‍♀️ Vulnerabilities have been addressed

18+ - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818)

19+ - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821)

20+ - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822)

21+ - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505)

22+ - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600)

23+ - [CVE-2026-56852](https://nvd.nist.gov/vuln/detail/CVE-2026-56852)

24+ - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853)

25+ - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858)

26+ - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859)

27+ - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860)

28+ - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862)

29+

30+## Important Notes

31+

32+## Breaking Changes

33+

934## Changes since v7.15.3

1035

36+- [#3493](https://github.com/oauth2-proxy/oauth2-proxy/pull/3493) chore(deps): update gomod @tuunit

37+

1138# V7.15.3

1239

1340## Release Highlights

Makefile+9−4

@@ -25,7 +25,8 @@ help: ## Display this help

2525

2626

2727GO ?= go

28−GOLANGCILINT ?= golangci-lint

28+# renovate: datasource=github-tags depName=golangci/golangci-lint

29+GOLANGCILINT_VERSION ?= v2.11.4

2930

3031BINARY := oauth2-proxy

3132VERSION ?= $(shell git describe --always --dirty --tags 2>/dev/null || echo "undefined")

@@ -66,7 +67,7 @@ DOCKER_BUILDX_PUSH := $(DOCKER_BUILDX) --push

6667DOCKER_BUILDX_PUSH_X_PLATFORM := $(DOCKER_BUILDX_PUSH) --platform ${DOCKER_BUILD_PLATFORM}

6768

6869DOCKER_BUILD_PLATFORM_ALPINE ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v6,linux/arm/v7,linux/s390x

69−DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.23.3

70+DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.24.1

7071DOCKER_BUILDX_ARGS_ALPINE ?= --build-arg RUNTIME_IMAGE=${DOCKER_BUILD_RUNTIME_IMAGE_ALPINE} ${DOCKER_BUILDX_COMMON_ARGS}

7172DOCKER_BUILDX_X_PLATFORM_ALPINE := docker buildx build ${DOCKER_BUILDX_ARGS_ALPINE} --platform ${DOCKER_BUILD_PLATFORM_ALPINE}

7273DOCKER_BUILDX_PUSH_X_PLATFORM_ALPINE := $(DOCKER_BUILDX_X_PLATFORM_ALPINE) --push

@@ -143,7 +144,7 @@ verify-generate: generate ## Verify command to check if alpha config docs are in

143144##@ Miscellaneous

144145

145146.PHONY: test

146−test: lint ## Run all Go tests

147+test: ## Run all Go tests

147148 GO111MODULE=on $(GO) test $(TESTCOVER) -v -race ./...

148149

149150.PHONY: release

@@ -157,7 +158,11 @@ clean: ## Cleanup release and build files

157158

158159.PHONY: lint

159160lint: validate-go-version ## Lint all files using golangci-lint

160− GO111MODULE=on $(GOLANGCILINT) run

161+ GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m

162+

163+.PHONY: lint-fix

164+lint-fix: validate-go-version ## Lint all files and apply fixes using golangci-lint

165+ GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m --fix

161166

162167.PHONY: validate-go-version

163168validate-go-version: ## Validate Go environment requirements

README.md+1−1

@@ -51,7 +51,7 @@ Microsoft Azure credits for open source projects

5151## Getting Involved

5252[![Slack](https://img.shields.io/badge/slack-CNCF_%23oauth2--proxy-blue?logo=slack)](https://cloud-native.slack.com/archives/C098Y5URZ2N)

5353

54−Join the #oauth2-proxy [Slack channel](https://cloud-native.slack.com/archives/C098Y5URZ2N) to chat with other users of OAuth2 Proxy or reach out to the maintainers directly. Use the [public invite link](https://communityinviter.com/apps/cloud-native/cncf) to get an invite for the Gopher Slack space.

54+Join the #oauth2-proxy [Slack channel](https://cloud-native.slack.com/archives/C098Y5URZ2N) to chat with other users of OAuth2 Proxy or reach out to the maintainers directly. Use the [public invite link](https://slack.cncf.io/) to get an invite for the CNCF space.

5555

5656OAuth2 Proxy is a community-driven project. We rely on the contribut️ions of our users to continually improve it. While review times can vary, we appreciate your patience and understanding. As a volunteer-driven project, we strive to keep this project stable and might take longer to merge changes.

5757

contrib/local-environment/Makefile+2−2

@@ -49,8 +49,8 @@ kubernetes-down:

4949

5050.PHONY: traefik-up

5151traefik-up:

52− docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml up -d

52+ docker compose -f docker-compose-traefik.yaml up -d

5353

5454.PHONY: traefik-%

5555traefik-%:

56− docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml $*

56+ docker compose -f docker-compose-traefik.yaml $*

contrib/local-environment/dex-traefik.yamlnew file+25

@@ -0,0 +1,25 @@

1+# This configuration is intended to be used with the Traefik local environment.

2+# Dex uses in-memory storage because this environment is disposable.

3+issuer: http://dex.localtest.me/dex

4+storage:

5+ type: memory

6+web:

7+ http: 0.0.0.0:5556

8+oauth2:

9+ skipApprovalScreen: true

10+expiry:

11+ signingKeys: "4h"

12+ idTokens: "1h"

13+staticClients:

14+ - id: oauth2-proxy

15+ redirectURIs:

16+ - "http://oauth2-proxy.localtest.me/oauth2/callback"

17+ name: "OAuth2 Proxy"

18+ secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

19+enablePasswordDB: true

20+staticPasswords:

21+ - email: "admin@example.com"

22+ # bcrypt hash of the string "password"

23+ hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"

24+ username: "admin"

25+ userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"

contrib/local-environment/dex.yaml+1−6

@@ -3,11 +3,7 @@

33# This should configure Dex to run on port 5556 and provides a static login

44issuer: http://dex.localtest.me:5556/dex

55storage:

6− type: etcd

7− config:

8− endpoints:

9− - http://etcd:2379

10− namespace: dex/

6+ type: memory

117web:

128 http: 0.0.0.0:5556

139oauth2:

@@ -21,7 +17,6 @@ staticClients:

2117 # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.

2218 - "http://oauth2-proxy.localtest.me:4180/oauth2/callback" # For basic proxy example.

2319 - "http://oauth2-proxy.localtest.me:8080/oauth2/callback" # For nginx example.

24− - "http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback" # For traefik example.

2520 name: "OAuth2 Proxy"

2621 secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

2722enablePasswordDB: true

contrib/local-environment/docker-compose-alpha-config.yaml+2−15

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex and HTTPBin as an example upstream.

4+# HTTPBin as an example upstream.

55# This file also uses alpha configuration when configuring OAuth2 Proxy.

66#

77# This file is an extension of the main compose file and must be used with it

@@ -14,7 +14,7 @@ version: "3.0"

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

1818 command: --config /oauth2-proxy.cfg --alpha-config /oauth2-proxy-alpha-config.yaml

1919 hostname: oauth2-proxy

2020 volumes:

@@ -43,25 +43,12 @@ services:

4343 dex:

4444 aliases:

4545 - dex.localtest.me

46− etcd: {}

47− depends_on:

48− - etcd

4946 httpbin:

5047 container_name: httpbin

5148 image: kennethreitz/httpbin

5249 ports: []

5350 networks:

5451 httpbin: {}

55− etcd:

56− container_name: etcd

57− image: gcr.io/etcd-development/etcd:v3.6.12

58− entrypoint: /usr/local/bin/etcd

59− command:

60− - --listen-client-urls=http://0.0.0.0:2379

61− - --advertise-client-urls=http://etcd:2379

62− networks:

63− etcd: {}

6452networks:

6553 dex: {}

66− etcd: {}

6754 httpbin: {}

contrib/local-environment/docker-compose-gitea.yaml+2−2

@@ -14,7 +14,7 @@ version: '3.0'

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

1818 command: --config /oauth2-proxy.cfg

1919 hostname: oauth2-proxy

2020 volumes:

@@ -39,7 +39,7 @@ services:

3939 httpbin: {}

4040

4141 gitea:

42− image: gitea/gitea:1.26.2

42+ image: gitea/gitea:1.27.2

4343 container_name: gitea

4444 environment:

4545 - USER_UID=1000

contrib/local-environment/docker-compose-keycloak.yaml+2−2

@@ -14,7 +14,7 @@ version: "3.0"

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

1818 command: --config /oauth2-proxy.cfg

1919 hostname: oauth2-proxy

2020 volumes:

@@ -40,7 +40,7 @@ services:

4040

4141 keycloak:

4242 container_name: keycloak

43− image: keycloak/keycloak:25.0

43+ image: keycloak/keycloak:26.7

4444 hostname: keycloak

4545 command:

4646 - "start-dev"

contrib/local-environment/docker-compose-nginx.yaml+3−28

@@ -1,28 +1,18 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex, nginx as a reverse proxy and other http services for upstreams

4+# nginx as a reverse proxy and other HTTP services for upstreams.

55#

66# This file is an extension of the main compose file and must be used with it

77# docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml <command>

88# Alternatively:

99# make nginx-<command> (eg make nginx-up, make nginx-down)

1010#

11−# Access one of the following URLs to initiate a login flow:

12−# - http://oauth2-proxy.localhost

13−# - http://httpbin.oauth2-proxy.localhost

14−#

15−# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16−#

17−# Note, the above URLs should work with Chrome, but you may need to add hosts

18−# entries for other browsers

19−# 127.0.0.1 oauth2-proxy.localhost

20−# 127.0.0.1 httpbin.oauth2-proxy.localhost

21−# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

11+# Access http://oauth2-proxy.localtest.me:8080 to initiate a login flow.

2212version: "3.0"

2313services:

2414 oauth2-proxy:

25− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

15+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

2616 ports: []

2717 hostname: oauth2-proxy

2818 container_name: oauth2-proxy

@@ -33,7 +23,6 @@ services:

3323 networks:

3424 oauth2-proxy: {}

3525 dex: {}

36− etcd: {}

3726 httpbin: {}

3827 depends_on:

3928 - dex

@@ -52,7 +41,6 @@ services:

5241 networks:

5342 oauth2-proxy: {}

5443 dex: {}

55− etcd: {}

5644 httpbin: {}

5745 dex:

5846 container_name: dex

@@ -68,26 +56,13 @@ services:

6856 dex:

6957 aliases:

7058 - dex.localtest.me

71− etcd: {}

72− depends_on:

73− - etcd

7459 httpbin:

7560 container_name: httpbin

7661 image: kennethreitz/httpbin

7762 ports: []

7863 networks:

7964 httpbin: {}

80− etcd:

81− container_name: etcd

82− image: gcr.io/etcd-development/etcd:v3.6.12

83− entrypoint: /usr/local/bin/etcd

84− command:

85− - --listen-client-urls=http://0.0.0.0:2379

86− - --advertise-client-urls=http://etcd:2379

87− networks:

88− etcd: {}

8965networks:

9066 dex: {}

91− etcd: {}

9267 httpbin: {}

9368 oauth2-proxy: {}

contrib/local-environment/docker-compose-traefik.yaml+42−18

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

3−# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# HTTPBin as an example upstream.

3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider

4+# and HTTPBin as an example upstream.

55#

66# This can either be created using docker-compose

77# docker-compose -f docker-compose-traefik.yaml <command>

@@ -9,32 +9,51 @@

99# make traefik-<command> (eg. make traefik-up, make traefik-down)

1010#

1111# Access one of the following URLs to initiate a login flow:

12−# - http://oauth2-proxy.localhost

13−# - http://httpbin.oauth2-proxy.localhost

12+# - http://oauth2-proxy.localtest.me

13+# - http://httpbin.localtest.me

14+# - http://dex.localtest.me/dex

1415#

15−# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16−#

17−# Note, the above URLs should work with Chrome, but you may need to add hosts

18−# entries for other browsers

19−# 127.0.0.1 oauth2-proxy.localhost

20−# 127.0.0.1 httpbin.oauth2-proxy.localhost

21−# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

22−version: '3.0'

16+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.localtest.me

2317services:

2418

2519 oauth2-proxy:

26− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

20+ container_name: oauth2-proxy

21+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

22+ command: --config /oauth2-proxy.cfg

2723 ports: []

2824 hostname: oauth2-proxy

2925 volumes:

3026 - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"

27+ restart: unless-stopped

28+ networks:

29+ oauth2-proxy: {}

30+ dex: {}

31+ depends_on:

32+ - dex

33+ - httpbin

34+

35+ dex:

36+ container_name: dex

37+ image: ghcr.io/dexidp/dex:v2.45.1

38+ command: dex serve /dex.yaml

39+ hostname: dex

40+ volumes:

41+ - "./dex-traefik.yaml:/dex.yaml"

42+ restart: unless-stopped

3143 networks:

32− oauth2-proxy:

44+ dex: {}

45+

46+ httpbin:

47+ container_name: httpbin

48+ image: kennethreitz/httpbin

49+ ports: []

50+ networks:

51+ httpbin: {}

3352

3453 # Reverse proxy

3554 gateway:

3655 container_name: traefik

37− image: traefik:v2.11.50

56+ image: traefik:v3.7.10

3857 volumes:

3958 - "./traefik:/etc/traefik"

4059 ports:

@@ -43,8 +62,13 @@ services:

4362 depends_on:

4463 - oauth2-proxy

4564 networks:

46− oauth2-proxy:

47− httpbin:

65+ oauth2-proxy: {}

66+ httpbin: {}

67+ dex:

68+ aliases:

69+ - dex.localtest.me

4870

4971networks:

50− oauth2-proxy:

72+ dex: {}

73+ httpbin: {}

74+ oauth2-proxy: {}

contrib/local-environment/docker-compose.yaml+2−15

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex and HTTPBin as an example upstream.

4+# HTTPBin as an example upstream.

55#

66# This can either be created using docker-compose

77# docker-compose -f docker-compose.yaml <command>

@@ -13,7 +13,7 @@ version: "3.0"

1313services:

1414 oauth2-proxy:

1515 container_name: oauth2-proxy

16− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

16+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

1717 command: --config /oauth2-proxy.cfg

1818 hostname: oauth2-proxy

1919 volumes:

@@ -41,25 +41,12 @@ services:

4141 dex:

4242 aliases:

4343 - dex.localtest.me

44− etcd: {}

45− depends_on:

46− - etcd

4744 httpbin:

4845 container_name: httpbin

4946 image: kennethreitz/httpbin

5047 ports: []

5148 networks:

5249 httpbin: {}

53− etcd:

54− container_name: etcd

55− image: gcr.io/etcd-development/etcd:v3.6.12

56− entrypoint: /usr/local/bin/etcd

57− command:

58− - --listen-client-urls=http://0.0.0.0:2379

59− - --advertise-client-urls=http://etcd:2379

60− networks:

61− etcd: {}

6250networks:

6351 dex: {}

64− etcd: {}

6552 httpbin: {}

contrib/local-environment/kubernetes/Chart.lock+3−3

@@ -1,7 +1,7 @@

11dependencies:

22- name: dex

33 repository: https://charts.dexidp.io

4− version: 0.24.0

4+ version: 0.24.1

55- name: oauth2-proxy

66 repository: https://oauth2-proxy.github.io/manifests

77 version: 7.18.0

@@ -11,5 +11,5 @@ dependencies:

1111- name: hello-world

1212 repository: https://conservis.github.io/helm-charts

1313 version: 1.1.0

14−digest: sha256:fee913531bfb67e5555e995d8fb040c330e6eb4b5a8c777ceb9841135ea9bb84

15−generated: "2025-10-28T06:46:35.38300324Z"

14+digest: sha256:3fff8bf99cebcd20a73c984423d5f1c2dfa1e5a394f82a5dc60d9aaffe5361b7

15+generated: "2026-08-18T07:33:03.791274914Z"

contrib/local-environment/kubernetes/Chart.yaml+1−1

@@ -3,7 +3,7 @@ description: K8S example based on https://kind.sigs.k8s.io

33name: kubernetes

44dependencies:

55 - name: dex

6− version: 0.24.0

6+ version: 0.24.1

77 repository: https://charts.dexidp.io

88 - name: oauth2-proxy

99 version: &chartVersion 7.18.0

contrib/local-environment/oauth2-proxy-traefik.cfg+4−4

@@ -2,14 +2,14 @@ http_address="0.0.0.0:4180"

22cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

33provider="oidc"

44email_domains=["example.com"]

5−oidc_issuer_url="http://dex.localhost:5556/dex"

5+oidc_issuer_url="http://dex.localtest.me/dex"

66client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

77client_id="oauth2-proxy"

88cookie_secure="false"

10−redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"

11−cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.

12−whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.

10+redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"

11+cookie_domains=".localtest.me" # Required so cookie can be read on all subdomains.

12+whitelist_domains=".localtest.me" # Required to allow redirection back to original requested target.

1313

1414# Mandatory option when using oauth2-proxy with traefik

1515reverse_proxy="true"

contrib/local-environment/traefik/dynamic.yaml+11−4

@@ -1,22 +1,25 @@

11http:

22 routers:

33 oauth2-proxy-route:

4− rule: "Host(`oauth2-proxy.oauth2-proxy.localhost`)"

4+ rule: "Host(`oauth2-proxy.localtest.me`)"

55 middlewares:

66 - auth-headers

77 service: oauth-backend

8+ dex-route:

9+ rule: "Host(`dex.localtest.me`)"

10+ service: dex-service

811 httpbin-route:

9− rule: "Host(`httpbin.oauth2-proxy.localhost`)"

12+ rule: "Host(`httpbin.localtest.me`)"

1013 service: httpbin-service

1114 middlewares:

1215 - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin

1316 httpbin-route-2:

14− rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/no-auto-redirect`)"

17+ rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/no-auto-redirect`)"

1518 service: httpbin-service

1619 middlewares:

1720 - oauth-auth-wo-redirect # unauthenticated session will return a 401

1821 services-oauth2-route:

19− rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/oauth2/`)"

22+ rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/oauth2/`)"

2023 middlewares:

2124 - auth-headers

2225 service: oauth-backend

@@ -30,6 +33,10 @@ http:

3033 loadBalancer:

3134 servers:

3235 - url: http://oauth2-proxy:4180

36+ dex-service:

37+ loadBalancer:

38+ servers:

39+ - url: http://dex:5556

3340

3441 middlewares:

3542 auth-headers:

contrib/local-environment/traefik/traefik.yaml+2

@@ -5,3 +5,5 @@ log:

55providers:

66 file:

77 filename: /etc/traefik/dynamic.yaml

8+ # Routes are static for this example; disabling watch avoids host inotify limits.

9+ watch: false

docs/docs/configuration/alpha_config.md+12−1

@@ -167,6 +167,17 @@ injectResponseHeaders:

167167* `claimSource` - `claim` (session claims either from id token or from profile URL)

168168* `secretSource` - `value` (base64), `fromFile` (file path)

169169

170+#### Claim value serialization

171+

172+`claimSource` converts the selected claim into one or more string header values. Scalars

173+produce one value, while arrays produce one value per element. Values that cannot be

174+converted directly to strings, such as objects, are JSON-encoded individually.

175+

176+Each non-empty value is added separately under the configured header name. An array of

177+objects therefore produces multiple header values containing one JSON object each, not a

178+single JSON array. HTTP libraries and intermediaries may expose repeated values as a

179+comma-joined string, so consumers should retrieve and parse each header value separately.

180+

170181**Request option:** `preserveRequestValue: true` retains existing header values

171182

172183**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

@@ -678,7 +689,7 @@ Requests will be proxied to this upstream if the path matches the request path.

678689| Field | Type | Description |

679690| ----- | ---- | ----------- |

680691| `id` | _string_ | ID should be a unique identifier for the upstream. This value is required for all upstreams. |

681−| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Path can also take a pattern when used with RewriteTarget. Path segments can be captured and matched using regular experessions. Eg: - `^/foo$`: Match only the explicit path `/foo` - `^/bar/$`: Match any path prefixed with `/bar/` - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |

692+| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Without RewriteTarget, Path follows gorilla/mux route syntax. Eg: - `/foo`: Match only the explicit path `/foo` - `/bar/`: Match any path prefixed with `/bar/` - `/baz/{path:.*}`: Match any path prefixed with `/baz/` When RewriteTarget is set, Path is treated as a regular expression. Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the remaining path for use with RewriteTarget. |

682693| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem (for a `file:` upstream). Use the Path to capture segments for reuse within the rewrite target. Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite the request `/baz/abc/123` to `/foo/abc/123` before proxying to the upstream server. Or if the upstream were `file:///app`, a request for `/baz/info.html` would return the contents of the file `/app/foo/info.html`. |

683694| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File based URL. It may include a path, in which case all requests will be served under that path. Eg: - http://localhost:8080 - https://service.localhost - https://service.localhost/path - file://host/path If the URI's path is "/base" and the incoming request was for "/dir", the upstream request will be for "/base/dir". |

684695| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts. This option is insecure and will allow potential Man-In-The-Middle attacks between OAuth2 Proxy and the upstream server. Defaults to false. |

docs/docs/configuration/alpha_config.md.tmpl+11

@@ -167,6 +167,17 @@ injectResponseHeaders:

167167* `claimSource` - `claim` (session claims either from id token or from profile URL)

168168* `secretSource` - `value` (base64), `fromFile` (file path)

169169

170+#### Claim value serialization

171+

172+`claimSource` converts the selected claim into one or more string header values. Scalars

173+produce one value, while arrays produce one value per element. Values that cannot be

174+converted directly to strings, such as objects, are JSON-encoded individually.

175+

176+Each non-empty value is added separately under the configured header name. An array of

177+objects therefore produces multiple header values containing one JSON object each, not a

178+single JSON array. HTTP libraries and intermediaries may expose repeated values as a

179+comma-joined string, so consumers should retrieve and parse each header value separately.

180+

170181**Request option:** `preserveRequestValue: true` retains existing header values

171182

172183**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

docs/docs/configuration/integrations/nginx.md+27−11

@@ -60,23 +60,23 @@ server {

6060 auth_request_set $auth_cookie $upstream_http_set_cookie;

6161 add_header Set-Cookie $auth_cookie;

6262

63− # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb

64− # limit and so the OAuth2 Proxy splits these into multiple parts.

63+ # Large OIDC tokens can make the session cookie exceed the 4KB limit,

64+ # causing OAuth2 Proxy to split the cookie into multiple parts.

6565 # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,

66− # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.

67− auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

66+ # so extract the second part when using the default cookie name, `_oauth2_proxy`.

67+ auth_request_set $auth_cookie_upstream_1 $upstream_cookie__oauth2_proxy_1;

6868

6969 # Extract the Cookie attributes from the first Set-Cookie header and append them

7070 # to the second part ($upstream_cookie_* variables only contain the raw cookie content)

7171 if ($auth_cookie ~* "(; .*)") {

72− set $auth_cookie_name_0 $auth_cookie;

73− set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";

72+ set $auth_cookie_0 $auth_cookie;

73+ set $auth_cookie_1 "_oauth2_proxy_1=$auth_cookie_upstream_1$1";

7474 }

7575

7676 # Send both Set-Cookie headers now if there was a second part

77− if ($auth_cookie_name_upstream_1) {

78− add_header Set-Cookie $auth_cookie_name_0;

79− add_header Set-Cookie $auth_cookie_name_1;

77+ if ($auth_cookie_upstream_1) {

78+ add_header Set-Cookie $auth_cookie_0;

79+ add_header Set-Cookie $auth_cookie_1;

8080 }

8181

8282 proxy_pass http://backend/;

@@ -91,6 +91,24 @@ server {

9191}

9292```

9393

94+### Multi-part session cookies

95+

96+The example above is ready to use with the default `--cookie-name=_oauth2_proxy` setting and handles a session split into two cookies. If you configure a custom cookie name, update both references to the second cookie part:

97+

98+| Cookie configuration | Nginx upstream cookie variable | `Set-Cookie` name |

99+| --- | --- | --- |

100+| Default (`_oauth2_proxy`) | `$upstream_cookie__oauth2_proxy_1` | `_oauth2_proxy_1=` |

101+| `--cookie-name=my_cookie` | `$upstream_cookie_my_cookie_1` | `my_cookie_1=` |

102+

103+For example, with `--cookie-name=my_cookie`, change the relevant lines to:

104+

105+```nginx

106+auth_request_set $auth_cookie_upstream_1 $upstream_cookie_my_cookie_1;

107+set $auth_cookie_1 "my_cookie_1=$auth_cookie_upstream_1$1";

108+```

109+

110+If a session is split into more than two cookies, repeat the extraction for each additional numeric suffix. For consistently large sessions, prefer `--session-store-type=redis` so only a small session ticket is stored in the browser cookie.

111+

94112### Understanding the `error_page` redirect pattern

95113

96114The `auth_request` directive expects the authentication endpoint (`/oauth2/auth`) to return:

@@ -167,8 +185,6 @@ It is recommended to use `--session-store-type=redis` when expecting large sessi

167185For a complete example of integrating oauth2-proxy with Kubernetes Dashboard on AKS using Azure Entra ID, including RBAC configuration and troubleshooting, see the [Kubernetes Dashboard on AKS](../providers/ms_entra_id.md#kubernetes-dashboard-on-aks) section in the Microsoft Entra ID provider documentation.

168186:::

169187

170−You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

171−

172188:::note

173189If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.

174190:::

docs/docs/configuration/providers/atlassian.mdnew file+26

@@ -0,0 +1,26 @@

1+---

2+id: atlassian

3+title: Atlassian Cloud

4+---

6+1. Create an OAuth 2.0 integration in the [Atlassian developer console](https://developer.atlassian.com/console/myapps/).

7+2. Under **Permissions**, add the User identity API with the `read:me` scope.

8+3. Under **Authorization**, set the callback URL to `https://<proxy_host>/oauth2/callback`.

9+4. Copy the client ID and secret from **Settings**.

10+5. Run the proxy with:

11+

12+```shell

13+ --provider=atlassian

14+ --client-id=<client ID>

15+ --client-secret=<secret>

16+ --redirect-url=https://<proxy_host>/oauth2/callback

17+ --cookie-secret=<cookie secret>

18+```

19+

20+A new app works only for the account that created it. Enable sharing under **Distribution** to let other users sign in.

21+Atlassian then admits only accounts with access to the Atlassian site the app is installed on; others are refused at

22+the consent screen.

23+

24+The proxy reads the user's email from `https://api.atlassian.com/me`. Restricting access further is supported by

25+[email](index.md#email-authentication). With `--cookie-refresh` set, the proxy re-validates the token against `/me` on

26+that interval.

docs/docs/configuration/providers/dtt_sso.mdnew file+45

@@ -0,0 +1,45 @@

1+---

2+id: dtt_sso

3+title: DTT SSO

4+---

6+Signs users in with the DTT SSO (auth-server) using the authorization code flow and its HS256 id_token.

8+1. Register a client in the auth-server config, one per protected service, with the proxy's callback as its

9+ only redirect URI:

10+

11+ ```yaml

12+ clients:

13+ redash-gate:

14+ secret: <random secret>

15+ redirect_uri: https://redash.example.com/oauth2/callback

16+ display_name: Redash

17+ ```

18+

19+2. Run the proxy with:

20+

21+ ```shell

22+ --provider=dtt-sso

23+ --client-id=redash-gate

24+ --client-secret-file=/run/secrets/client_secret

25+ --redirect-url=https://redash.example.com/oauth2/callback

26+ --cookie-secret-file=/run/secrets/cookie_secret

27+ --cookie-name=_dtt_sso_redash

28+ --cookie-refresh=5m

29+ ```

30+

31+ Give each instance its own `--cookie-name`: another oauth2-proxy setting its cookie on a parent domain

32+ (the Atlassian proxy uses `_oauth2_proxy` on `.thebestagent.pro`) would otherwise shadow this one.

33+

34+The endpoints default to `https://auth.thebestagent.pro`. For another SSO host set `--login-url`, `--redeem-url`

35+and `--validate-url` to its `/oauth/authorize`, `/oauth/token` and `/oauth/check_token`; the id_token issuer must

36+equal the login URL's origin (the SSO's `site_host`).

37+

38+The scope must stay `openid`, the only scope the SSO accepts.

39+

40+The session carries the SSO `email`, the user UUID as the user, and the SSO `role` as the only group, so

41+`--allowed-group=dtt_admin` restricts access by role. `--authenticated-emails-file` and `--email-domain` restrict

42+by email as usual.

43+

44+With `--cookie-refresh` set, the proxy refreshes the tokens on that interval and re-reads the email and role; a user

45+deleted or signed out in the SSO loses access at the next refresh.

docs/docs/configuration/providers/index.md+2

@@ -9,10 +9,12 @@ with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.

99Valid providers are :

1010

1111- [ADFS](adfs.md)

12+- [Atlassian Cloud](atlassian.md)

1213- [Bitbucket](bitbucket.md)

1314- [Cidaas](cidaas.md)

1415- [CiscoDuo](cisco_duo.md)

1516- [DigitalOcean](digitalocean.md)

17+- [DTT SSO](dtt_sso.md)

1618- [Facebook](facebook.md)

1719- [Gitea](gitea.md)

1820- [GitHub](github.md)

docs/docs/installation.md+1−1

@@ -5,7 +5,7 @@ title: Installation

661. Choose how to deploy:

8− a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.3`)

8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)

1010 b. Using Go to install the latest release

1111 ```bash

docs/sidebars.js+2

@@ -46,11 +46,13 @@ const sidebars = {

4646 },

4747 items: [

4848 "configuration/providers/adfs",

49+ "configuration/providers/atlassian",

4950 "configuration/providers/azure",

5051 "configuration/providers/bitbucket",

5152 "configuration/providers/cidaas",

5253 "configuration/providers/cisco_duo",

5354 "configuration/providers/digitalocean",

55+ "configuration/providers/dtt_sso",

5456 "configuration/providers/facebook",

5557 "configuration/providers/gitea",

5658 "configuration/providers/github",

docs/versioned_docs/version-7.15.x/installation.md+1−1

@@ -5,7 +5,7 @@ title: Installation

661. Choose how to deploy:

8− a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.3`)

8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)

1010 b. Using Go to install the latest release

1111 ```bash

go.mod+33−37

@@ -9,7 +9,7 @@ require (

99 github.com/alicebob/miniredis/v2 v2.38.0

1010 github.com/bitly/go-simplejson v0.5.1

1111 github.com/bsm/redislock v0.10.0

12− github.com/coreos/go-oidc/v3 v3.18.0

12+ github.com/coreos/go-oidc/v3 v3.20.0

1313 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf

1414 github.com/fsnotify/fsnotify v1.10.1

1515 github.com/go-jose/go-jose/v3 v3.0.5

@@ -21,67 +21,63 @@ require (

2121 github.com/gorilla/mux v1.8.1

2222 github.com/justinas/alice v1.2.0

2323 github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25

24− github.com/onsi/ginkgo/v2 v2.30.0

25− github.com/onsi/gomega v1.41.0

26− github.com/pierrec/lz4/v4 v4.1.27

27− github.com/prometheus/client_golang v1.23.2

28− github.com/redis/go-redis/v9 v9.20.1

24+ github.com/onsi/ginkgo/v2 v2.32.1

25+ github.com/onsi/gomega v1.42.1

26+ github.com/pierrec/lz4/v4 v4.1.28

27+ github.com/prometheus/client_golang v1.24.1

28+ github.com/redis/go-redis/v9 v9.22.0

2929 github.com/spf13/cast v1.10.0

3030 github.com/spf13/pflag v1.0.10

3131 github.com/spf13/viper v1.21.0

32− github.com/stretchr/testify v1.11.1

32+ github.com/stretchr/testify v1.12.0

3333 github.com/vmihailenco/msgpack/v5 v5.4.1

34− go.yaml.in/yaml/v3 v3.0.4

35− golang.org/x/crypto v0.53.0

36− golang.org/x/net v0.56.0

34+ go.yaml.in/yaml/v3 v3.0.5

35+ golang.org/x/crypto v0.55.0

36+ golang.org/x/net v0.58.0

3737 golang.org/x/oauth2 v0.36.0

38− golang.org/x/sync v0.21.0

39− google.golang.org/api v0.284.0

38+ golang.org/x/sync v0.22.0

39+ google.golang.org/api v0.293.0

4040 gopkg.in/natefinch/lumberjack.v2 v2.2.1

41− k8s.io/apimachinery v0.36.2

41+ k8s.io/apimachinery v0.36.3

4242)

4343

4444require (

45− cloud.google.com/go/auth v0.20.0 // indirect

45+ cloud.google.com/go/auth v0.23.1 // indirect

4646 cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect

4747 github.com/Masterminds/semver/v3 v3.5.0 // indirect

4848 github.com/beorn7/perks v1.0.1 // indirect

4949 github.com/cespare/xxhash/v2 v2.3.0 // indirect

50− github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect

51− github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect

52− github.com/felixge/httpsnoop v1.0.4 // indirect

53− github.com/go-logr/logr v1.4.3 // indirect

50+ github.com/felixge/httpsnoop v1.1.0 // indirect

51+ github.com/go-logr/logr v1.4.4 // indirect

5452 github.com/go-logr/stdr v1.2.2 // indirect

5553 github.com/go-task/slim-sprig/v3 v3.0.0 // indirect

56− github.com/google/pprof v0.0.0-20260604005048-7023385849c0 // indirect

54+ github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect

5755 github.com/google/s2a-go v0.1.9 // indirect

58− github.com/googleapis/enterprise-certificate-proxy v0.3.16 // indirect

59− github.com/googleapis/gax-go/v2 v2.22.0 // indirect

56+ github.com/googleapis/enterprise-certificate-proxy v0.3.21 // indirect

57+ github.com/googleapis/gax-go/v2 v2.23.0 // indirect

6058 github.com/kylelemons/godebug v1.1.0 // indirect

6159 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

62− github.com/pelletier/go-toml/v2 v2.3.1 // indirect

63− github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect

60+ github.com/pelletier/go-toml/v2 v2.4.3 // indirect

6461 github.com/prometheus/client_model v0.6.2 // indirect

65− github.com/prometheus/common v0.68.1 // indirect

66− github.com/prometheus/procfs v0.20.1 // indirect

62+ github.com/prometheus/common v0.70.1 // indirect

63+ github.com/prometheus/procfs v0.21.1 // indirect

6764 github.com/sagikazarmark/locafero v0.12.0 // indirect

6865 github.com/spf13/afero v1.15.0 // indirect

6966 github.com/subosito/gotenv v1.6.0 // indirect

7067 github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect

7168 github.com/yuin/gopher-lua v1.1.2 // indirect

7269 go.opentelemetry.io/auto/sdk v1.2.1 // indirect

73− go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect

74− go.opentelemetry.io/otel v1.44.0 // indirect

75− go.opentelemetry.io/otel/metric v1.44.0 // indirect

76− go.opentelemetry.io/otel/trace v1.44.0 // indirect

70+ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect

71+ go.opentelemetry.io/otel v1.45.0 // indirect

72+ go.opentelemetry.io/otel/metric v1.45.0 // indirect

73+ go.opentelemetry.io/otel/trace v1.45.0 // indirect

7774 go.uber.org/atomic v1.11.0 // indirect

78− go.yaml.in/yaml/v2 v2.4.4 // indirect

79− golang.org/x/mod v0.36.0 // indirect

80− golang.org/x/sys v0.46.0 // indirect

81− golang.org/x/text v0.38.0 // indirect

82− golang.org/x/tools v0.45.0 // indirect

83− google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect

84− google.golang.org/grpc v1.81.1 // indirect

85− google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect

75+ golang.org/x/mod v0.40.0 // indirect

76+ golang.org/x/sys v0.47.0 // indirect

77+ golang.org/x/text v0.41.0 // indirect

78+ golang.org/x/tools v0.49.0 // indirect

79+ google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect

80+ google.golang.org/grpc v1.83.0 // indirect

81+ google.golang.org/protobuf v1.36.12 // indirect

8682 gopkg.in/yaml.v3 v3.0.1 // indirect

8783)

go.sum+79−211

@@ -1,7 +1,5 @@

1−cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=

2−cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=

3−cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=

4−cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=

1+cloud.google.com/go/auth v0.23.1 h1:1tPpBPG02lQHmoiAvs9egyCASqXP0xgobptjZzov/Jg=

2+cloud.google.com/go/auth v0.23.1/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0=

53cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=

64cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=

75cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=

@@ -10,16 +8,12 @@ github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb h1:ZVN4Iat3runWO

108github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb/go.mod h1:WsAABbY4HQBgd3mGuG4KMNTbHJCPvx9IVBHzysbknss=

119github.com/FZambia/sentinel v1.0.0 h1:KJ0ryjKTZk5WMp0dXvSdNqp3lFaW1fNFuEYfrkLOYIc=

1210github.com/FZambia/sentinel v1.0.0/go.mod h1:ytL1Am/RLlAoAXG6Kj5LNuw/TRRQrv2rt2FT26vP5gI=

13−github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=

14−github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

1511github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=

1612github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

1713github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY=

1814github.com/a8m/envsubst v1.4.3/go.mod h1:4jjHWQlZoaXPoLQUb7H2qT4iLkZDdmEQiOUogdUmqVU=

1915github.com/alicebob/gopher-json v0.0.0-20180125190556-5a6b3ba71ee6/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=

2016github.com/alicebob/miniredis/v2 v2.11.1/go.mod h1:UA48pmi7aSazcGAvcdKcBB49z521IC9VjTTRz2nIaJE=

21−github.com/alicebob/miniredis/v2 v2.37.0 h1:RheObYW32G1aiJIj81XVt78ZHJpHonHLHW7OLIshq68=

22−github.com/alicebob/miniredis/v2 v2.37.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

2317github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e2uP9jiw=

2418github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

2519github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

@@ -30,8 +24,6 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=

3024github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=

3125github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=

3226github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=

33−github.com/bsm/redislock v0.9.4 h1:X/Wse1DPpiQgHbVYRE9zv6m070UcKoOGekgvpNhiSvw=

34−github.com/bsm/redislock v0.9.4/go.mod h1:Epf7AJLiSFwLCiZcfi6pWFO/8eAYrYpQXFxEDPoDeAk=

3527github.com/bsm/redislock v0.10.0 h1:NAe1OHDnwPmWEzD+LpWBZXAdZrWld/xj/wmqEcQednQ=

3628github.com/bsm/redislock v0.10.0/go.mod h1:M05WZGjPbX/8ne7LmB7AbOsa2kv7Jzx4fqkLpDFZvJs=

3729github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

@@ -39,23 +31,15 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL

3931github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=

4032github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=

4133github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=

42−github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=

43−github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=

44−github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=

45−github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=

34+github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE=

35+github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=

4636github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=

4737github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=

4838github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

49−github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=

50−github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

51−github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=

52−github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=

53−github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=

54−github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=

39+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=

40+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=

5541github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=

5642github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=

57−github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=

58−github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=

5943github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=

6044github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=

6145github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=

@@ -64,21 +48,17 @@ github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZ

6448github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=

6549github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=

6650github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=

67−github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=

68−github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

6951github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=

7052github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

7153github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=

7254github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=

7355github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=

74−github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=

75−github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

56+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=

57+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

7658github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=

7759github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=

7860github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=

7961github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=

80−github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=

81−github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

8262github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=

8363github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

8464github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=

@@ -92,38 +72,27 @@ github.com/gomodule/redigo v1.7.1-0.20190322064113-39e2c31b7ca3/go.mod h1:B4C85q

9272github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=

9373github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=

9474github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=

95−github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=

96−github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

97−github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=

98−github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

99−github.com/google/pprof v0.0.0-20260604005048-7023385849c0 h1:h1QTMDl6q9wDvDCJVpKQSjgleGFYnd2fOxmg2K+6BGE=

100−github.com/google/pprof v0.0.0-20260604005048-7023385849c0/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

75+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=

76+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=

10177github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=

10278github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=

10379github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

10480github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=

10581github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

106−github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=

107−github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=

108−github.com/googleapis/enterprise-certificate-proxy v0.3.16 h1:F/VPrx0YPBdksZJQdCAp0WUsqnNmZpUZszzfYt0M5Dw=

109−github.com/googleapis/enterprise-certificate-proxy v0.3.16/go.mod h1:9Yb0eAkH/Xqhvv3zbeKf/+wMJqCeocWc6KIhDvEAuYE=

110−github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE=

111−github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA=

112−github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI=

113−github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=

114−github.com/googleapis/gax-go/v2 v2.22.0 h1:PjIWBpgGIVKGoCXuiCoP64altEJCj3/Ei+kSU5vlZD4=

115−github.com/googleapis/gax-go/v2 v2.22.0/go.mod h1:irWBbALSr0Sk3qlqb9SyJ1h68WjgeFuiOzI4Rqw5+aY=

82+github.com/googleapis/enterprise-certificate-proxy v0.3.21 h1:OFdQ3tnCX/zaQ0Cedur3D3z7kI6HiLX9g3TiAN4/DFU=

83+github.com/googleapis/enterprise-certificate-proxy v0.3.21/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=

84+github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=

85+github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=

11686github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=

11787github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=

11888github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE=

11989github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=

12090github.com/justinas/alice v1.2.0 h1:+MHSA/vccVCF4Uq37S42jwlkvI2Xzl7zTPCN5BnZNVo=

12191github.com/justinas/alice v1.2.0/go.mod h1:fN5HRH/reO/zrUflLfTN43t3vXvKzvZIENsNEe7i7qA=

122−github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=

123−github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=

124−github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=

125−github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

92+github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=

93+github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=

12694github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=

95+github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=

12796github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=

12897github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=

12998github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=

@@ -140,45 +109,25 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq

140109github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

141110github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25 h1:9bCMuD3TcnjeqjPT2gSlha4asp8NvgcFRYExCaikCxk=

142111github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25/go.mod h1:eDjgYHYDJbPLBLsyZ6qRaugP0mX8vePOhZ5id1fdzJw=

143−github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=

144−github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=

145−github.com/onsi/ginkgo/v2 v2.29.0 h1:rfh+ZFjgJhYWRoIqVf3Uwx/W20yLrcrE2h2GmYVRaag=

146−github.com/onsi/ginkgo/v2 v2.29.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

147−github.com/onsi/ginkgo/v2 v2.30.0 h1:zxM/9XneXFIy64j6/wAmBIX4zRC7Hu6U8XFNZvDnCQc=

148−github.com/onsi/ginkgo/v2 v2.30.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

149−github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=

150−github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=

151−github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=

152−github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=

153−github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=

154−github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

155−github.com/pelletier/go-toml/v2 v2.3.0 h1:k59bC/lIZREW0/iVaQR8nDHxVq8OVlIzYCOJf421CaM=

156−github.com/pelletier/go-toml/v2 v2.3.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

157−github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=

158−github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

159−github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=

160−github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

161−github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk=

162−github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

112+github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=

113+github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

114+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=

115+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=

116+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=

117+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

118+github.com/pierrec/lz4/v4 v4.1.28 h1:pPEPwRJ4kybBTfGt28q7lQsRJQHhC08axprdLD5Ppio=

119+github.com/pierrec/lz4/v4 v4.1.28/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

163120github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

164−github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=

165−github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

166−github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=

167−github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=

121+github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=

122+github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=

168123github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=

169124github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=

170−github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=

171−github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=

172−github.com/prometheus/common v0.68.1 h1:omjRRl4QP4komogpXuhfeOiisQg7xdy8VM1UY+pStaY=

173−github.com/prometheus/common v0.68.1/go.mod h1:ZzL3f6u94qUxh9p+tJTrF+FvBS1XXbbRAZCQkytAL0Y=

174−github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=

175−github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=

176−github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=

177−github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=

178−github.com/redis/go-redis/v9 v9.20.0 h1:WnQYxLkgO2xiXTCJY0ldIiI8dNqCDlQAG+AtaH7a2a0=

179−github.com/redis/go-redis/v9 v9.20.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=

180−github.com/redis/go-redis/v9 v9.20.1 h1:sfCU6A8P3dXbKyWes02uxA2baehGux9dZHfEKtsTB1w=

181−github.com/redis/go-redis/v9 v9.20.1/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=

125+github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=

126+github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=

127+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=

128+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=

129+github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=

130+github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=

182131github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=

183132github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=

184133github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=

@@ -193,8 +142,8 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=

193142github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=

194143github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

195144github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

196−github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=

197−github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=

145+github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=

146+github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=

198147github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=

199148github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=

200149github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=

@@ -212,99 +161,57 @@ github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV

212161github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=

213162github.com/yuin/gopher-lua v0.0.0-20190206043414-8bfc7677f583/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

214163github.com/yuin/gopher-lua v0.0.0-20191213034115-f46add6fdb5c/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

215−github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=

216−github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=

217164github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=

218165github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=

219−github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=

220−github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=

221166github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=

167+github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=

222168go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=

223169go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=

224−go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=

225−go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=

226170go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=

227−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=

228−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=

229−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=

230−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=

231−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=

232−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=

233−go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=

234−go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=

235−go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=

236−go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=

237−go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=

238−go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=

239−go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=

240−go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=

241−go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=

242−go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=

243−go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=

244−go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=

245−go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=

246−go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=

247−go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=

248−go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=

249−go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=

250−go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=

251−go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=

252−go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=

253−go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=

254−go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=

255−go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=

256−go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=

257−go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=

258−go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=

171+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=

172+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=

173+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=

174+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=

175+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=

176+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=

177+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=

178+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=

179+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=

180+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=

181+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=

182+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=

183+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=

259184go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=

260185go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=

261186go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

262187go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=

263188go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=

264189go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=

265−go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=

266−go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=

190+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=

191+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=

267192golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=

268193golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=

269194golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=

270−golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=

271−golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=

272−golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=

273−golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=

274−golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=

275−golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=

276−golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=

277−golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=

195+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=

196+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=

278197golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=

279198golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=

280−golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=

281−golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=

282−golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=

283−golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=

284−golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=

285−golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=

199+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=

200+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=

286201golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=

287202golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=

288203golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=

289204golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=

290205golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=

291−golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=

292−golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=

293−golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=

294−golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=

295−golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=

296−golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=

297−golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=

298−golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=

206+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=

207+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=

299208golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=

300209golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=

301210golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

302211golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

303212golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

304−golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=

305−golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

306−golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=

307−golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

213+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=

214+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

308215golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

309216golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

310217golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

@@ -314,14 +221,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc

314221golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

315222golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

316223golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

317−golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=

318−golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

319−golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=

320−golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

321−golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=

322−golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

323−golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=

324−golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

224+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=

225+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

325226golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

326227golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

327228golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=

@@ -333,60 +234,31 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=

333234golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=

334235golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=

335236golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=

336−golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=

337−golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=

338−golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=

339−golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=

340−golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=

341−golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=

342−golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=

343−golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=

237+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=

238+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=

344239golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=

345240golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=

346241golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

347242golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=

348243golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

349244golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=

350−golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=

351−golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=

352−golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=

353−golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=

354−golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=

355−golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=

245+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=

246+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=

356247golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

357−gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=

358−gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=

359248gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=

360−google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=

361−google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=

362−google.golang.org/api v0.275.0 h1:vfY5d9vFVJeWEZT65QDd9hbndr7FyZ2+6mIzGAh71NI=

363−google.golang.org/api v0.275.0/go.mod h1:Fnag/EWUPIcJXuIkP1pjoTgS5vdxlk3eeemL7Do6bvw=

364−google.golang.org/api v0.283.0 h1:0lkp8u0MPwJVHqRL+nJlMAoZVVzbmiXmFHXMOTmSPik=

365−google.golang.org/api v0.283.0/go.mod h1:6Wssta4c5n9qHq5CBhmlai5h/PUa1djdDAIhYEHyvcM=

366−google.golang.org/api v0.284.0 h1:i+cKTgeQRcRySkP7QTl5PDO7/pAm8EcMFIUMlNbk4Vc=

367−google.golang.org/api v0.284.0/go.mod h1:AU44fU+XVZOCcd8uLaBIa/ZgzgPf/0qqY3+m7lQaado=

368−google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 h1:JNfk58HZ8lfmXbYK2vx/UvsqIL59TzByCxPIX4TDmsE=

369−google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:x5julN69+ED4PcFk/XWayw35O0lf/nGa4aNgODCmNmw=

249+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=

250+google.golang.org/api v0.293.0 h1:p9XIWOf63U4OgYx120ZwVU8+vl4XTPmWfgVPnmOAS9w=

251+google.golang.org/api v0.293.0/go.mod h1:6n5tjEB1gzwniZTepZ0g5u+wM7Bof5GeULCx/zh8ZE0=

370252google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=

371−google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 h1:CogIeEXn4qWYzzQU0QqvYBM8yDF9cFYzDq9ojSpv0Js=

372−google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=

373−google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=

374−google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=

375−google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

376−google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=

377−google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

378−google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=

379−google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

380−google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=

381−google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=

382−google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=

383−google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=

384−google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=

385−google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=

386−google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=

387−google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

388−google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=

389−google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

253+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=

254+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU=

255+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA=

256+google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 h1:utmqiUzZAEINbLmRyAt1QjVkMyLQ+lvIwCpLaB1rZfw=

257+google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

258+google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=

259+google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=

260+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=

261+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

390262gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

391263gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=

392264gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

@@ -395,9 +267,5 @@ gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYs

395267gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

396268gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

397269gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

398−k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8=

399−k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=

400−k8s.io/apimachinery v0.36.1 h1:G63Gjx2W+q0YD+72Vo8oY0nDnePVwnuzTmmy5ENrVSA=

401−k8s.io/apimachinery v0.36.1/go.mod h1:ibYOR00vW/I1kzvi5SF0dRuJ52BvKtfvRdOn35GPQ+8=

402−k8s.io/apimachinery v0.36.2 h1:0PE/W/WNy1UX61NLbXY5TMbJ6UwLL6E6lAPkYrKFxbQ=

403−k8s.io/apimachinery v0.36.2/go.mod h1:fvf/HOLXq9RId0rnDIbN1OEBvHXdQbLMM8nu0LcBUf4=

270+k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=

271+k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=

pkg/apis/options/load_test.go+1−1

@@ -282,7 +282,7 @@ var _ = Describe("Load", func() {

282282 Entry("with an invalid config file", &testOptionsTableInput{

283283 configFile: []byte(`slice_option = foo`),

284284 flagSet: func() *pflag.FlagSet { return testOptionsFlagSet },

285− expectedErr: fmt.Errorf("unable to load config file: While parsing config: toml: expected 'false'"),

285+ expectedErr: fmt.Errorf("unable to load config file: While parsing config: toml: expected keyword \"false\""),

286286 expectedOutput: &TestOptions{},

287287 }),

288288 Entry("with an invalid flagset", &testOptionsTableInput{

pkg/apis/options/providers.go+6

@@ -151,6 +151,9 @@ const (

151151 // ADFSProvider is the provider type for ADFS

152152 ADFSProvider ProviderType = "adfs"

153153

154+ // AtlassianProvider is the provider type for Atlassian Cloud

155+ AtlassianProvider ProviderType = "atlassian"

156+

154157 // AzureProvider is the provider type for Azure

155158 AzureProvider ProviderType = "azure"

156159

@@ -166,6 +169,9 @@ const (

166169 // DigitalOceanProvider is the provider type for DigitalOcean

167170 DigitalOceanProvider ProviderType = "digitalocean"

168171

172+ // DTTSSOProvider is the provider type for the DTT SSO

173+ DTTSSOProvider ProviderType = "dtt-sso"

174+

169175 // FacebookProvider is the provider type for Facebook

170176 FacebookProvider ProviderType = "facebook"

171177

pkg/apis/options/upstreams.go+7−5

@@ -62,12 +62,14 @@ type Upstream struct {

6262

6363 // Path is used to map requests to the upstream server.

6464 // The closest match will take precedence and all Paths must be unique.

65− // Path can also take a pattern when used with RewriteTarget.

66− // Path segments can be captured and matched using regular experessions.

65+ // Without RewriteTarget, Path follows gorilla/mux route syntax.

6766 // Eg:

68− // - `^/foo$`: Match only the explicit path `/foo`

69− // - `^/bar/$`: Match any path prefixed with `/bar/`

70− // - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget

67+ // - `/foo`: Match only the explicit path `/foo`

68+ // - `/bar/`: Match any path prefixed with `/bar/`

69+ // - `/baz/{path:.*}`: Match any path prefixed with `/baz/`

70+ // When RewriteTarget is set, Path is treated as a regular expression.

71+ // Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the

72+ // remaining path for use with RewriteTarget.

7173 Path string `yaml:"path,omitempty"`

7274

7375 // RewriteTarget allows users to rewrite the request path before it is sent to

providers/atlassian-cloud.gonew file+99

@@ -0,0 +1,99 @@

1+package providers

3+import (

4+ "context"

5+ "errors"

6+ "net/url"

8+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

10+)

11+

12+// AtlassianProvider represents an Atlassian Cloud based Identity Provider

13+type AtlassianProvider struct {

14+ *ProviderData

15+}

16+

17+var _ Provider = (*AtlassianProvider)(nil)

18+

19+const (

20+ atlassianProviderName = "Atlassian"

21+ atlassianDefaultScope = "read:me"

22+ atlassianPrompt = "consent"

23+ atlassianAudience = "api.atlassian.com"

24+)

25+

26+var (

27+ atlassianDefaultLoginURL = &url.URL{

28+ Scheme: "https",

29+ Host: "auth.atlassian.com",

30+ Path: "/authorize",

31+ }

32+

33+ atlassianDefaultRedeemURL = &url.URL{

34+ Scheme: "https",

35+ Host: "auth.atlassian.com",

36+ Path: "/oauth/token",

37+ }

38+

39+ // atlassianDefaultProfileURL returns the signed-in user's profile.

40+ atlassianDefaultProfileURL = &url.URL{

41+ Scheme: "https",

42+ Host: "api.atlassian.com",

43+ Path: "/me",

44+ }

45+)

46+

47+// NewAtlassianProvider initiates a new AtlassianProvider

48+func NewAtlassianProvider(p *ProviderData) *AtlassianProvider {

49+ p.setProviderDefaults(providerDefaults{

50+ name: atlassianProviderName,

51+ loginURL: atlassianDefaultLoginURL,

52+ redeemURL: atlassianDefaultRedeemURL,

53+ profileURL: atlassianDefaultProfileURL,

54+ validateURL: atlassianDefaultProfileURL,

55+ scope: atlassianDefaultScope,

56+ })

57+ return &AtlassianProvider{ProviderData: p}

58+}

59+

60+// GetLoginURL adds the audience and prompt parameters Atlassian requires.

61+func (p *AtlassianProvider) GetLoginURL(redirectURI, state, _ string, extraParams url.Values) string {

62+ params := url.Values{}

63+ for k, v := range extraParams {

64+ params[k] = v

65+ }

66+ params.Del("approval_prompt")

67+ if params.Get("prompt") == "" {

68+ params.Set("prompt", atlassianPrompt)

69+ }

70+ params.Set("audience", atlassianAudience)

71+

72+ loginURL := makeLoginURL(p.ProviderData, redirectURI, state, params)

73+ return loginURL.String()

74+}

75+

76+// EnrichSession sets the session's email from the Atlassian profile.

77+func (p *AtlassianProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {

78+ var profile struct {

79+ Email string `json:"email"`

80+ }

81+ err := requests.New(p.ProfileURL.String()).

82+ WithContext(ctx).

83+ WithHeaders(makeOIDCHeader(s.AccessToken)).

84+ Do().

85+ UnmarshalInto(&profile)

86+ if err != nil {

87+ return err

88+ }

89+ if profile.Email == "" {

90+ return errors.New("no email in Atlassian profile")

91+ }

92+ s.Email = profile.Email

93+ return nil

94+}

95+

96+// ValidateSession validates the AccessToken

97+func (p *AtlassianProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

98+ return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))

99+}

providers/atlassian-cloud_test.gonew file+93

@@ -0,0 +1,93 @@

1+package providers

3+import (

4+ "context"

5+ "net/http"

6+ "net/http/httptest"

7+ "net/url"

8+ "testing"

10+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

11+ . "github.com/onsi/gomega"

12+)

13+

14+func testAtlassianBackend(status int, body string) *httptest.Server {

15+ return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

16+ if r.URL.Path != "/me" || r.Header.Get("Authorization") != "Bearer imaginary_access_token" {

17+ w.WriteHeader(http.StatusUnauthorized)

18+ return

19+ }

20+ w.WriteHeader(status)

21+ _, _ = w.Write([]byte(body))

22+ }))

23+}

24+

25+func testAtlassianProvider(backend *httptest.Server) *AtlassianProvider {

26+ p := NewAtlassianProvider(&ProviderData{})

27+ u, _ := url.Parse(backend.URL)

28+ updateURL(p.ProfileURL, u.Host)

29+ updateURL(p.ValidateURL, u.Host)

30+ return p

31+}

32+

33+func TestNewAtlassianProvider(t *testing.T) {

34+ g := NewWithT(t)

35+

36+ providerData := NewAtlassianProvider(&ProviderData{}).Data()

37+ g.Expect(providerData.ProviderName).To(Equal("Atlassian"))

38+ g.Expect(providerData.LoginURL.String()).To(Equal("https://auth.atlassian.com/authorize"))

39+ g.Expect(providerData.RedeemURL.String()).To(Equal("https://auth.atlassian.com/oauth/token"))

40+ g.Expect(providerData.ProfileURL.String()).To(Equal("https://api.atlassian.com/me"))

41+ g.Expect(providerData.ValidateURL.String()).To(Equal("https://api.atlassian.com/me"))

42+ g.Expect(providerData.Scope).To(Equal("read:me"))

43+}

44+

45+func TestAtlassianProviderGetLoginURL(t *testing.T) {

46+ g := NewWithT(t)

47+ p := NewAtlassianProvider(&ProviderData{ClientID: "client"})

48+

49+ loginURL, err := url.Parse(p.GetLoginURL("https://proxy/oauth2/callback", "state", "",

50+ url.Values{"approval_prompt": {"force"}}))

51+ g.Expect(err).ToNot(HaveOccurred())

52+

53+ q := loginURL.Query()

54+ g.Expect(q.Get("audience")).To(Equal("api.atlassian.com"))

55+ g.Expect(q.Get("prompt")).To(Equal("consent"))

56+ g.Expect(q.Has("approval_prompt")).To(BeFalse())

57+ g.Expect(q.Get("scope")).To(Equal("read:me"))

58+

59+ loginURL, err = url.Parse(p.GetLoginURL("https://proxy/oauth2/callback", "state", "",

60+ url.Values{"prompt": {"login"}}))

61+ g.Expect(err).ToNot(HaveOccurred())

62+ g.Expect(loginURL.Query().Get("prompt")).To(Equal("login"))

63+}

64+

65+func TestAtlassianProviderEnrichSession(t *testing.T) {

66+ g := NewWithT(t)

67+ b := testAtlassianBackend(http.StatusOK, `{"account_id":"abc","email":"user@example.com"}`)

68+ defer b.Close()

69+ p := testAtlassianProvider(b)

70+

71+ session := CreateAuthorizedSession()

72+ g.Expect(p.EnrichSession(context.Background(), session)).To(Succeed())

73+ g.Expect(session.Email).To(Equal("user@example.com"))

74+}

75+

76+func TestAtlassianProviderEnrichSessionWithoutEmail(t *testing.T) {

77+ g := NewWithT(t)

78+ b := testAtlassianBackend(http.StatusOK, `{"account_id":"abc"}`)

79+ defer b.Close()

80+ p := testAtlassianProvider(b)

81+

82+ g.Expect(p.EnrichSession(context.Background(), CreateAuthorizedSession())).ToNot(Succeed())

83+}

84+

85+func TestAtlassianProviderValidateSession(t *testing.T) {

86+ g := NewWithT(t)

87+ b := testAtlassianBackend(http.StatusOK, `{"email":"user@example.com"}`)

88+ defer b.Close()

89+ p := testAtlassianProvider(b)

90+

91+ g.Expect(p.ValidateSession(context.Background(), CreateAuthorizedSession())).To(BeTrue())

92+ g.Expect(p.ValidateSession(context.Background(), &sessions.SessionState{AccessToken: "wrong"})).To(BeFalse())

93+}

providers/dtt_sso.gonew file+202

@@ -0,0 +1,202 @@

1+package providers

3+import (

4+ "bytes"

5+ "context"

6+ "encoding/base64"

7+ "errors"

8+ "fmt"

9+ "net/http"

10+ "net/url"

11+ "time"

12+

13+ "github.com/golang-jwt/jwt/v5"

14+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

15+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

16+)

17+

18+// DTTSSOProvider signs users in with the DTT SSO (auth-server).

19+type DTTSSOProvider struct {

20+ *ProviderData

21+}

22+

23+var _ Provider = (*DTTSSOProvider)(nil)

24+

25+const (

26+ dttSSOProviderName = "DTT SSO"

27+ dttSSODefaultScope = "openid"

28+)

29+

30+var (

31+ dttSSODefaultLoginURL = &url.URL{

32+ Scheme: "https",

33+ Host: "auth.thebestagent.pro",

34+ Path: "/oauth/authorize",

35+ }

36+

37+ dttSSODefaultRedeemURL = &url.URL{

38+ Scheme: "https",

39+ Host: "auth.thebestagent.pro",

40+ Path: "/oauth/token",

41+ }

42+

43+ dttSSODefaultValidateURL = &url.URL{

44+ Scheme: "https",

45+ Host: "auth.thebestagent.pro",

46+ Path: "/oauth/check_token",

47+ }

48+)

49+

50+// NewDTTSSOProvider initiates a new DTTSSOProvider

51+func NewDTTSSOProvider(p *ProviderData) *DTTSSOProvider {

52+ p.setProviderDefaults(providerDefaults{

53+ name: dttSSOProviderName,

54+ loginURL: dttSSODefaultLoginURL,

55+ redeemURL: dttSSODefaultRedeemURL,

56+ profileURL: nil,

57+ validateURL: dttSSODefaultValidateURL,

58+ scope: dttSSODefaultScope,

59+ })

60+ return &DTTSSOProvider{ProviderData: p}

61+}

62+

63+// dttSSOTokenResponse is the SSO's /oauth/token response.

64+type dttSSOTokenResponse struct {

65+ AccessToken string `json:"access_token"`

66+ RefreshToken string `json:"refresh_token"`

67+ ExpiresIn int64 `json:"expires_in"`

68+ IDToken string `json:"id_token"`

69+}

70+

71+// dttSSOClaims holds the id_token claims the provider uses.

72+type dttSSOClaims struct {

73+ jwt.RegisteredClaims

74+ Email string `json:"email"`

75+ Role string `json:"role"`

76+ UserID string `json:"user_id"`

77+}

78+

79+// Redeem exchanges the authorization code for a session.

80+func (p *DTTSSOProvider) Redeem(ctx context.Context, redirectURL, code, _ string) (*sessions.SessionState, error) {

81+ if code == "" {

82+ return nil, ErrMissingCode

83+ }

84+ return p.requestTokens(ctx, url.Values{

85+ "grant_type": {"authorization_code"},

86+ "code": {code},

87+ "redirect_uri": {redirectURL},

88+ })

89+}

90+

91+// RefreshSession renews the tokens and re-reads the email and role.

92+func (p *DTTSSOProvider) RefreshSession(ctx context.Context, s *sessions.SessionState) (bool, error) {

93+ if s == nil || s.RefreshToken == "" {

94+ return false, nil

95+ }

96+ refreshed, err := p.requestTokens(ctx, url.Values{

97+ "grant_type": {"refresh_token"},

98+ "refresh_token": {s.RefreshToken},

99+ })

100+ if err != nil {

101+ return false, fmt.Errorf("unable to redeem refresh token: %v", err)

102+ }

103+ s.AccessToken = refreshed.AccessToken

104+ s.RefreshToken = refreshed.RefreshToken

105+ s.IDToken = refreshed.IDToken

106+ s.Email = refreshed.Email

107+ s.User = refreshed.User

108+ s.Groups = refreshed.Groups

109+ s.CreatedAt = refreshed.CreatedAt

110+ s.ExpiresOn = refreshed.ExpiresOn

111+ return true, nil

112+}

113+

114+// ValidateSession checks the access token with the SSO's check_token endpoint.

115+func (p *DTTSSOProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

116+ return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))

117+}

118+

119+// requestTokens calls the token endpoint and builds a session from the verified id_token.

120+//

121+// The SSO compares the Basic credentials byte for byte, so they are sent unescaped

122+// rather than through golang.org/x/oauth2, which URL-escapes them.

123+func (p *DTTSSOProvider) requestTokens(ctx context.Context, params url.Values) (*sessions.SessionState, error) {

124+ clientSecret, err := p.GetClientSecret()

125+ if err != nil {

126+ return nil, err

127+ }

128+ credentials := base64.StdEncoding.EncodeToString([]byte(p.ClientID + ":" + clientSecret))

129+

130+ result := requests.New(p.RedeemURL.String()).

131+ WithContext(ctx).

132+ WithMethod(http.MethodPost).

133+ WithBody(bytes.NewBufferString(params.Encode())).

134+ SetHeader("Content-Type", "application/x-www-form-urlencoded").

135+ SetHeader("Authorization", "Basic "+credentials).

136+ Do()

137+ if result.Error() != nil {

138+ return nil, result.Error()

139+ }

140+ if result.StatusCode() != http.StatusOK {

141+ return nil, fmt.Errorf("token request failed: status %d - %s", result.StatusCode(), result.Body())

142+ }

143+

144+ var token dttSSOTokenResponse

145+ if err := result.UnmarshalInto(&token); err != nil {

146+ return nil, err

147+ }

148+ if token.AccessToken == "" {

149+ return nil, errors.New("token response carried no access_token")

150+ }

151+ claims, err := p.verifyIDToken(token.IDToken, clientSecret)

152+ if err != nil {

153+ return nil, err

154+ }

155+

156+ s := &sessions.SessionState{

157+ AccessToken: token.AccessToken,

158+ RefreshToken: token.RefreshToken,

159+ IDToken: token.IDToken,

160+ Email: claims.Email,

161+ User: claims.UserID,

162+ }

163+ if claims.Role != "" {

164+ s.Groups = []string{claims.Role}

165+ }

166+ s.CreatedAtNow()

167+ if token.ExpiresIn > 0 {

168+ s.ExpiresIn(time.Duration(token.ExpiresIn) * time.Second)

169+ }

170+ return s, nil

171+}

172+

173+// verifyIDToken checks the id_token's HS256 signature (keyed on the client secret),

174+// issuer, audience and expiry.

175+//

176+// go-jose is not used: it rejects HMAC keys under 32 bytes, and SSO client secrets

177+// can be shorter.

178+func (p *DTTSSOProvider) verifyIDToken(raw, clientSecret string) (*dttSSOClaims, error) {

179+ if raw == "" {

180+ return nil, errors.New("token response carried no id_token; the scope must be exactly \"openid\"")

181+ }

182+ var claims dttSSOClaims

183+ _, err := jwt.ParseWithClaims(raw, &claims,

184+ func(*jwt.Token) (any, error) { return []byte(clientSecret), nil },

185+ jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),

186+ jwt.WithIssuer(p.issuer()),

187+ jwt.WithAudience(p.ClientID),

188+ jwt.WithExpirationRequired(),

189+ )

190+ if err != nil {

191+ return nil, fmt.Errorf("verifying id_token: %v", err)

192+ }

193+ if claims.Email == "" {

194+ return nil, errors.New("id_token carries no email")

195+ }

196+ return &claims, nil

197+}

198+

199+// issuer is the SSO's site host, the origin of the login URL.

200+func (p *DTTSSOProvider) issuer() string {

201+ return p.LoginURL.Scheme + "://" + p.LoginURL.Host

202+}

providers/dtt_sso_test.gonew file+237

@@ -0,0 +1,237 @@

1+package providers

3+import (

4+ "context"

5+ "encoding/base64"

6+ "encoding/json"

7+ "net/http"

8+ "net/http/httptest"

9+ "net/url"

10+ "testing"

11+ "time"

12+

13+ "github.com/golang-jwt/jwt/v5"

14+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

15+ . "github.com/onsi/gomega"

16+)

17+

18+const (

19+ dttSSOTestClientID = "redash-gate"

20+ // Shorter than 32 bytes, and contains characters golang.org/x/oauth2 would

21+ // URL-escape in Basic auth.

22+ dttSSOTestSecret = "s3cr+t/abc=="

23+)

24+

25+// dttSSOTestServer mimics the SSO's token and check_token endpoints.

26+type dttSSOTestServer struct {

27+ *httptest.Server

28+ claims map[string]interface{}

29+ signingKey []byte

30+ lastForm url.Values

31+ validTokens map[string]bool

32+ tokenCounter int

33+}

34+

35+func newDTTSSOTestServer() *dttSSOTestServer {

36+ s := &dttSSOTestServer{

37+ signingKey: []byte(dttSSOTestSecret),

38+ validTokens: map[string]bool{},

39+ }

40+ s.Server = httptest.NewServer(http.HandlerFunc(s.handle))

41+ u, _ := url.Parse(s.URL)

42+ s.claims = map[string]interface{}{

43+ "iss": "http://" + u.Host,

44+ "aud": dttSSOTestClientID,

45+ "sub": "0b5c1e1a-1111-2222-3333-444455556666",

46+ "user_id": "0b5c1e1a-1111-2222-3333-444455556666",

47+ "email": "admin@example.com",

48+ "role": "dtt_admin",

49+ "exp": time.Now().Add(time.Hour).Unix(),

50+ }

51+ return s

52+}

53+

54+func (s *dttSSOTestServer) handle(w http.ResponseWriter, r *http.Request) {

55+ switch r.URL.Path {

56+ case "/oauth/token":

57+ want := "Basic " + base64.StdEncoding.EncodeToString([]byte(dttSSOTestClientID+":"+dttSSOTestSecret))

58+ if r.Header.Get("Authorization") != want {

59+ w.WriteHeader(http.StatusUnauthorized)

60+ return

61+ }

62+ _ = r.ParseForm()

63+ s.lastForm = r.PostForm

64+ if r.PostForm.Get("grant_type") == "refresh_token" && !s.validTokens["refresh-"+r.PostForm.Get("refresh_token")] {

65+ w.WriteHeader(http.StatusBadRequest)

66+ _, _ = w.Write([]byte(`{"error":"invalid_grant","error_description":"Invalid refresh token"}`))

67+ return

68+ }

69+ s.tokenCounter++

70+ access := "access-" + string(rune('0'+s.tokenCounter))

71+ refresh := "refresh-" + string(rune('0'+s.tokenCounter))

72+ s.validTokens[access] = true

73+ s.validTokens["refresh-"+refresh] = true

74+ w.Header().Set("Content-Type", "application/json")

75+ _ = json.NewEncoder(w).Encode(map[string]interface{}{

76+ "access_token": access,

77+ "token_type": "bearer",

78+ "expires_in": 3600,

79+ "refresh_token": refresh,

80+ "id_token": s.idToken(),

81+ "scope": "openid",

82+ })

83+ case "/oauth/check_token":

84+ token := r.Header.Get("Authorization")

85+ if len(token) > len("Bearer ") && s.validTokens[token[len("Bearer "):]] {

86+ _, _ = w.Write([]byte(`{"user_id":"0b5c1e1a-1111-2222-3333-444455556666","real_user_id":null,"issued_by":"redash-gate"}`))

87+ return

88+ }

89+ w.WriteHeader(http.StatusUnauthorized)

90+ _, _ = w.Write([]byte("Invalid access token"))

91+ default:

92+ w.WriteHeader(http.StatusNotFound)

93+ }

94+}

95+

96+func (s *dttSSOTestServer) idToken() string {

97+ if s.claims == nil {

98+ return ""

99+ }

100+ raw, err := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims(s.claims)).SignedString(s.signingKey)

101+ if err != nil {

102+ panic(err)

103+ }

104+ return raw

105+}

106+

107+func testDTTSSOProvider(server *dttSSOTestServer) *DTTSSOProvider {

108+ p := NewDTTSSOProvider(&ProviderData{ClientID: dttSSOTestClientID, ClientSecret: dttSSOTestSecret})

109+ u, _ := url.Parse(server.URL)

110+ updateURL(p.LoginURL, u.Host)

111+ updateURL(p.RedeemURL, u.Host)

112+ updateURL(p.ValidateURL, u.Host)

113+ return p

114+}

115+

116+func TestNewDTTSSOProvider(t *testing.T) {

117+ g := NewWithT(t)

118+

119+ providerData := NewDTTSSOProvider(&ProviderData{}).Data()

120+ g.Expect(providerData.ProviderName).To(Equal("DTT SSO"))

121+ g.Expect(providerData.LoginURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/authorize"))

122+ g.Expect(providerData.RedeemURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/token"))

123+ g.Expect(providerData.ValidateURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/check_token"))

124+ g.Expect(providerData.Scope).To(Equal("openid"))

125+}

126+

127+func TestDTTSSOProviderRedeem(t *testing.T) {

128+ g := NewWithT(t)

129+ server := newDTTSSOTestServer()

130+ defer server.Close()

131+ p := testDTTSSOProvider(server)

132+

133+ s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

134+ g.Expect(err).ToNot(HaveOccurred())

135+ g.Expect(s.Email).To(Equal("admin@example.com"))

136+ g.Expect(s.User).To(Equal("0b5c1e1a-1111-2222-3333-444455556666"))

137+ g.Expect(s.Groups).To(Equal([]string{"dtt_admin"}))

138+ g.Expect(s.AccessToken).To(Equal("access-1"))

139+ g.Expect(s.RefreshToken).To(Equal("refresh-1"))

140+ g.Expect(s.IDToken).ToNot(BeEmpty())

141+ g.Expect(s.ExpiresOn).ToNot(BeNil())

142+ g.Expect(*s.ExpiresOn).To(BeTemporally("~", time.Now().Add(time.Hour), time.Minute))

143+

144+ g.Expect(server.lastForm.Get("grant_type")).To(Equal("authorization_code"))

145+ g.Expect(server.lastForm.Get("code")).To(Equal("the-code"))

146+ g.Expect(server.lastForm.Get("redirect_uri")).To(Equal("https://redash.example.com/oauth2/callback"))

147+}

148+

149+func TestDTTSSOProviderRedeemRejectsBadIDTokens(t *testing.T) {

150+ testCases := map[string]func(s *dttSSOTestServer){

151+ "signed with another secret": func(s *dttSSOTestServer) { s.signingKey = []byte("some-other-client-secret") },

152+ "other audience": func(s *dttSSOTestServer) { s.claims["aud"] = "frappe-gate" },

153+ "other issuer": func(s *dttSSOTestServer) { s.claims["iss"] = "https://evil.example.com" },

154+ "expired": func(s *dttSSOTestServer) { s.claims["exp"] = time.Now().Add(-time.Minute).Unix() },

155+ "no email": func(s *dttSSOTestServer) { delete(s.claims, "email") },

156+ "no id_token": func(s *dttSSOTestServer) { s.claims = nil },

157+ }

158+ for name, tamper := range testCases {

159+ t.Run(name, func(t *testing.T) {

160+ g := NewWithT(t)

161+ server := newDTTSSOTestServer()

162+ defer server.Close()

163+ tamper(server)

164+

165+ _, err := testDTTSSOProvider(server).Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

166+ g.Expect(err).To(HaveOccurred())

167+ })

168+ }

169+}

170+

171+func TestDTTSSOProviderRedeemRejectsUnsignedIDToken(t *testing.T) {

172+ g := NewWithT(t)

173+ server := newDTTSSOTestServer()

174+ defer server.Close()

175+ p := testDTTSSOProvider(server)

176+

177+ header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none"}`))

178+ payload, _ := json.Marshal(server.claims)

179+ unsigned := header + "." + base64.RawURLEncoding.EncodeToString(payload) + "."

180+

181+ _, err := p.verifyIDToken(unsigned, dttSSOTestSecret)

182+ g.Expect(err).To(HaveOccurred())

183+}

184+

185+func TestDTTSSOProviderRefreshSession(t *testing.T) {

186+ g := NewWithT(t)

187+ server := newDTTSSOTestServer()

188+ defer server.Close()

189+ p := testDTTSSOProvider(server)

190+

191+ s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

192+ g.Expect(err).ToNot(HaveOccurred())

193+ nonce := []byte("keep-me")

194+ s.Nonce = nonce

195+

196+ server.claims["role"] = "agent"

197+ server.claims["email"] = "renamed@example.com"

198+ refreshed, err := p.RefreshSession(context.Background(), s)

199+ g.Expect(err).ToNot(HaveOccurred())

200+ g.Expect(refreshed).To(BeTrue())

201+ g.Expect(s.AccessToken).To(Equal("access-2"))

202+ g.Expect(s.RefreshToken).To(Equal("refresh-2"))

203+ g.Expect(s.Groups).To(Equal([]string{"agent"}))

204+ g.Expect(s.Email).To(Equal("renamed@example.com"))

205+ g.Expect(s.Nonce).To(Equal(nonce))

206+ g.Expect(server.lastForm.Get("grant_type")).To(Equal("refresh_token"))

207+ g.Expect(server.lastForm.Get("refresh_token")).To(Equal("refresh-1"))

208+}

209+

210+func TestDTTSSOProviderRefreshSessionFailures(t *testing.T) {

211+ g := NewWithT(t)

212+ server := newDTTSSOTestServer()

213+ defer server.Close()

214+ p := testDTTSSOProvider(server)

215+

216+ refreshed, err := p.RefreshSession(context.Background(), &sessions.SessionState{})

217+ g.Expect(err).ToNot(HaveOccurred())

218+ g.Expect(refreshed).To(BeFalse())

219+

220+ refreshed, err = p.RefreshSession(context.Background(), &sessions.SessionState{RefreshToken: "revoked"})

221+ g.Expect(err).To(HaveOccurred())

222+ g.Expect(refreshed).To(BeFalse())

223+}

224+

225+func TestDTTSSOProviderValidateSession(t *testing.T) {

226+ g := NewWithT(t)

227+ server := newDTTSSOTestServer()

228+ defer server.Close()

229+ p := testDTTSSOProvider(server)

230+

231+ s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

232+ g.Expect(err).ToNot(HaveOccurred())

233+ g.Expect(p.ValidateSession(context.Background(), s)).To(BeTrue())

234+

235+ delete(server.validTokens, s.AccessToken)

236+ g.Expect(p.ValidateSession(context.Background(), s)).To(BeFalse())

237+}

providers/providers.go+7−3

@@ -40,6 +40,8 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

4040 switch providerConfig.Type {

4141 case options.ADFSProvider:

4242 return NewADFSProvider(providerData, providerConfig), nil

43+ case options.AtlassianProvider:

44+ return NewAtlassianProvider(providerData), nil

4345 case options.AzureProvider:

4446 return NewAzureProvider(providerData, providerConfig.AzureConfig), nil

4547 case options.MicrosoftEntraIDProvider:

@@ -50,6 +52,8 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

5052 return NewCIDAASProvider(providerData, providerConfig), nil

5153 case options.DigitalOceanProvider:

5254 return NewDigitalOceanProvider(providerData), nil

55+ case options.DTTSSOProvider:

56+ return NewDTTSSOProvider(providerData), nil

5357 case options.FacebookProvider:

5458 return NewFacebookProvider(providerData), nil

5559 case options.GitHubProvider:

@@ -189,9 +193,9 @@ func parseCodeChallengeMethod(providerConfig options.Provider) string {

189193

190194func providerRequiresOIDCProviderVerifier(providerType options.ProviderType) (bool, error) {

191195 switch providerType {

192− case options.BitbucketProvider, options.DigitalOceanProvider, options.FacebookProvider, options.GitHubProvider,

193− options.GoogleProvider, options.KeycloakProvider, options.LinkedInProvider, options.LoginGovProvider,

194− options.NextCloudProvider, options.SourceHutProvider:

196+ case options.AtlassianProvider, options.BitbucketProvider, options.DigitalOceanProvider, options.DTTSSOProvider,

197+ options.FacebookProvider, options.GitHubProvider, options.GoogleProvider, options.KeycloakProvider,

198+ options.LinkedInProvider, options.LoginGovProvider, options.NextCloudProvider, options.SourceHutProvider:

195199 return false, nil

196200 case options.OIDCProvider, options.ADFSProvider, options.AzureProvider, options.CidaasProvider,

197201 options.GitLabProvider, options.KeycloakOIDCProvider, options.MicrosoftEntraIDProvider: