66b3a17...master · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

on master help sign in

.github/ISSUE_TEMPLATE/config.yml+2−2

since splitsnapshots

unifiedsplit

@@ -1,6 +1,6 @@

1blank_issues_enabled: false

2contact_links:

3− - name: OAuth2-Proxy Slack

3+ - name: OAuth2 Proxy Slack

4− url: https://gophers.slack.com/messages/CM2RSS25N

4+ url: https://cloud-native.slack.com/archives/C098Y5URZ2N

5 about: Feel free to ask any questions here.

.github/renovate.json5+9

@@ -46,6 +46,15 @@

46 depNameTemplate: "alpine",

47 datasourceTemplate: "docker",

48 },

49+ {

50+ customType: "regex",

51+ fileMatch: [

52+ "^Makefile",

53+ ],

54+ matchStrings: [

55+ "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+?GOLANGCILINT_VERSION \\?= (?<currentValue>.*)\\s",

56+ ],

57+ },

49 {

58 {

50 customType: "regex",

59 customType: "regex",

51 fileMatch: ["(^|/)\\.github/workflows/[^/]+\\.ya?ml$"],

60 fileMatch: ["(^|/)\\.github/workflows/[^/]+\\.ya?ml$"],

.github/workflows/ci.yml+8−14

@@ -19,7 +19,7 @@ jobs:

19 runs-on: ubuntu-latest

20 steps:

21 - name: Check out code

22− uses: actions/checkout@v6

22+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

23 with:

24 fetch-depth: 0

@@ -30,17 +30,11 @@ jobs:

30 id: go-version

32 - name: Set up Go

33− uses: actions/setup-go@v6

33+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

34 with:

35 go-version: ${{ steps.go-version.outputs.version }}

36 check-latest: true

38− - name: Install golangci-lint

39− uses: golangci/golangci-lint-action@v9

40− with:

41− install-only: true

42− version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint

43−

44 - name: Verify Code Generation

38 - name: Verify Code Generation

45 run: |

39 run: |

46 make verify-generate

40 make verify-generate

@@ -74,14 +68,14 @@ jobs:

75 - name: Upload Coverage Report

69 - name: Upload Coverage Report

76 if: github.event_name == 'push'

70 if: github.event_name == 'push'

77− uses: qltysh/qlty-action/coverage@v2

71+ uses: qltysh/qlty-action/coverage@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0

78 with:

72 with:

79 oidc: true

73 oidc: true

80 files: lcov.info

74 files: lcov.info

82 - name: Run Trivy vulnerability scanner

76 - name: Run Trivy vulnerability scanner

83 if: (!startsWith(github.head_ref, 'release'))

77 if: (!startsWith(github.head_ref, 'release'))

84− uses: aquasecurity/trivy-action@0.35.0

78+ uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0

85 with:

79 with:

86 scan-type: 'rootfs'

80 scan-type: 'rootfs'

87 scan-ref: './oauth2-proxy'

81 scan-ref: './oauth2-proxy'

@@ -93,7 +87,7 @@ jobs:

94 - name: Upload Trivy scan results

88 - name: Upload Trivy scan results

95 if: (!startsWith(github.head_ref, 'release'))

89 if: (!startsWith(github.head_ref, 'release'))

96− uses: github/codeql-action/upload-sarif@v4

90+ uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

97 with:

91 with:

98 sarif_file: 'trivy-results.sarif'

92 sarif_file: 'trivy-results.sarif'

@@ -101,16 +95,16 @@ jobs:

101 runs-on: ubuntu-latest

95 runs-on: ubuntu-latest

102 steps:

96 steps:

103 - name: Check out code

97 - name: Check out code

104− uses: actions/checkout@v6

98+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

105 with:

99 with:

106 fetch-depth: 0

100 fetch-depth: 0

107

101

108 - name: Set up QEMU

102 - name: Set up QEMU

109− uses: docker/setup-qemu-action@v3

103+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

110

104

111 - name: Set up Docker Buildx

105 - name: Set up Docker Buildx

112 id: buildx

106 id: buildx

113− uses: docker/setup-buildx-action@v3

107+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

114

108

115 - name: Docker Build

109 - name: Docker Build

116 if: (!startsWith(github.head_ref, 'release'))

110 if: (!startsWith(github.head_ref, 'release'))

.github/workflows/codeql.yml+4−4

@@ -32,18 +32,18 @@ jobs:

33 steps:

34 - name: Checkout repository

35− uses: actions/checkout@v6

35+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

37 # Initializes the CodeQL tools for scanning.

38 - name: Initialize CodeQL

39− uses: github/codeql-action/init@v3

39+ uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

40 with:

41 languages: go

43 # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).

44 # If this step fails, then you should remove it and run the build manually (see below)

45 - name: Autobuild

46− uses: github/codeql-action/autobuild@v3

46+ uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

48 # ℹ️ Command-line programs to run using the OS shell.

49 # 📚 https://git.io/JvXDl

@@ -57,4 +57,4 @@ jobs:

57 # make release

59 - name: Perform CodeQL Analysis

60− uses: github/codeql-action/analyze@v3

60+ uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

.github/workflows/create-release.yml+2−2

@@ -17,7 +17,7 @@ jobs:

17 runs-on: ubuntu-latest

18 steps:

19 - name: Check out code

20− uses: actions/checkout@v6

20+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

21 with:

22 ref: master

23 fetch-depth: 0

@@ -54,7 +54,7 @@ jobs:

54 git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"

56 - name: Setup node

57− uses: actions/setup-node@v6

57+ uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

58 with:

59 node-version-file: docs/package.json

.github/workflows/docs.yml+7−7

@@ -14,13 +14,13 @@ jobs:

14 if: github.event_name == 'pull_request'

15 runs-on: ubuntu-latest

16 steps:

17− - uses: actions/checkout@v6

17+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

19 - name: Setup Pages

20 id: pages

21− uses: actions/configure-pages@v5

21+ uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

23− - uses: actions/setup-node@v6

23+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

24 with:

25 # renovate: datasource=node-version depName=node

26 node-version: 24

@@ -35,9 +35,9 @@ jobs:

35 if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'

36 runs-on: ubuntu-latest

37 steps:

38− - uses: actions/checkout@v6

38+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

40− - uses: actions/setup-node@v6

40+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

41 with:

42 # renovate: datasource=node-version depName=node

43 node-version: 24

@@ -49,7 +49,7 @@ jobs:

49 npm run build

51 - name: Upload artifact

52− uses: actions/upload-pages-artifact@v3

52+ uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0

53 with:

54 path: ./docs/build

@@ -65,4 +65,4 @@ jobs:

65 steps:

66 - name: Deploy to GitHub Pages

67 id: deployment

68− uses: actions/deploy-pages@v4

68+ uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/labeler.yml+1−1

@@ -9,7 +9,7 @@ jobs:

9 pull-requests: write

10 runs-on: ubuntu-latest

11 steps:

12− - uses: actions/labeler@v6

12+ - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0

13 with:

14 sync-labels: true

15 dot: true

.github/workflows/nightly.yml+4−4

@@ -12,21 +12,21 @@ jobs:

12 if: github.repository == 'oauth2-proxy/oauth2-proxy'

13 steps:

14 - name: Check out code

15− uses: actions/checkout@v6

15+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

16 with:

17 ref: master

18 fetch-depth: 0

19 fetch-tags: true

21 - name: Set up QEMU

22− uses: docker/setup-qemu-action@v3

22+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

24 - name: Set up Docker Buildx

25 id: buildx

26− uses: docker/setup-buildx-action@v3

26+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

28 - name: Login to quay.io

29− uses: docker/login-action@v3

29+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

30 with:

31 registry: quay.io/oauth2-proxy

32 username: ${{ secrets.REGISTRY_USERNAME_NIGHTLY }}

.github/workflows/publish-release.yml+7−13

@@ -20,7 +20,7 @@ jobs:

20 tag: ${{ steps.tag.outputs.version }}

21 steps:

22 - name: Check out code

23− uses: actions/checkout@v6

23+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

24 with:

25 ref: ${{ github.event.pull_request.merge_commit_sha }}

26 fetch-depth: 0

@@ -50,17 +50,11 @@ jobs:

50 id: go-version

52 - name: Set up Go

53− uses: actions/setup-go@v6

53+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

54 with:

55 go-version: ${{ steps.go-version.outputs.version }}

56 check-latest: true

58− - name: Install golangci-lint

59− uses: golangci/golangci-lint-action@v9

60− with:

61− install-only: true

62− version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint

63−

64 - name: Get go dependencies

58 - name: Get go dependencies

65 run: |

59 run: |

66 go mod download

60 go mod download

@@ -70,7 +64,7 @@ jobs:

71 # Upload artifacts in case of workflow failure

65 # Upload artifacts in case of workflow failure

72 - name: Upload Artifacts

66 - name: Upload Artifacts

73− uses: actions/upload-artifact@v7

67+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

74 with:

68 with:

75 name: oauth2-proxy-artifacts

69 name: oauth2-proxy-artifacts

76 path: |

70 path: |

@@ -106,21 +100,21 @@ jobs:

106 runs-on: ubuntu-latest

100 runs-on: ubuntu-latest

107 steps:

101 steps:

108 - name: Check out code

102 - name: Check out code

109− uses: actions/checkout@v6

103+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

110 with:

104 with:

111 ref: ${{ needs.publish.outputs.tag }}

105 ref: ${{ needs.publish.outputs.tag }}

112 fetch-depth: 0

106 fetch-depth: 0

113 fetch-tags: true

107 fetch-tags: true

114

108

115 - name: Set up QEMU

109 - name: Set up QEMU

116− uses: docker/setup-qemu-action@v3

110+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

117

111

118 - name: Set up Docker Buildx

112 - name: Set up Docker Buildx

119 id: buildx

113 id: buildx

120− uses: docker/setup-buildx-action@v3

114+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

121

115

122 - name: Login to quay.io

116 - name: Login to quay.io

123− uses: docker/login-action@v3

117+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

124 with:

118 with:

125 registry: quay.io/oauth2-proxy

119 registry: quay.io/oauth2-proxy

126 username: ${{ secrets.REGISTRY_USERNAME }}

120 username: ${{ secrets.REGISTRY_USERNAME }}

.github/workflows/stale.yml+1−1

@@ -10,7 +10,7 @@ jobs:

10 runs-on: ubuntu-latest

12 steps:

13− - uses: actions/stale@v10

13+ - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0

14 with:

15 repo-token: ${{ secrets.GITHUB_TOKEN }}

16 days-before-stale: 180

CHANGELOG.md+27

@@ -6,8 +6,35 @@

7## Breaking Changes

9+## Changes since v7.15.4

10+

11+# V7.15.4

12+

13+## Release Highlights

14+

15+- 🔵 Golang version upgrade to v1.26.7

16+ - Upgrade of all dependencies to their latest versions

17+- 🕵️‍♀️ Vulnerabilities have been addressed

18+ - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818)

19+ - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821)

20+ - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822)

21+ - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505)

22+ - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600)

23+ - [CVE-2026-56852](https://nvd.nist.gov/vuln/detail/CVE-2026-56852)

24+ - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853)

25+ - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858)

26+ - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859)

27+ - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860)

28+ - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862)

29+

30+## Important Notes

31+

32+## Breaking Changes

33+

9## Changes since v7.15.3

34## Changes since v7.15.3

36+- [#3493](https://github.com/oauth2-proxy/oauth2-proxy/pull/3493) chore(deps): update gomod @tuunit

37+

11# V7.15.3

38# V7.15.3

13## Release Highlights

40## Release Highlights

Makefile+9−4

@@ -25,7 +25,8 @@ help: ## Display this help

27GO ?= go

28−GOLANGCILINT ?= golangci-lint

28+# renovate: datasource=github-tags depName=golangci/golangci-lint

29+GOLANGCILINT_VERSION ?= v2.11.4

30BINARY := oauth2-proxy

31BINARY := oauth2-proxy

31VERSION ?= $(shell git describe --always --dirty --tags 2>/dev/null || echo "undefined")

32VERSION ?= $(shell git describe --always --dirty --tags 2>/dev/null || echo "undefined")

@@ -66,7 +67,7 @@ DOCKER_BUILDX_PUSH := $(DOCKER_BUILDX) --push

66DOCKER_BUILDX_PUSH_X_PLATFORM := $(DOCKER_BUILDX_PUSH) --platform ${DOCKER_BUILD_PLATFORM}

67DOCKER_BUILDX_PUSH_X_PLATFORM := $(DOCKER_BUILDX_PUSH) --platform ${DOCKER_BUILD_PLATFORM}

68DOCKER_BUILD_PLATFORM_ALPINE ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v6,linux/arm/v7,linux/s390x

69DOCKER_BUILD_PLATFORM_ALPINE ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v6,linux/arm/v7,linux/s390x

69−DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.23.3

70+DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.24.1

70DOCKER_BUILDX_ARGS_ALPINE ?= --build-arg RUNTIME_IMAGE=${DOCKER_BUILD_RUNTIME_IMAGE_ALPINE} ${DOCKER_BUILDX_COMMON_ARGS}

71DOCKER_BUILDX_ARGS_ALPINE ?= --build-arg RUNTIME_IMAGE=${DOCKER_BUILD_RUNTIME_IMAGE_ALPINE} ${DOCKER_BUILDX_COMMON_ARGS}

71DOCKER_BUILDX_X_PLATFORM_ALPINE := docker buildx build ${DOCKER_BUILDX_ARGS_ALPINE} --platform ${DOCKER_BUILD_PLATFORM_ALPINE}

72DOCKER_BUILDX_X_PLATFORM_ALPINE := docker buildx build ${DOCKER_BUILDX_ARGS_ALPINE} --platform ${DOCKER_BUILD_PLATFORM_ALPINE}

72DOCKER_BUILDX_PUSH_X_PLATFORM_ALPINE := $(DOCKER_BUILDX_X_PLATFORM_ALPINE) --push

73DOCKER_BUILDX_PUSH_X_PLATFORM_ALPINE := $(DOCKER_BUILDX_X_PLATFORM_ALPINE) --push

@@ -143,7 +144,7 @@ verify-generate: generate ## Verify command to check if alpha config docs are in

143##@ Miscellaneous

144##@ Miscellaneous

144

145

145.PHONY: test

146.PHONY: test

146−test: lint ## Run all Go tests

147+test: ## Run all Go tests

147 GO111MODULE=on $(GO) test $(TESTCOVER) -v -race ./...

148 GO111MODULE=on $(GO) test $(TESTCOVER) -v -race ./...

148

149

149.PHONY: release

150.PHONY: release

@@ -157,7 +158,11 @@ clean: ## Cleanup release and build files

157

158

158.PHONY: lint

159.PHONY: lint

159lint: validate-go-version ## Lint all files using golangci-lint

160lint: validate-go-version ## Lint all files using golangci-lint

160− GO111MODULE=on $(GOLANGCILINT) run

161+ GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m

162+

163+.PHONY: lint-fix

164+lint-fix: validate-go-version ## Lint all files and apply fixes using golangci-lint

165+ GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m --fix

161

166

162.PHONY: validate-go-version

167.PHONY: validate-go-version

163validate-go-version: ## Validate Go environment requirements

168validate-go-version: ## Validate Go environment requirements

README.md+4−4

@@ -12,7 +12,7 @@

13OAuth2 Proxy is a flexible, open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. It provides a simple and secure way to protect your web applications with OAuth2 / OIDC authentication. As a reverse proxy, it intercepts requests to your application and redirects users to an OAuth2 provider for authentication. As a middleware, it can be seamlessly integrated into your existing infrastructure to handle authentication for multiple applications.

15−OAuth2 Proxy supports a lot of OAuth2 as well as OIDC providers. Either through a generic OIDC client or a specific implementation for Google, Microsoft Entra ID, GitHub, login.gov and others. Through specialised provider implementations oauth2-proxy can extract more details about the user like preferred usernames and groups. Those details can then be forwarded as HTTP headers to your upstream applications.

15+OAuth2 Proxy supports a lot of OAuth2 as well as OIDC providers. Either through a generic OIDC client or a specific implementation for Google, Microsoft Entra ID, GitHub, login.gov and others. Through specialised provider implementations OAuth2 Proxy can extract more details about the user like preferred usernames and groups. Those details can then be forwarded as HTTP headers to your upstream applications.

17![Simplified Architecture](docs/static/img/simplified-architecture.svg)

@@ -23,7 +23,7 @@ OAuth2 Proxy's [Installation Docs](https://oauth2-proxy.github.io/oauth2-proxy/i

23## Releases

25### Binaries

26−We publish oauth2-proxy as compiled binaries on GitHub for all major architectures as well as more exotic ones like `ppc64le` as well as `s390x`.

26+We publish OAuth2 Proxy as compiled binaries on GitHub for all major architectures as well as more exotic ones like `ppc64le` as well as `s390x`.

28Check out the [latest release](https://github.com/oauth2-proxy/oauth2-proxy/releases/latest).

@@ -49,9 +49,9 @@ SAP Open Source Program

49Microsoft Azure credits for open source projects

51## Getting Involved

52−[![Slack](https://img.shields.io/badge/slack-Gopher_%23oauth2--proxy-red?logo=slack)](https://gophers.slack.com/archives/CM2RSS25N)

52+[![Slack](https://img.shields.io/badge/slack-CNCF_%23oauth2--proxy-blue?logo=slack)](https://cloud-native.slack.com/archives/C098Y5URZ2N)

54−Join the #oauth2-proxy [Slack channel](https://gophers.slack.com/archives/CM2RSS25N) to chat with other users of oauth2-proxy or reach out to the maintainers directly. Use the [public invite link](https://invite.slack.golangbridge.org/) to get an invite for the Gopher Slack space.

54+Join the #oauth2-proxy [Slack channel](https://cloud-native.slack.com/archives/C098Y5URZ2N) to chat with other users of OAuth2 Proxy or reach out to the maintainers directly. Use the [public invite link](https://slack.cncf.io/) to get an invite for the CNCF space.

56OAuth2 Proxy is a community-driven project. We rely on the contribut️ions of our users to continually improve it. While review times can vary, we appreciate your patience and understanding. As a volunteer-driven project, we strive to keep this project stable and might take longer to merge changes.

contrib/local-environment/Makefile+2−2

@@ -49,8 +49,8 @@ kubernetes-down:

50.PHONY: traefik-up

51traefik-up:

52− docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml up -d

52+ docker compose -f docker-compose-traefik.yaml up -d

54.PHONY: traefik-%

55traefik-%:

56− docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml $*

56+ docker compose -f docker-compose-traefik.yaml $*

contrib/local-environment/dex-traefik.yamlnew file+25

@@ -0,0 +1,25 @@

1+# This configuration is intended to be used with the Traefik local environment.

2+# Dex uses in-memory storage because this environment is disposable.

3+issuer: http://dex.localtest.me/dex

4+storage:

5+ type: memory

6+web:

7+ http: 0.0.0.0:5556

8+oauth2:

9+ skipApprovalScreen: true

10+expiry:

11+ signingKeys: "4h"

12+ idTokens: "1h"

13+staticClients:

14+ - id: oauth2-proxy

15+ redirectURIs:

16+ - "http://oauth2-proxy.localtest.me/oauth2/callback"

17+ name: "OAuth2 Proxy"

18+ secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

19+enablePasswordDB: true

20+staticPasswords:

21+ - email: "admin@example.com"

22+ # bcrypt hash of the string "password"

23+ hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"

24+ username: "admin"

25+ userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"

contrib/local-environment/dex.yaml+1−6

@@ -3,11 +3,7 @@

3# This should configure Dex to run on port 5556 and provides a static login

4issuer: http://dex.localtest.me:5556/dex

5storage:

6− type: etcd

6+ type: memory

7− config:

8− endpoints:

9− - http://etcd:2379

10− namespace: dex/

11web:

7web:

12 http: 0.0.0.0:5556

8 http: 0.0.0.0:5556

13oauth2:

9oauth2:

@@ -21,7 +17,6 @@ staticClients:

21 # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.

17 # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.

22 - "http://oauth2-proxy.localtest.me:4180/oauth2/callback" # For basic proxy example.

18 - "http://oauth2-proxy.localtest.me:4180/oauth2/callback" # For basic proxy example.

23 - "http://oauth2-proxy.localtest.me:8080/oauth2/callback" # For nginx example.

19 - "http://oauth2-proxy.localtest.me:8080/oauth2/callback" # For nginx example.

24− - "http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback" # For traefik example.

25 name: "OAuth2 Proxy"

20 name: "OAuth2 Proxy"

26 secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

21 secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

27enablePasswordDB: true

22enablePasswordDB: true

contrib/local-environment/docker-compose-alpha-config.yaml+2−15

@@ -1,7 +1,7 @@

1# This docker-compose file can be used to bring up an example instance of oauth2-proxy

2# for manual testing and exploration of features.

3# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex and HTTPBin as an example upstream.

4+# HTTPBin as an example upstream.

5# This file also uses alpha configuration when configuring OAuth2 Proxy.

7# This file is an extension of the main compose file and must be used with it

@@ -14,7 +14,7 @@ version: "3.0"

14services:

15 oauth2-proxy:

16 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

18 command: --config /oauth2-proxy.cfg --alpha-config /oauth2-proxy-alpha-config.yaml

19 hostname: oauth2-proxy

20 volumes:

@@ -43,25 +43,12 @@ services:

43 dex:

44 aliases:

45 - dex.localtest.me

46− etcd: {}

47− depends_on:

48− - etcd

49 httpbin:

46 httpbin:

50 container_name: httpbin

47 container_name: httpbin

51 image: kennethreitz/httpbin

48 image: kennethreitz/httpbin

52 ports: []

49 ports: []

53 networks:

50 networks:

54 httpbin: {}

51 httpbin: {}

55− etcd:

56− container_name: etcd

57− image: gcr.io/etcd-development/etcd:v3.6.8

58− entrypoint: /usr/local/bin/etcd

59− command:

60− - --listen-client-urls=http://0.0.0.0:2379

61− - --advertise-client-urls=http://etcd:2379

62− networks:

63− etcd: {}

64networks:

52networks:

65 dex: {}

53 dex: {}

66− etcd: {}

67 httpbin: {}

54 httpbin: {}

contrib/local-environment/docker-compose-gitea.yaml+2−2

@@ -14,7 +14,7 @@ version: '3.0'

14services:

15 oauth2-proxy:

16 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

18 command: --config /oauth2-proxy.cfg

19 hostname: oauth2-proxy

20 volumes:

@@ -39,7 +39,7 @@ services:

39 httpbin: {}

41 gitea:

42− image: gitea/gitea:1.25.5

42+ image: gitea/gitea:1.27.2

43 container_name: gitea

44 environment:

45 - USER_UID=1000

contrib/local-environment/docker-compose-keycloak.yaml+2−2

@@ -14,7 +14,7 @@ version: "3.0"

14services:

15 oauth2-proxy:

16 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

18 command: --config /oauth2-proxy.cfg

19 hostname: oauth2-proxy

20 volumes:

@@ -40,7 +40,7 @@ services:

41 keycloak:

42 container_name: keycloak

43− image: keycloak/keycloak:25.0

43+ image: keycloak/keycloak:26.7

44 hostname: keycloak

45 command:

46 - "start-dev"

contrib/local-environment/docker-compose-nginx.yaml+4−29

@@ -1,28 +1,18 @@

1# This docker-compose file can be used to bring up an example instance of oauth2-proxy

2# for manual testing and exploration of features.

3# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex, nginx as a reverse proxy and other http services for upstreams

4+# nginx as a reverse proxy and other HTTP services for upstreams.

6# This file is an extension of the main compose file and must be used with it

7# docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml <command>

8# Alternatively:

9# make nginx-<command> (eg make nginx-up, make nginx-down)

10#

11−# Access one of the following URLs to initiate a login flow:

11+# Access http://oauth2-proxy.localtest.me:8080 to initiate a login flow.

12−# - http://oauth2-proxy.localhost

13−# - http://httpbin.oauth2-proxy.localhost

14−#

15−# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16−#

17−# Note, the above URLs should work with Chrome, but you may need to add hosts

18−# entries for other browsers

19−# 127.0.0.1 oauth2-proxy.localhost

20−# 127.0.0.1 httpbin.oauth2-proxy.localhost

21−# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

22version: "3.0"

12version: "3.0"

23services:

13services:

24 oauth2-proxy:

14 oauth2-proxy:

25− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

15+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

26 ports: []

16 ports: []

27 hostname: oauth2-proxy

17 hostname: oauth2-proxy

28 container_name: oauth2-proxy

18 container_name: oauth2-proxy

@@ -33,7 +23,6 @@ services:

33 networks:

23 networks:

34 oauth2-proxy: {}

24 oauth2-proxy: {}

35 dex: {}

25 dex: {}

36− etcd: {}

37 httpbin: {}

26 httpbin: {}

38 depends_on:

27 depends_on:

39 - dex

28 - dex

@@ -42,7 +31,7 @@ services:

42 depends_on:

31 depends_on:

43 - oauth2-proxy

32 - oauth2-proxy

44 container_name: nginx

33 container_name: nginx

45− image: nginx:1.29

34+ image: nginx:1.31

46 restart: unless-stopped

35 restart: unless-stopped

47 ports:

36 ports:

48 - 8080:8080/tcp

37 - 8080:8080/tcp

@@ -52,7 +41,6 @@ services:

52 networks:

41 networks:

53 oauth2-proxy: {}

42 oauth2-proxy: {}

54 dex: {}

43 dex: {}

55− etcd: {}

56 httpbin: {}

44 httpbin: {}

57 dex:

45 dex:

58 container_name: dex

46 container_name: dex

@@ -68,26 +56,13 @@ services:

68 dex:

56 dex:

69 aliases:

57 aliases:

70 - dex.localtest.me

58 - dex.localtest.me

71− etcd: {}

72− depends_on:

73− - etcd

74 httpbin:

59 httpbin:

75 container_name: httpbin

60 container_name: httpbin

76 image: kennethreitz/httpbin

61 image: kennethreitz/httpbin

77 ports: []

62 ports: []

78 networks:

63 networks:

79 httpbin: {}

64 httpbin: {}

80− etcd:

81− container_name: etcd

82− image: gcr.io/etcd-development/etcd:v3.6.8

83− entrypoint: /usr/local/bin/etcd

84− command:

85− - --listen-client-urls=http://0.0.0.0:2379

86− - --advertise-client-urls=http://etcd:2379

87− networks:

88− etcd: {}

89networks:

65networks:

90 dex: {}

66 dex: {}

91− etcd: {}

92 httpbin: {}

67 httpbin: {}

93 oauth2-proxy: {}

68 oauth2-proxy: {}

contrib/local-environment/docker-compose-traefik.yaml+42−18

@@ -1,7 +1,7 @@

1# This docker-compose file can be used to bring up an example instance of oauth2-proxy

2# for manual testing and exploration of features.

3−# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider

4−# HTTPBin as an example upstream.

4+# and HTTPBin as an example upstream.

6# This can either be created using docker-compose

7# docker-compose -f docker-compose-traefik.yaml <command>

@@ -9,32 +9,51 @@

9# make traefik-<command> (eg. make traefik-up, make traefik-down)

10#

11# Access one of the following URLs to initiate a login flow:

12−# - http://oauth2-proxy.localhost

12+# - http://oauth2-proxy.localtest.me

13−# - http://httpbin.oauth2-proxy.localhost

13+# - http://httpbin.localtest.me

14+# - http://dex.localtest.me/dex

14#

15#

15−# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.localtest.me

16−#

17−# Note, the above URLs should work with Chrome, but you may need to add hosts

18−# entries for other browsers

19−# 127.0.0.1 oauth2-proxy.localhost

20−# 127.0.0.1 httpbin.oauth2-proxy.localhost

21−# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

22−version: '3.0'

23services:

17services:

25 oauth2-proxy:

19 oauth2-proxy:

20+ container_name: oauth2-proxy

26− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

21+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

22+ command: --config /oauth2-proxy.cfg

27 ports: []

23 ports: []

28 hostname: oauth2-proxy

24 hostname: oauth2-proxy

29 volumes:

25 volumes:

30 - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"

26 - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"

27+ restart: unless-stopped

28+ networks:

29+ oauth2-proxy: {}

30+ dex: {}

31+ depends_on:

32+ - dex

33+ - httpbin

34+

35+ dex:

36+ container_name: dex

37+ image: ghcr.io/dexidp/dex:v2.45.1

38+ command: dex serve /dex.yaml

39+ hostname: dex

40+ volumes:

41+ - "./dex-traefik.yaml:/dex.yaml"

42+ restart: unless-stopped

31 networks:

43 networks:

32− oauth2-proxy:

44+ dex: {}

45+

46+ httpbin:

47+ container_name: httpbin

48+ image: kennethreitz/httpbin

49+ ports: []

50+ networks:

51+ httpbin: {}

34 # Reverse proxy

53 # Reverse proxy

35 gateway:

54 gateway:

36 container_name: traefik

55 container_name: traefik

37− image: traefik:v2.11.40

56+ image: traefik:v3.7.10

38 volumes:

57 volumes:

39 - "./traefik:/etc/traefik"

58 - "./traefik:/etc/traefik"

40 ports:

59 ports:

@@ -43,8 +62,13 @@ services:

43 depends_on:

62 depends_on:

44 - oauth2-proxy

63 - oauth2-proxy

45 networks:

64 networks:

46− oauth2-proxy:

65+ oauth2-proxy: {}

47− httpbin:

66+ httpbin: {}

67+ dex:

68+ aliases:

69+ - dex.localtest.me

49networks:

71networks:

72+ dex: {}

73+ httpbin: {}

50− oauth2-proxy:

74+ oauth2-proxy: {}

contrib/local-environment/docker-compose.yaml+2−15

@@ -1,7 +1,7 @@

1# This docker-compose file can be used to bring up an example instance of oauth2-proxy

2# for manual testing and exploration of features.

3# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex and HTTPBin as an example upstream.

4+# HTTPBin as an example upstream.

6# This can either be created using docker-compose

7# docker-compose -f docker-compose.yaml <command>

@@ -13,7 +13,7 @@ version: "3.0"

13services:

14 oauth2-proxy:

15 container_name: oauth2-proxy

16− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

16+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

17 command: --config /oauth2-proxy.cfg

18 hostname: oauth2-proxy

19 volumes:

@@ -41,25 +41,12 @@ services:

41 dex:

42 aliases:

43 - dex.localtest.me

44− etcd: {}

45− depends_on:

46− - etcd

47 httpbin:

44 httpbin:

48 container_name: httpbin

45 container_name: httpbin

49 image: kennethreitz/httpbin

46 image: kennethreitz/httpbin

50 ports: []

47 ports: []

51 networks:

48 networks:

52 httpbin: {}

49 httpbin: {}

53− etcd:

54− container_name: etcd

55− image: gcr.io/etcd-development/etcd:v3.6.8

56− entrypoint: /usr/local/bin/etcd

57− command:

58− - --listen-client-urls=http://0.0.0.0:2379

59− - --advertise-client-urls=http://etcd:2379

60− networks:

61− etcd: {}

62networks:

50networks:

63 dex: {}

51 dex: {}

64− etcd: {}

65 httpbin: {}

52 httpbin: {}

contrib/local-environment/kubernetes/Chart.lock+3−3

@@ -1,7 +1,7 @@

1dependencies:

2- name: dex

3 repository: https://charts.dexidp.io

4− version: 0.24.0

4+ version: 0.24.1

5- name: oauth2-proxy

6 repository: https://oauth2-proxy.github.io/manifests

7 version: 7.18.0

@@ -11,5 +11,5 @@ dependencies:

11- name: hello-world

12 repository: https://conservis.github.io/helm-charts

13 version: 1.1.0

14−digest: sha256:fee913531bfb67e5555e995d8fb040c330e6eb4b5a8c777ceb9841135ea9bb84

14+digest: sha256:3fff8bf99cebcd20a73c984423d5f1c2dfa1e5a394f82a5dc60d9aaffe5361b7

15−generated: "2025-10-28T06:46:35.38300324Z"

15+generated: "2026-08-18T07:33:03.791274914Z"

contrib/local-environment/kubernetes/Chart.yaml+1−1

@@ -3,7 +3,7 @@ description: K8S example based on https://kind.sigs.k8s.io

3name: kubernetes

4dependencies:

5 - name: dex

6− version: 0.24.0

6+ version: 0.24.1

7 repository: https://charts.dexidp.io

8 - name: oauth2-proxy

9 version: &chartVersion 7.18.0

contrib/local-environment/oauth2-proxy-traefik.cfg+4−4

@@ -2,14 +2,14 @@ http_address="0.0.0.0:4180"

2cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

3provider="oidc"

4email_domains=["example.com"]

5−oidc_issuer_url="http://dex.localhost:5556/dex"

5+oidc_issuer_url="http://dex.localtest.me/dex"

6client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

7client_id="oauth2-proxy"

8cookie_secure="false"

10−redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"

10+redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"

11−cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.

11+cookie_domains=".localtest.me" # Required so cookie can be read on all subdomains.

12−whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.

12+whitelist_domains=".localtest.me" # Required to allow redirection back to original requested target.

14# Mandatory option when using oauth2-proxy with traefik

15reverse_proxy="true"

contrib/local-environment/traefik/dynamic.yaml+11−4

@@ -1,22 +1,25 @@

1http:

2 routers:

3 oauth2-proxy-route:

4− rule: "Host(`oauth2-proxy.oauth2-proxy.localhost`)"

4+ rule: "Host(`oauth2-proxy.localtest.me`)"

5 middlewares:

6 - auth-headers

7 service: oauth-backend

8+ dex-route:

9+ rule: "Host(`dex.localtest.me`)"

10+ service: dex-service

8 httpbin-route:

11 httpbin-route:

9− rule: "Host(`httpbin.oauth2-proxy.localhost`)"

12+ rule: "Host(`httpbin.localtest.me`)"

10 service: httpbin-service

13 service: httpbin-service

11 middlewares:

14 middlewares:

12 - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin

15 - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin

13 httpbin-route-2:

16 httpbin-route-2:

14− rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/no-auto-redirect`)"

17+ rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/no-auto-redirect`)"

15 service: httpbin-service

18 service: httpbin-service

16 middlewares:

19 middlewares:

17 - oauth-auth-wo-redirect # unauthenticated session will return a 401

20 - oauth-auth-wo-redirect # unauthenticated session will return a 401

18 services-oauth2-route:

21 services-oauth2-route:

19− rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/oauth2/`)"

22+ rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/oauth2/`)"

20 middlewares:

23 middlewares:

21 - auth-headers

24 - auth-headers

22 service: oauth-backend

25 service: oauth-backend

@@ -30,6 +33,10 @@ http:

30 loadBalancer:

33 loadBalancer:

31 servers:

34 servers:

32 - url: http://oauth2-proxy:4180

35 - url: http://oauth2-proxy:4180

36+ dex-service:

37+ loadBalancer:

38+ servers:

39+ - url: http://dex:5556

34 middlewares:

41 middlewares:

35 auth-headers:

42 auth-headers:

contrib/local-environment/traefik/traefik.yaml+2

@@ -5,3 +5,5 @@ log:

5providers:

6 file:

7 filename: /etc/traefik/dynamic.yaml

8+ # Routes are static for this example; disabling watch avoids host inotify limits.

9+ watch: false

docs/docs/configuration/alpha_config.md+12−1

@@ -167,6 +167,17 @@ injectResponseHeaders:

167* `claimSource` - `claim` (session claims either from id token or from profile URL)

168* `secretSource` - `value` (base64), `fromFile` (file path)

169

170+#### Claim value serialization

171+

172+`claimSource` converts the selected claim into one or more string header values. Scalars

173+produce one value, while arrays produce one value per element. Values that cannot be

174+converted directly to strings, such as objects, are JSON-encoded individually.

175+

176+Each non-empty value is added separately under the configured header name. An array of

177+objects therefore produces multiple header values containing one JSON object each, not a

178+single JSON array. HTTP libraries and intermediaries may expose repeated values as a

179+comma-joined string, so consumers should retrieve and parse each header value separately.

180+

170**Request option:** `preserveRequestValue: true` retains existing header values

181**Request option:** `preserveRequestValue: true` retains existing header values

171

182

172**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

183**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

@@ -678,7 +689,7 @@ Requests will be proxied to this upstream if the path matches the request path.

678| Field | Type | Description |

689| Field | Type | Description |

679| ----- | ---- | ----------- |

690| ----- | ---- | ----------- |

680| `id` | _string_ | ID should be a unique identifier for the upstream. This value is required for all upstreams. |

691| `id` | _string_ | ID should be a unique identifier for the upstream. This value is required for all upstreams. |

681−| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Path can also take a pattern when used with RewriteTarget. Path segments can be captured and matched using regular experessions. Eg: - `^/foo$`: Match only the explicit path `/foo` - `^/bar/$`: Match any path prefixed with `/bar/` - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |

692+| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Without RewriteTarget, Path follows gorilla/mux route syntax. Eg: - `/foo`: Match only the explicit path `/foo` - `/bar/`: Match any path prefixed with `/bar/` - `/baz/{path:.*}`: Match any path prefixed with `/baz/` When RewriteTarget is set, Path is treated as a regular expression. Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the remaining path for use with RewriteTarget. |

682| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem (for a `file:` upstream). Use the Path to capture segments for reuse within the rewrite target. Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite the request `/baz/abc/123` to `/foo/abc/123` before proxying to the upstream server. Or if the upstream were `file:///app`, a request for `/baz/info.html` would return the contents of the file `/app/foo/info.html`. |

693| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem (for a `file:` upstream). Use the Path to capture segments for reuse within the rewrite target. Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite the request `/baz/abc/123` to `/foo/abc/123` before proxying to the upstream server. Or if the upstream were `file:///app`, a request for `/baz/info.html` would return the contents of the file `/app/foo/info.html`. |

683| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File based URL. It may include a path, in which case all requests will be served under that path. Eg: - http://localhost:8080 - https://service.localhost - https://service.localhost/path - file://host/path If the URI's path is "/base" and the incoming request was for "/dir", the upstream request will be for "/base/dir". |

694| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File based URL. It may include a path, in which case all requests will be served under that path. Eg: - http://localhost:8080 - https://service.localhost - https://service.localhost/path - file://host/path If the URI's path is "/base" and the incoming request was for "/dir", the upstream request will be for "/base/dir". |

684| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts. This option is insecure and will allow potential Man-In-The-Middle attacks between OAuth2 Proxy and the upstream server. Defaults to false. |

695| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts. This option is insecure and will allow potential Man-In-The-Middle attacks between OAuth2 Proxy and the upstream server. Defaults to false. |

docs/docs/configuration/alpha_config.md.tmpl+11

@@ -167,6 +167,17 @@ injectResponseHeaders:

167* `claimSource` - `claim` (session claims either from id token or from profile URL)

168* `secretSource` - `value` (base64), `fromFile` (file path)

169

170+#### Claim value serialization

171+

172+`claimSource` converts the selected claim into one or more string header values. Scalars

173+produce one value, while arrays produce one value per element. Values that cannot be

174+converted directly to strings, such as objects, are JSON-encoded individually.

175+

176+Each non-empty value is added separately under the configured header name. An array of

177+objects therefore produces multiple header values containing one JSON object each, not a

178+single JSON array. HTTP libraries and intermediaries may expose repeated values as a

179+comma-joined string, so consumers should retrieve and parse each header value separately.

180+

170**Request option:** `preserveRequestValue: true` retains existing header values

181**Request option:** `preserveRequestValue: true` retains existing header values

171

182

172**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

183**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

docs/docs/configuration/integrations/nginx.md+27−11

@@ -60,23 +60,23 @@ server {

60 auth_request_set $auth_cookie $upstream_http_set_cookie;

61 add_header Set-Cookie $auth_cookie;

63− # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb

63+ # Large OIDC tokens can make the session cookie exceed the 4KB limit,

64− # limit and so the OAuth2 Proxy splits these into multiple parts.

64+ # causing OAuth2 Proxy to split the cookie into multiple parts.

65 # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,

66− # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.

66+ # so extract the second part when using the default cookie name, `_oauth2_proxy`.

67− auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

67+ auth_request_set $auth_cookie_upstream_1 $upstream_cookie__oauth2_proxy_1;

69 # Extract the Cookie attributes from the first Set-Cookie header and append them

70 # to the second part ($upstream_cookie_* variables only contain the raw cookie content)

71 if ($auth_cookie ~* "(; .*)") {

72− set $auth_cookie_name_0 $auth_cookie;

72+ set $auth_cookie_0 $auth_cookie;

73− set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";

73+ set $auth_cookie_1 "_oauth2_proxy_1=$auth_cookie_upstream_1$1";

74 }

76 # Send both Set-Cookie headers now if there was a second part

77− if ($auth_cookie_name_upstream_1) {

77+ if ($auth_cookie_upstream_1) {

78− add_header Set-Cookie $auth_cookie_name_0;

78+ add_header Set-Cookie $auth_cookie_0;

79− add_header Set-Cookie $auth_cookie_name_1;

79+ add_header Set-Cookie $auth_cookie_1;

80 }

82 proxy_pass http://backend/;

@@ -91,6 +91,24 @@ server {

91}

92```

94+### Multi-part session cookies

95+

96+The example above is ready to use with the default `--cookie-name=_oauth2_proxy` setting and handles a session split into two cookies. If you configure a custom cookie name, update both references to the second cookie part:

97+

98+| Cookie configuration | Nginx upstream cookie variable | `Set-Cookie` name |

99+| --- | --- | --- |

100+| Default (`_oauth2_proxy`) | `$upstream_cookie__oauth2_proxy_1` | `_oauth2_proxy_1=` |

101+| `--cookie-name=my_cookie` | `$upstream_cookie_my_cookie_1` | `my_cookie_1=` |

102+

103+For example, with `--cookie-name=my_cookie`, change the relevant lines to:

104+

105+```nginx

106+auth_request_set $auth_cookie_upstream_1 $upstream_cookie_my_cookie_1;

107+set $auth_cookie_1 "my_cookie_1=$auth_cookie_upstream_1$1";

108+```

109+

110+If a session is split into more than two cookies, repeat the extraction for each additional numeric suffix. For consistently large sessions, prefer `--session-store-type=redis` so only a small session ticket is stored in the browser cookie.

111+

94### Understanding the `error_page` redirect pattern

112### Understanding the `error_page` redirect pattern

113

96The `auth_request` directive expects the authentication endpoint (`/oauth2/auth`) to return:

114The `auth_request` directive expects the authentication endpoint (`/oauth2/auth`) to return:

@@ -167,8 +185,6 @@ It is recommended to use `--session-store-type=redis` when expecting large sessi

167For a complete example of integrating oauth2-proxy with Kubernetes Dashboard on AKS using Azure Entra ID, including RBAC configuration and troubleshooting, see the [Kubernetes Dashboard on AKS](../providers/ms_entra_id.md#kubernetes-dashboard-on-aks) section in the Microsoft Entra ID provider documentation.

185For a complete example of integrating oauth2-proxy with Kubernetes Dashboard on AKS using Azure Entra ID, including RBAC configuration and troubleshooting, see the [Kubernetes Dashboard on AKS](../providers/ms_entra_id.md#kubernetes-dashboard-on-aks) section in the Microsoft Entra ID provider documentation.

168:::

186:::

169

187

170−You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

171−

172:::note

188:::note

173If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.

189If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.

174:::

190:::

docs/docs/configuration/providers/atlassian.mdnew file+26

@@ -0,0 +1,26 @@

1+---

2+id: atlassian

3+title: Atlassian Cloud

4+---

6+1. Create an OAuth 2.0 integration in the [Atlassian developer console](https://developer.atlassian.com/console/myapps/).

7+2. Under **Permissions**, add the User identity API with the `read:me` scope.

8+3. Under **Authorization**, set the callback URL to `https://<proxy_host>/oauth2/callback`.

9+4. Copy the client ID and secret from **Settings**.

10+5. Run the proxy with:

11+

12+```shell

13+ --provider=atlassian

14+ --client-id=<client ID>

15+ --client-secret=<secret>

16+ --redirect-url=https://<proxy_host>/oauth2/callback

17+ --cookie-secret=<cookie secret>

18+```

19+

20+A new app works only for the account that created it. Enable sharing under **Distribution** to let other users sign in.

21+Atlassian then admits only accounts with access to the Atlassian site the app is installed on; others are refused at

22+the consent screen.

23+

24+The proxy reads the user's email from `https://api.atlassian.com/me`. Restricting access further is supported by

25+[email](index.md#email-authentication). With `--cookie-refresh` set, the proxy re-validates the token against `/me` on

26+that interval.

docs/docs/configuration/providers/dtt_sso.mdnew file+45

@@ -0,0 +1,45 @@

1+---

2+id: dtt_sso

3+title: DTT SSO

4+---

6+Signs users in with the DTT SSO (auth-server) using the authorization code flow and its HS256 id_token.

8+1. Register a client in the auth-server config, one per protected service, with the proxy's callback as its

9+ only redirect URI:

10+

11+ ```yaml

12+ clients:

13+ redash-gate:

14+ secret: <random secret>

15+ redirect_uri: https://redash.example.com/oauth2/callback

16+ display_name: Redash

17+ ```

18+

19+2. Run the proxy with:

20+

21+ ```shell

22+ --provider=dtt-sso

23+ --client-id=redash-gate

24+ --client-secret-file=/run/secrets/client_secret

25+ --redirect-url=https://redash.example.com/oauth2/callback

26+ --cookie-secret-file=/run/secrets/cookie_secret

27+ --cookie-name=_dtt_sso_redash

28+ --cookie-refresh=5m

29+ ```

30+

31+ Give each instance its own `--cookie-name`: another oauth2-proxy setting its cookie on a parent domain

32+ (the Atlassian proxy uses `_oauth2_proxy` on `.thebestagent.pro`) would otherwise shadow this one.

33+

34+The endpoints default to `https://auth.thebestagent.pro`. For another SSO host set `--login-url`, `--redeem-url`

35+and `--validate-url` to its `/oauth/authorize`, `/oauth/token` and `/oauth/check_token`; the id_token issuer must

36+equal the login URL's origin (the SSO's `site_host`).

37+

38+The scope must stay `openid`, the only scope the SSO accepts.

39+

40+The session carries the SSO `email`, the user UUID as the user, and the SSO `role` as the only group, so

41+`--allowed-group=dtt_admin` restricts access by role. `--authenticated-emails-file` and `--email-domain` restrict

42+by email as usual.

43+

44+With `--cookie-refresh` set, the proxy refreshes the tokens on that interval and re-reads the email and role; a user

45+deleted or signed out in the SSO loses access at the next refresh.

docs/docs/configuration/providers/index.md+2

@@ -9,10 +9,12 @@ with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.

9Valid providers are :

11- [ADFS](adfs.md)

12+- [Atlassian Cloud](atlassian.md)

12- [Bitbucket](bitbucket.md)

13- [Bitbucket](bitbucket.md)

13- [Cidaas](cidaas.md)

14- [Cidaas](cidaas.md)

14- [CiscoDuo](cisco_duo.md)

15- [CiscoDuo](cisco_duo.md)

15- [DigitalOcean](digitalocean.md)

16- [DigitalOcean](digitalocean.md)

17+- [DTT SSO](dtt_sso.md)

16- [Facebook](facebook.md)

18- [Facebook](facebook.md)

17- [Gitea](gitea.md)

19- [Gitea](gitea.md)

18- [GitHub](github.md)

20- [GitHub](github.md)

docs/docs/installation.md+1−1

@@ -5,7 +5,7 @@ title: Installation

61. Choose how to deploy:

8− a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.3`)

8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)

10 b. Using Go to install the latest release

11 ```bash

docs/docusaurus.config.js+1−1

@@ -105,7 +105,7 @@ const config = {

105 dropdownActiveClassDisabled: true,

106 },

107 {

108− href: 'https://gophers.slack.com/messages/CM2RSS25N',

108+ href: 'https://cloud-native.slack.com/archives/C098Y5URZ2N',

109 label: 'Slack',

110 position: 'right',

111 },

docs/sidebars.js+2

@@ -46,11 +46,13 @@ const sidebars = {

46 },

47 items: [

48 "configuration/providers/adfs",

49+ "configuration/providers/atlassian",

49 "configuration/providers/azure",

50 "configuration/providers/azure",

50 "configuration/providers/bitbucket",

51 "configuration/providers/bitbucket",

51 "configuration/providers/cidaas",

52 "configuration/providers/cidaas",

52 "configuration/providers/cisco_duo",

53 "configuration/providers/cisco_duo",

53 "configuration/providers/digitalocean",

54 "configuration/providers/digitalocean",

55+ "configuration/providers/dtt_sso",

54 "configuration/providers/facebook",

56 "configuration/providers/facebook",

55 "configuration/providers/gitea",

57 "configuration/providers/gitea",

56 "configuration/providers/github",

58 "configuration/providers/github",

docs/versioned_docs/version-7.15.x/installation.md+1−1

@@ -5,7 +5,7 @@ title: Installation

61. Choose how to deploy:

8− a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.3`)

8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)

10 b. Using Go to install the latest release

11 ```bash

go.mod+33−37

@@ -9,7 +9,7 @@ require (

9 github.com/alicebob/miniredis/v2 v2.38.0

10 github.com/bitly/go-simplejson v0.5.1

11 github.com/bsm/redislock v0.10.0

12− github.com/coreos/go-oidc/v3 v3.18.0

12+ github.com/coreos/go-oidc/v3 v3.20.0

13 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf

14 github.com/fsnotify/fsnotify v1.10.1

15 github.com/go-jose/go-jose/v3 v3.0.5

@@ -21,67 +21,63 @@ require (

21 github.com/gorilla/mux v1.8.1

22 github.com/justinas/alice v1.2.0

23 github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25

24− github.com/onsi/ginkgo/v2 v2.29.0

24+ github.com/onsi/ginkgo/v2 v2.32.1

25− github.com/onsi/gomega v1.41.0

25+ github.com/onsi/gomega v1.42.1

26− github.com/pierrec/lz4/v4 v4.1.27

26+ github.com/pierrec/lz4/v4 v4.1.28

27− github.com/prometheus/client_golang v1.23.2

27+ github.com/prometheus/client_golang v1.24.1

28− github.com/redis/go-redis/v9 v9.20.0

28+ github.com/redis/go-redis/v9 v9.22.0

29 github.com/spf13/cast v1.10.0

30 github.com/spf13/pflag v1.0.10

31 github.com/spf13/viper v1.21.0

32− github.com/stretchr/testify v1.11.1

32+ github.com/stretchr/testify v1.12.0

33 github.com/vmihailenco/msgpack/v5 v5.4.1

34− go.yaml.in/yaml/v3 v3.0.4

34+ go.yaml.in/yaml/v3 v3.0.5

35− golang.org/x/crypto v0.52.0

35+ golang.org/x/crypto v0.55.0

36− golang.org/x/net v0.55.0

36+ golang.org/x/net v0.58.0

37 golang.org/x/oauth2 v0.36.0

38− golang.org/x/sync v0.20.0

38+ golang.org/x/sync v0.22.0

39− google.golang.org/api v0.283.0

39+ google.golang.org/api v0.293.0

40 gopkg.in/natefinch/lumberjack.v2 v2.2.1

41− k8s.io/apimachinery v0.36.1

41+ k8s.io/apimachinery v0.36.3

42)

44require (

45− cloud.google.com/go/auth v0.20.0 // indirect

45+ cloud.google.com/go/auth v0.23.1 // indirect

46 cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect

47 github.com/Masterminds/semver/v3 v3.5.0 // indirect

48 github.com/beorn7/perks v1.0.1 // indirect

49 github.com/cespare/xxhash/v2 v2.3.0 // indirect

50− github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect

51− github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect

52− github.com/felixge/httpsnoop v1.0.4 // indirect

50+ github.com/felixge/httpsnoop v1.1.0 // indirect

53− github.com/go-logr/logr v1.4.3 // indirect

51+ github.com/go-logr/logr v1.4.4 // indirect

54 github.com/go-logr/stdr v1.2.2 // indirect

52 github.com/go-logr/stdr v1.2.2 // indirect

55 github.com/go-task/slim-sprig/v3 v3.0.0 // indirect

53 github.com/go-task/slim-sprig/v3 v3.0.0 // indirect

56− github.com/google/pprof v0.0.0-20260604005048-7023385849c0 // indirect

54+ github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect

57 github.com/google/s2a-go v0.1.9 // indirect

55 github.com/google/s2a-go v0.1.9 // indirect

58− github.com/googleapis/enterprise-certificate-proxy v0.3.16 // indirect

56+ github.com/googleapis/enterprise-certificate-proxy v0.3.21 // indirect

59− github.com/googleapis/gax-go/v2 v2.22.0 // indirect

57+ github.com/googleapis/gax-go/v2 v2.23.0 // indirect

60 github.com/kylelemons/godebug v1.1.0 // indirect

58 github.com/kylelemons/godebug v1.1.0 // indirect

61 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

59 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

62− github.com/pelletier/go-toml/v2 v2.3.1 // indirect

60+ github.com/pelletier/go-toml/v2 v2.4.3 // indirect

63− github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect

64 github.com/prometheus/client_model v0.6.2 // indirect

61 github.com/prometheus/client_model v0.6.2 // indirect

65− github.com/prometheus/common v0.68.1 // indirect

62+ github.com/prometheus/common v0.70.1 // indirect

66− github.com/prometheus/procfs v0.20.1 // indirect

63+ github.com/prometheus/procfs v0.21.1 // indirect

67 github.com/sagikazarmark/locafero v0.12.0 // indirect

64 github.com/sagikazarmark/locafero v0.12.0 // indirect

68 github.com/spf13/afero v1.15.0 // indirect

65 github.com/spf13/afero v1.15.0 // indirect

69 github.com/subosito/gotenv v1.6.0 // indirect

66 github.com/subosito/gotenv v1.6.0 // indirect

70 github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect

67 github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect

71 github.com/yuin/gopher-lua v1.1.2 // indirect

68 github.com/yuin/gopher-lua v1.1.2 // indirect

72 go.opentelemetry.io/auto/sdk v1.2.1 // indirect

69 go.opentelemetry.io/auto/sdk v1.2.1 // indirect

73− go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect

70+ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect

74− go.opentelemetry.io/otel v1.44.0 // indirect

71+ go.opentelemetry.io/otel v1.45.0 // indirect

75− go.opentelemetry.io/otel/metric v1.44.0 // indirect

72+ go.opentelemetry.io/otel/metric v1.45.0 // indirect

76− go.opentelemetry.io/otel/trace v1.44.0 // indirect

73+ go.opentelemetry.io/otel/trace v1.45.0 // indirect

77 go.uber.org/atomic v1.11.0 // indirect

74 go.uber.org/atomic v1.11.0 // indirect

78− go.yaml.in/yaml/v2 v2.4.4 // indirect

79− golang.org/x/mod v0.36.0 // indirect

75+ golang.org/x/mod v0.40.0 // indirect

80− golang.org/x/sys v0.45.0 // indirect

76+ golang.org/x/sys v0.47.0 // indirect

81− golang.org/x/text v0.37.0 // indirect

77+ golang.org/x/text v0.41.0 // indirect

82− golang.org/x/tools v0.45.0 // indirect

78+ golang.org/x/tools v0.49.0 // indirect

83− google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect

79+ google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect

84− google.golang.org/grpc v1.81.1 // indirect

80+ google.golang.org/grpc v1.83.0 // indirect

85− google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect

81+ google.golang.org/protobuf v1.36.12 // indirect

86 gopkg.in/yaml.v3 v3.0.1 // indirect

82 gopkg.in/yaml.v3 v3.0.1 // indirect

87)

83)

go.sum+79−193

@@ -1,7 +1,5 @@

1−cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=

1+cloud.google.com/go/auth v0.23.1 h1:1tPpBPG02lQHmoiAvs9egyCASqXP0xgobptjZzov/Jg=

2−cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=

2+cloud.google.com/go/auth v0.23.1/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0=

3−cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=

4−cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=

5cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=

3cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=

6cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=

4cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=

7cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=

5cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=

@@ -10,16 +8,12 @@ github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb h1:ZVN4Iat3runWO

10github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb/go.mod h1:WsAABbY4HQBgd3mGuG4KMNTbHJCPvx9IVBHzysbknss=

8github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb/go.mod h1:WsAABbY4HQBgd3mGuG4KMNTbHJCPvx9IVBHzysbknss=

11github.com/FZambia/sentinel v1.0.0 h1:KJ0ryjKTZk5WMp0dXvSdNqp3lFaW1fNFuEYfrkLOYIc=

9github.com/FZambia/sentinel v1.0.0 h1:KJ0ryjKTZk5WMp0dXvSdNqp3lFaW1fNFuEYfrkLOYIc=

12github.com/FZambia/sentinel v1.0.0/go.mod h1:ytL1Am/RLlAoAXG6Kj5LNuw/TRRQrv2rt2FT26vP5gI=

10github.com/FZambia/sentinel v1.0.0/go.mod h1:ytL1Am/RLlAoAXG6Kj5LNuw/TRRQrv2rt2FT26vP5gI=

13−github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=

14−github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

15github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=

11github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=

16github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

12github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

17github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY=

13github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY=

18github.com/a8m/envsubst v1.4.3/go.mod h1:4jjHWQlZoaXPoLQUb7H2qT4iLkZDdmEQiOUogdUmqVU=

14github.com/a8m/envsubst v1.4.3/go.mod h1:4jjHWQlZoaXPoLQUb7H2qT4iLkZDdmEQiOUogdUmqVU=

19github.com/alicebob/gopher-json v0.0.0-20180125190556-5a6b3ba71ee6/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=

15github.com/alicebob/gopher-json v0.0.0-20180125190556-5a6b3ba71ee6/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=

20github.com/alicebob/miniredis/v2 v2.11.1/go.mod h1:UA48pmi7aSazcGAvcdKcBB49z521IC9VjTTRz2nIaJE=

16github.com/alicebob/miniredis/v2 v2.11.1/go.mod h1:UA48pmi7aSazcGAvcdKcBB49z521IC9VjTTRz2nIaJE=

21−github.com/alicebob/miniredis/v2 v2.37.0 h1:RheObYW32G1aiJIj81XVt78ZHJpHonHLHW7OLIshq68=

22−github.com/alicebob/miniredis/v2 v2.37.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

23github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e2uP9jiw=

17github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e2uP9jiw=

24github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

18github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

25github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

19github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

@@ -30,8 +24,6 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=

30github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=

24github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=

31github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=

25github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=

32github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=

26github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=

33−github.com/bsm/redislock v0.9.4 h1:X/Wse1DPpiQgHbVYRE9zv6m070UcKoOGekgvpNhiSvw=

34−github.com/bsm/redislock v0.9.4/go.mod h1:Epf7AJLiSFwLCiZcfi6pWFO/8eAYrYpQXFxEDPoDeAk=

35github.com/bsm/redislock v0.10.0 h1:NAe1OHDnwPmWEzD+LpWBZXAdZrWld/xj/wmqEcQednQ=

27github.com/bsm/redislock v0.10.0 h1:NAe1OHDnwPmWEzD+LpWBZXAdZrWld/xj/wmqEcQednQ=

36github.com/bsm/redislock v0.10.0/go.mod h1:M05WZGjPbX/8ne7LmB7AbOsa2kv7Jzx4fqkLpDFZvJs=

28github.com/bsm/redislock v0.10.0/go.mod h1:M05WZGjPbX/8ne7LmB7AbOsa2kv7Jzx4fqkLpDFZvJs=

37github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

29github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

@@ -39,23 +31,15 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL

39github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=

31github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=

40github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=

32github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=

41github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=

33github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=

42−github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=

34+github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE=

43−github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=

44−github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=

45−github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=

35+github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=

46github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=

36github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=

47github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=

37github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=

48github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

38github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

49−github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=

39+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=

50−github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

40+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=

51−github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=

52−github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=

53−github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=

54−github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=

55github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=

41github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=

56github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=

42github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=

57−github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=

58−github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=

59github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=

43github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=

60github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=

44github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=

61github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=

45github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=

@@ -64,21 +48,17 @@ github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZ

64github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=

48github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=

65github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=

49github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=

66github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=

50github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=

67−github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=

68−github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

69github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=

51github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=

70github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

52github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

71github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=

53github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=

72github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=

54github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=

73github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=

55github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=

74−github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=

56+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=

75−github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

57+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

76github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=

58github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=

77github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=

59github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=

78github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=

60github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=

79github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=

61github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=

80−github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=

81−github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

82github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=

62github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=

83github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

63github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

84github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=

64github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=

@@ -92,38 +72,27 @@ github.com/gomodule/redigo v1.7.1-0.20190322064113-39e2c31b7ca3/go.mod h1:B4C85q

92github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=

72github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=

93github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=

73github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=

94github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=

74github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=

95−github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=

75+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=

96−github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

76+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=

97−github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=

98−github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

99−github.com/google/pprof v0.0.0-20260604005048-7023385849c0 h1:h1QTMDl6q9wDvDCJVpKQSjgleGFYnd2fOxmg2K+6BGE=

100−github.com/google/pprof v0.0.0-20260604005048-7023385849c0/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

101github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=

77github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=

102github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=

78github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=

103github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

79github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

104github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=

80github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=

105github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

81github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

106−github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=

82+github.com/googleapis/enterprise-certificate-proxy v0.3.21 h1:OFdQ3tnCX/zaQ0Cedur3D3z7kI6HiLX9g3TiAN4/DFU=

107−github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=

108−github.com/googleapis/enterprise-certificate-proxy v0.3.16 h1:F/VPrx0YPBdksZJQdCAp0WUsqnNmZpUZszzfYt0M5Dw=

83+github.com/googleapis/enterprise-certificate-proxy v0.3.21/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=

109−github.com/googleapis/enterprise-certificate-proxy v0.3.16/go.mod h1:9Yb0eAkH/Xqhvv3zbeKf/+wMJqCeocWc6KIhDvEAuYE=

110−github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE=

84+github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=

111−github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA=

85+github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=

112−github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI=

113−github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=

114−github.com/googleapis/gax-go/v2 v2.22.0 h1:PjIWBpgGIVKGoCXuiCoP64altEJCj3/Ei+kSU5vlZD4=

115−github.com/googleapis/gax-go/v2 v2.22.0/go.mod h1:irWBbALSr0Sk3qlqb9SyJ1h68WjgeFuiOzI4Rqw5+aY=

116github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=

86github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=

117github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=

87github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=

118github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE=

88github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE=

119github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=

89github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=

120github.com/justinas/alice v1.2.0 h1:+MHSA/vccVCF4Uq37S42jwlkvI2Xzl7zTPCN5BnZNVo=

90github.com/justinas/alice v1.2.0 h1:+MHSA/vccVCF4Uq37S42jwlkvI2Xzl7zTPCN5BnZNVo=

121github.com/justinas/alice v1.2.0/go.mod h1:fN5HRH/reO/zrUflLfTN43t3vXvKzvZIENsNEe7i7qA=

91github.com/justinas/alice v1.2.0/go.mod h1:fN5HRH/reO/zrUflLfTN43t3vXvKzvZIENsNEe7i7qA=

122−github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=

92+github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=

123−github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=

93+github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=

124−github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=

125−github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

126github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=

94github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=

95+github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=

127github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=

96github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=

128github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=

97github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=

129github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=

98github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=

@@ -140,41 +109,25 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq

140github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

109github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

141github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25 h1:9bCMuD3TcnjeqjPT2gSlha4asp8NvgcFRYExCaikCxk=

110github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25 h1:9bCMuD3TcnjeqjPT2gSlha4asp8NvgcFRYExCaikCxk=

142github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25/go.mod h1:eDjgYHYDJbPLBLsyZ6qRaugP0mX8vePOhZ5id1fdzJw=

111github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25/go.mod h1:eDjgYHYDJbPLBLsyZ6qRaugP0mX8vePOhZ5id1fdzJw=

143−github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=

112+github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=

144−github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=

145−github.com/onsi/ginkgo/v2 v2.29.0 h1:rfh+ZFjgJhYWRoIqVf3Uwx/W20yLrcrE2h2GmYVRaag=

146−github.com/onsi/ginkgo/v2 v2.29.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

113+github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

147−github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=

114+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=

148−github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=

115+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=

149−github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=

116+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=

150−github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=

151−github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=

152−github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

153−github.com/pelletier/go-toml/v2 v2.3.0 h1:k59bC/lIZREW0/iVaQR8nDHxVq8OVlIzYCOJf421CaM=

154−github.com/pelletier/go-toml/v2 v2.3.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

155−github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=

156−github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

117+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

157−github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=

118+github.com/pierrec/lz4/v4 v4.1.28 h1:pPEPwRJ4kybBTfGt28q7lQsRJQHhC08axprdLD5Ppio=

158−github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

159−github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk=

160−github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

119+github.com/pierrec/lz4/v4 v4.1.28/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

161github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

120github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

162−github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=

121+github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=

163−github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

164−github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=

165−github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=

122+github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=

166github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=

123github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=

167github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=

124github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=

168−github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=

125+github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=

169−github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=

126+github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=

170−github.com/prometheus/common v0.68.1 h1:omjRRl4QP4komogpXuhfeOiisQg7xdy8VM1UY+pStaY=

127+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=

171−github.com/prometheus/common v0.68.1/go.mod h1:ZzL3f6u94qUxh9p+tJTrF+FvBS1XXbbRAZCQkytAL0Y=

128+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=

172−github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=

129+github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=

173−github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=

174−github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=

175−github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=

130+github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=

176−github.com/redis/go-redis/v9 v9.20.0 h1:WnQYxLkgO2xiXTCJY0ldIiI8dNqCDlQAG+AtaH7a2a0=

177−github.com/redis/go-redis/v9 v9.20.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=

178github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=

131github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=

179github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=

132github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=

180github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=

133github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=

@@ -189,8 +142,8 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=

189github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=

142github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=

190github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

143github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

191github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

144github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

192−github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=

145+github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=

193−github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=

146+github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=

194github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=

147github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=

195github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=

148github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=

196github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=

149github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=

@@ -208,93 +161,57 @@ github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV

208github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=

161github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=

209github.com/yuin/gopher-lua v0.0.0-20190206043414-8bfc7677f583/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

162github.com/yuin/gopher-lua v0.0.0-20190206043414-8bfc7677f583/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

210github.com/yuin/gopher-lua v0.0.0-20191213034115-f46add6fdb5c/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

163github.com/yuin/gopher-lua v0.0.0-20191213034115-f46add6fdb5c/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

211−github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=

212−github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=

213github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=

164github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=

214github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=

165github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=

215−github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=

216−github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=

217github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=

166github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=

167+github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=

218go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=

168go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=

219go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=

169go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=

220−go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=

221−go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=

222go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=

170go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=

223−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=

171+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=

224−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=

225−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=

172+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=

226−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=

173+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=

227−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=

174+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=

228−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=

229−go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=

230−go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=

175+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=

231−go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=

176+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=

232−go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=

177+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=

233−go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=

178+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=

234−go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=

179+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=

235−go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=

180+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=

236−go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=

181+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=

237−go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=

182+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=

238−go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=

183+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=

239−go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=

240−go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=

241−go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=

242−go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=

243−go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=

244−go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=

245−go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=

246−go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=

247−go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=

248−go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=

249−go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=

250−go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=

251−go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=

252−go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=

253−go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=

254−go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=

255go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=

184go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=

256go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=

185go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=

257go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

186go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

258go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=

187go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=

259go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=

188go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=

260go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=

189go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=

261−go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=

190+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=

262−go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=

191+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=

263golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=

192golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=

264golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=

193golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=

265golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=

194golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=

266−golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=

195+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=

267−golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=

196+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=

268−golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=

269−golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=

270−golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=

271−golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=

272golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=

197golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=

273golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=

198golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=

274−golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=

199+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=

275−golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=

200+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=

276−golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=

277−golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=

278−golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=

279−golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=

280golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=

201golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=

281golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=

202golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=

282golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=

203golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=

283golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=

204golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=

284golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=

205golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=

285−golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=

206+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=

286−golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=

207+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=

287−golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=

288−golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=

289−golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=

290−golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=

291golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=

208golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=

292golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=

209golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=

293golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

210golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

294golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

211golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

295golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

212golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

296−golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=

213+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=

297−golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

214+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

298golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

215golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

299golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

216golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

300golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

217golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

@@ -304,12 +221,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc

304golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

221golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

305golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

222golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

306golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

223golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

307−golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=

224+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=

308−golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

309−golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=

310−golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

311−golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=

312−golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

225+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

313golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

226golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

314golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

227golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

315golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=

228golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=

@@ -321,56 +234,31 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=

321golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=

234golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=

322golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=

235golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=

323golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=

236golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=

324−golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=

237+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=

325−golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=

238+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=

326−golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=

327−golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=

328−golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=

329−golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=

330golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=

239golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=

331golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=

240golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=

332golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

241golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

333golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=

242golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=

334golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

243golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

335golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=

244golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=

336−golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=

245+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=

337−golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=

246+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=

338−golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=

339−golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=

340−golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=

341−golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=

342golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

247golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

343−gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=

344−gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=

345gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=

248gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=

346−google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=

249+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=

347−google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=

250+google.golang.org/api v0.293.0 h1:p9XIWOf63U4OgYx120ZwVU8+vl4XTPmWfgVPnmOAS9w=

348−google.golang.org/api v0.275.0 h1:vfY5d9vFVJeWEZT65QDd9hbndr7FyZ2+6mIzGAh71NI=

251+google.golang.org/api v0.293.0/go.mod h1:6n5tjEB1gzwniZTepZ0g5u+wM7Bof5GeULCx/zh8ZE0=

349−google.golang.org/api v0.275.0/go.mod h1:Fnag/EWUPIcJXuIkP1pjoTgS5vdxlk3eeemL7Do6bvw=

350−google.golang.org/api v0.283.0 h1:0lkp8u0MPwJVHqRL+nJlMAoZVVzbmiXmFHXMOTmSPik=

351−google.golang.org/api v0.283.0/go.mod h1:6Wssta4c5n9qHq5CBhmlai5h/PUa1djdDAIhYEHyvcM=

352−google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 h1:JNfk58HZ8lfmXbYK2vx/UvsqIL59TzByCxPIX4TDmsE=

353−google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:x5julN69+ED4PcFk/XWayw35O0lf/nGa4aNgODCmNmw=

354google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=

252google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=

355−google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 h1:CogIeEXn4qWYzzQU0QqvYBM8yDF9cFYzDq9ojSpv0Js=

253+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=

356−google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=

254+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU=

357−google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=

255+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA=

358−google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=

256+google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 h1:utmqiUzZAEINbLmRyAt1QjVkMyLQ+lvIwCpLaB1rZfw=

359−google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

360−google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=

361−google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

362−google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=

363−google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

257+google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

364−google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=

258+google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=

365−google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=

259+google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=

366−google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=

260+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=

367−google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=

368−google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=

369−google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=

370−google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=

371−google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

372−google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=

373−google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

261+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

374gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

262gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

375gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=

263gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=

376gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

264gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

@@ -379,7 +267,5 @@ gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYs

379gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

267gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

380gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

268gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

381gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

269gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

382−k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8=

270+k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=

383−k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=

271+k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=

384−k8s.io/apimachinery v0.36.1 h1:G63Gjx2W+q0YD+72Vo8oY0nDnePVwnuzTmmy5ENrVSA=

385−k8s.io/apimachinery v0.36.1/go.mod h1:ibYOR00vW/I1kzvi5SF0dRuJ52BvKtfvRdOn35GPQ+8=

pkg/apis/options/load_test.go+1−1

@@ -282,7 +282,7 @@ var _ = Describe("Load", func() {

282 Entry("with an invalid config file", &testOptionsTableInput{

283 configFile: []byte(`slice_option = foo`),

284 flagSet: func() *pflag.FlagSet { return testOptionsFlagSet },

285− expectedErr: fmt.Errorf("unable to load config file: While parsing config: toml: expected 'false'"),

285+ expectedErr: fmt.Errorf("unable to load config file: While parsing config: toml: expected keyword \"false\""),

286 expectedOutput: &TestOptions{},

287 }),

288 Entry("with an invalid flagset", &testOptionsTableInput{

pkg/apis/options/providers.go+6

@@ -151,6 +151,9 @@ const (

151 // ADFSProvider is the provider type for ADFS

152 ADFSProvider ProviderType = "adfs"

153

154+ // AtlassianProvider is the provider type for Atlassian Cloud

155+ AtlassianProvider ProviderType = "atlassian"

156+

154 // AzureProvider is the provider type for Azure

157 // AzureProvider is the provider type for Azure

155 AzureProvider ProviderType = "azure"

158 AzureProvider ProviderType = "azure"

156

159

@@ -166,6 +169,9 @@ const (

166 // DigitalOceanProvider is the provider type for DigitalOcean

169 // DigitalOceanProvider is the provider type for DigitalOcean

167 DigitalOceanProvider ProviderType = "digitalocean"

170 DigitalOceanProvider ProviderType = "digitalocean"

168

171

172+ // DTTSSOProvider is the provider type for the DTT SSO

173+ DTTSSOProvider ProviderType = "dtt-sso"

174+

169 // FacebookProvider is the provider type for Facebook

175 // FacebookProvider is the provider type for Facebook

170 FacebookProvider ProviderType = "facebook"

176 FacebookProvider ProviderType = "facebook"

171

177

pkg/apis/options/upstreams.go+7−5

@@ -62,12 +62,14 @@ type Upstream struct {

63 // Path is used to map requests to the upstream server.

64 // The closest match will take precedence and all Paths must be unique.

65− // Path can also take a pattern when used with RewriteTarget.

65+ // Without RewriteTarget, Path follows gorilla/mux route syntax.

66− // Path segments can be captured and matched using regular experessions.

67 // Eg:

66 // Eg:

68− // - `^/foo$`: Match only the explicit path `/foo`

67+ // - `/foo`: Match only the explicit path `/foo`

69− // - `^/bar/$`: Match any path prefixed with `/bar/`

68+ // - `/bar/`: Match any path prefixed with `/bar/`

69+ // - `/baz/{path:.*}`: Match any path prefixed with `/baz/`

70+ // When RewriteTarget is set, Path is treated as a regular expression.

71+ // Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the

70− // - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget

72+ // remaining path for use with RewriteTarget.

71 Path string `yaml:"path,omitempty"`

73 Path string `yaml:"path,omitempty"`

73 // RewriteTarget allows users to rewrite the request path before it is sent to

75 // RewriteTarget allows users to rewrite the request path before it is sent to

providers/atlassian-cloud.gonew file+99

@@ -0,0 +1,99 @@

1+package providers

3+import (

4+ "context"

5+ "errors"

6+ "net/url"

8+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

10+)

11+

12+// AtlassianProvider represents an Atlassian Cloud based Identity Provider

13+type AtlassianProvider struct {

14+ *ProviderData

15+}

16+

17+var _ Provider = (*AtlassianProvider)(nil)

18+

19+const (

20+ atlassianProviderName = "Atlassian"

21+ atlassianDefaultScope = "read:me"

22+ atlassianPrompt = "consent"

23+ atlassianAudience = "api.atlassian.com"

24+)

25+

26+var (

27+ atlassianDefaultLoginURL = &url.URL{

28+ Scheme: "https",

29+ Host: "auth.atlassian.com",

30+ Path: "/authorize",

31+ }

32+

33+ atlassianDefaultRedeemURL = &url.URL{

34+ Scheme: "https",

35+ Host: "auth.atlassian.com",

36+ Path: "/oauth/token",

37+ }

38+

39+ // atlassianDefaultProfileURL returns the signed-in user's profile.

40+ atlassianDefaultProfileURL = &url.URL{

41+ Scheme: "https",

42+ Host: "api.atlassian.com",

43+ Path: "/me",

44+ }

45+)

46+

47+// NewAtlassianProvider initiates a new AtlassianProvider

48+func NewAtlassianProvider(p *ProviderData) *AtlassianProvider {

49+ p.setProviderDefaults(providerDefaults{

50+ name: atlassianProviderName,

51+ loginURL: atlassianDefaultLoginURL,

52+ redeemURL: atlassianDefaultRedeemURL,

53+ profileURL: atlassianDefaultProfileURL,

54+ validateURL: atlassianDefaultProfileURL,

55+ scope: atlassianDefaultScope,

56+ })

57+ return &AtlassianProvider{ProviderData: p}

58+}

59+

60+// GetLoginURL adds the audience and prompt parameters Atlassian requires.

61+func (p *AtlassianProvider) GetLoginURL(redirectURI, state, _ string, extraParams url.Values) string {

62+ params := url.Values{}

63+ for k, v := range extraParams {

64+ params[k] = v

65+ }

66+ params.Del("approval_prompt")

67+ if params.Get("prompt") == "" {

68+ params.Set("prompt", atlassianPrompt)

69+ }

70+ params.Set("audience", atlassianAudience)

71+

72+ loginURL := makeLoginURL(p.ProviderData, redirectURI, state, params)

73+ return loginURL.String()

74+}

75+

76+// EnrichSession sets the session's email from the Atlassian profile.

77+func (p *AtlassianProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {

78+ var profile struct {

79+ Email string `json:"email"`

80+ }

81+ err := requests.New(p.ProfileURL.String()).

82+ WithContext(ctx).

83+ WithHeaders(makeOIDCHeader(s.AccessToken)).

84+ Do().

85+ UnmarshalInto(&profile)

86+ if err != nil {

87+ return err

88+ }

89+ if profile.Email == "" {

90+ return errors.New("no email in Atlassian profile")

91+ }

92+ s.Email = profile.Email

93+ return nil

94+}

95+

96+// ValidateSession validates the AccessToken

97+func (p *AtlassianProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

98+ return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))

99+}

providers/atlassian-cloud_test.gonew file+93

@@ -0,0 +1,93 @@

1+package providers

3+import (

4+ "context"

5+ "net/http"

6+ "net/http/httptest"

7+ "net/url"

8+ "testing"

10+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

11+ . "github.com/onsi/gomega"

12+)

13+

14+func testAtlassianBackend(status int, body string) *httptest.Server {

15+ return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

16+ if r.URL.Path != "/me" || r.Header.Get("Authorization") != "Bearer imaginary_access_token" {

17+ w.WriteHeader(http.StatusUnauthorized)

18+ return

19+ }

20+ w.WriteHeader(status)

21+ _, _ = w.Write([]byte(body))

22+ }))

23+}

24+

25+func testAtlassianProvider(backend *httptest.Server) *AtlassianProvider {

26+ p := NewAtlassianProvider(&ProviderData{})

27+ u, _ := url.Parse(backend.URL)

28+ updateURL(p.ProfileURL, u.Host)

29+ updateURL(p.ValidateURL, u.Host)

30+ return p

31+}

32+

33+func TestNewAtlassianProvider(t *testing.T) {

34+ g := NewWithT(t)

35+

36+ providerData := NewAtlassianProvider(&ProviderData{}).Data()

37+ g.Expect(providerData.ProviderName).To(Equal("Atlassian"))

38+ g.Expect(providerData.LoginURL.String()).To(Equal("https://auth.atlassian.com/authorize"))

39+ g.Expect(providerData.RedeemURL.String()).To(Equal("https://auth.atlassian.com/oauth/token"))

40+ g.Expect(providerData.ProfileURL.String()).To(Equal("https://api.atlassian.com/me"))

41+ g.Expect(providerData.ValidateURL.String()).To(Equal("https://api.atlassian.com/me"))

42+ g.Expect(providerData.Scope).To(Equal("read:me"))

43+}

44+

45+func TestAtlassianProviderGetLoginURL(t *testing.T) {

46+ g := NewWithT(t)

47+ p := NewAtlassianProvider(&ProviderData{ClientID: "client"})

48+

49+ loginURL, err := url.Parse(p.GetLoginURL("https://proxy/oauth2/callback", "state", "",

50+ url.Values{"approval_prompt": {"force"}}))

51+ g.Expect(err).ToNot(HaveOccurred())

52+

53+ q := loginURL.Query()

54+ g.Expect(q.Get("audience")).To(Equal("api.atlassian.com"))

55+ g.Expect(q.Get("prompt")).To(Equal("consent"))

56+ g.Expect(q.Has("approval_prompt")).To(BeFalse())

57+ g.Expect(q.Get("scope")).To(Equal("read:me"))

58+

59+ loginURL, err = url.Parse(p.GetLoginURL("https://proxy/oauth2/callback", "state", "",

60+ url.Values{"prompt": {"login"}}))

61+ g.Expect(err).ToNot(HaveOccurred())

62+ g.Expect(loginURL.Query().Get("prompt")).To(Equal("login"))

63+}

64+

65+func TestAtlassianProviderEnrichSession(t *testing.T) {

66+ g := NewWithT(t)

67+ b := testAtlassianBackend(http.StatusOK, `{"account_id":"abc","email":"user@example.com"}`)

68+ defer b.Close()

69+ p := testAtlassianProvider(b)

70+

71+ session := CreateAuthorizedSession()

72+ g.Expect(p.EnrichSession(context.Background(), session)).To(Succeed())

73+ g.Expect(session.Email).To(Equal("user@example.com"))

74+}

75+

76+func TestAtlassianProviderEnrichSessionWithoutEmail(t *testing.T) {

77+ g := NewWithT(t)

78+ b := testAtlassianBackend(http.StatusOK, `{"account_id":"abc"}`)

79+ defer b.Close()

80+ p := testAtlassianProvider(b)

81+

82+ g.Expect(p.EnrichSession(context.Background(), CreateAuthorizedSession())).ToNot(Succeed())

83+}

84+

85+func TestAtlassianProviderValidateSession(t *testing.T) {

86+ g := NewWithT(t)

87+ b := testAtlassianBackend(http.StatusOK, `{"email":"user@example.com"}`)

88+ defer b.Close()

89+ p := testAtlassianProvider(b)

90+

91+ g.Expect(p.ValidateSession(context.Background(), CreateAuthorizedSession())).To(BeTrue())

92+ g.Expect(p.ValidateSession(context.Background(), &sessions.SessionState{AccessToken: "wrong"})).To(BeFalse())

93+}

providers/dtt_sso.gonew file+202

@@ -0,0 +1,202 @@

1+package providers

3+import (

4+ "bytes"

5+ "context"

6+ "encoding/base64"

7+ "errors"

8+ "fmt"

9+ "net/http"

10+ "net/url"

11+ "time"

12+

13+ "github.com/golang-jwt/jwt/v5"

14+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

15+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

16+)

17+

18+// DTTSSOProvider signs users in with the DTT SSO (auth-server).

19+type DTTSSOProvider struct {

20+ *ProviderData

21+}

22+

23+var _ Provider = (*DTTSSOProvider)(nil)

24+

25+const (

26+ dttSSOProviderName = "DTT SSO"

27+ dttSSODefaultScope = "openid"

28+)

29+

30+var (

31+ dttSSODefaultLoginURL = &url.URL{

32+ Scheme: "https",

33+ Host: "auth.thebestagent.pro",

34+ Path: "/oauth/authorize",

35+ }

36+

37+ dttSSODefaultRedeemURL = &url.URL{

38+ Scheme: "https",

39+ Host: "auth.thebestagent.pro",

40+ Path: "/oauth/token",

41+ }

42+

43+ dttSSODefaultValidateURL = &url.URL{

44+ Scheme: "https",

45+ Host: "auth.thebestagent.pro",

46+ Path: "/oauth/check_token",

47+ }

48+)

49+

50+// NewDTTSSOProvider initiates a new DTTSSOProvider

51+func NewDTTSSOProvider(p *ProviderData) *DTTSSOProvider {

52+ p.setProviderDefaults(providerDefaults{

53+ name: dttSSOProviderName,

54+ loginURL: dttSSODefaultLoginURL,

55+ redeemURL: dttSSODefaultRedeemURL,

56+ profileURL: nil,

57+ validateURL: dttSSODefaultValidateURL,

58+ scope: dttSSODefaultScope,

59+ })

60+ return &DTTSSOProvider{ProviderData: p}

61+}

62+

63+// dttSSOTokenResponse is the SSO's /oauth/token response.

64+type dttSSOTokenResponse struct {

65+ AccessToken string `json:"access_token"`

66+ RefreshToken string `json:"refresh_token"`

67+ ExpiresIn int64 `json:"expires_in"`

68+ IDToken string `json:"id_token"`

69+}

70+

71+// dttSSOClaims holds the id_token claims the provider uses.

72+type dttSSOClaims struct {

73+ jwt.RegisteredClaims

74+ Email string `json:"email"`

75+ Role string `json:"role"`

76+ UserID string `json:"user_id"`

77+}

78+

79+// Redeem exchanges the authorization code for a session.

80+func (p *DTTSSOProvider) Redeem(ctx context.Context, redirectURL, code, _ string) (*sessions.SessionState, error) {

81+ if code == "" {

82+ return nil, ErrMissingCode

83+ }

84+ return p.requestTokens(ctx, url.Values{

85+ "grant_type": {"authorization_code"},

86+ "code": {code},

87+ "redirect_uri": {redirectURL},

88+ })

89+}

90+

91+// RefreshSession renews the tokens and re-reads the email and role.

92+func (p *DTTSSOProvider) RefreshSession(ctx context.Context, s *sessions.SessionState) (bool, error) {

93+ if s == nil || s.RefreshToken == "" {

94+ return false, nil

95+ }

96+ refreshed, err := p.requestTokens(ctx, url.Values{

97+ "grant_type": {"refresh_token"},

98+ "refresh_token": {s.RefreshToken},

99+ })

100+ if err != nil {

101+ return false, fmt.Errorf("unable to redeem refresh token: %v", err)

102+ }

103+ s.AccessToken = refreshed.AccessToken

104+ s.RefreshToken = refreshed.RefreshToken

105+ s.IDToken = refreshed.IDToken

106+ s.Email = refreshed.Email

107+ s.User = refreshed.User

108+ s.Groups = refreshed.Groups

109+ s.CreatedAt = refreshed.CreatedAt

110+ s.ExpiresOn = refreshed.ExpiresOn

111+ return true, nil

112+}

113+

114+// ValidateSession checks the access token with the SSO's check_token endpoint.

115+func (p *DTTSSOProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

116+ return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))

117+}

118+

119+// requestTokens calls the token endpoint and builds a session from the verified id_token.

120+//

121+// The SSO compares the Basic credentials byte for byte, so they are sent unescaped

122+// rather than through golang.org/x/oauth2, which URL-escapes them.

123+func (p *DTTSSOProvider) requestTokens(ctx context.Context, params url.Values) (*sessions.SessionState, error) {

124+ clientSecret, err := p.GetClientSecret()

125+ if err != nil {

126+ return nil, err

127+ }

128+ credentials := base64.StdEncoding.EncodeToString([]byte(p.ClientID + ":" + clientSecret))

129+

130+ result := requests.New(p.RedeemURL.String()).

131+ WithContext(ctx).

132+ WithMethod(http.MethodPost).

133+ WithBody(bytes.NewBufferString(params.Encode())).

134+ SetHeader("Content-Type", "application/x-www-form-urlencoded").

135+ SetHeader("Authorization", "Basic "+credentials).

136+ Do()

137+ if result.Error() != nil {

138+ return nil, result.Error()

139+ }

140+ if result.StatusCode() != http.StatusOK {

141+ return nil, fmt.Errorf("token request failed: status %d - %s", result.StatusCode(), result.Body())

142+ }

143+

144+ var token dttSSOTokenResponse

145+ if err := result.UnmarshalInto(&token); err != nil {

146+ return nil, err

147+ }

148+ if token.AccessToken == "" {

149+ return nil, errors.New("token response carried no access_token")

150+ }

151+ claims, err := p.verifyIDToken(token.IDToken, clientSecret)

152+ if err != nil {

153+ return nil, err

154+ }

155+

156+ s := &sessions.SessionState{

157+ AccessToken: token.AccessToken,

158+ RefreshToken: token.RefreshToken,

159+ IDToken: token.IDToken,

160+ Email: claims.Email,

161+ User: claims.UserID,

162+ }

163+ if claims.Role != "" {

164+ s.Groups = []string{claims.Role}

165+ }

166+ s.CreatedAtNow()

167+ if token.ExpiresIn > 0 {

168+ s.ExpiresIn(time.Duration(token.ExpiresIn) * time.Second)

169+ }

170+ return s, nil

171+}

172+

173+// verifyIDToken checks the id_token's HS256 signature (keyed on the client secret),

174+// issuer, audience and expiry.

175+//

176+// go-jose is not used: it rejects HMAC keys under 32 bytes, and SSO client secrets

177+// can be shorter.

178+func (p *DTTSSOProvider) verifyIDToken(raw, clientSecret string) (*dttSSOClaims, error) {

179+ if raw == "" {

180+ return nil, errors.New("token response carried no id_token; the scope must be exactly \"openid\"")

181+ }

182+ var claims dttSSOClaims

183+ _, err := jwt.ParseWithClaims(raw, &claims,

184+ func(*jwt.Token) (any, error) { return []byte(clientSecret), nil },

185+ jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),

186+ jwt.WithIssuer(p.issuer()),

187+ jwt.WithAudience(p.ClientID),

188+ jwt.WithExpirationRequired(),

189+ )

190+ if err != nil {

191+ return nil, fmt.Errorf("verifying id_token: %v", err)

192+ }

193+ if claims.Email == "" {

194+ return nil, errors.New("id_token carries no email")

195+ }

196+ return &claims, nil

197+}

198+

199+// issuer is the SSO's site host, the origin of the login URL.

200+func (p *DTTSSOProvider) issuer() string {

201+ return p.LoginURL.Scheme + "://" + p.LoginURL.Host

202+}

providers/dtt_sso_test.gonew file+237

@@ -0,0 +1,237 @@

1+package providers

3+import (

4+ "context"

5+ "encoding/base64"

6+ "encoding/json"

7+ "net/http"

8+ "net/http/httptest"

9+ "net/url"

10+ "testing"

11+ "time"

12+

13+ "github.com/golang-jwt/jwt/v5"

14+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

15+ . "github.com/onsi/gomega"

16+)

17+

18+const (

19+ dttSSOTestClientID = "redash-gate"

20+ // Shorter than 32 bytes, and contains characters golang.org/x/oauth2 would

21+ // URL-escape in Basic auth.

22+ dttSSOTestSecret = "s3cr+t/abc=="

23+)

24+

25+// dttSSOTestServer mimics the SSO's token and check_token endpoints.

26+type dttSSOTestServer struct {

27+ *httptest.Server

28+ claims map[string]interface{}

29+ signingKey []byte

30+ lastForm url.Values

31+ validTokens map[string]bool

32+ tokenCounter int

33+}

34+

35+func newDTTSSOTestServer() *dttSSOTestServer {

36+ s := &dttSSOTestServer{

37+ signingKey: []byte(dttSSOTestSecret),

38+ validTokens: map[string]bool{},

39+ }

40+ s.Server = httptest.NewServer(http.HandlerFunc(s.handle))

41+ u, _ := url.Parse(s.URL)

42+ s.claims = map[string]interface{}{

43+ "iss": "http://" + u.Host,

44+ "aud": dttSSOTestClientID,

45+ "sub": "0b5c1e1a-1111-2222-3333-444455556666",

46+ "user_id": "0b5c1e1a-1111-2222-3333-444455556666",

47+ "email": "admin@example.com",

48+ "role": "dtt_admin",

49+ "exp": time.Now().Add(time.Hour).Unix(),

50+ }

51+ return s

52+}

53+

54+func (s *dttSSOTestServer) handle(w http.ResponseWriter, r *http.Request) {

55+ switch r.URL.Path {

56+ case "/oauth/token":

57+ want := "Basic " + base64.StdEncoding.EncodeToString([]byte(dttSSOTestClientID+":"+dttSSOTestSecret))

58+ if r.Header.Get("Authorization") != want {

59+ w.WriteHeader(http.StatusUnauthorized)

60+ return

61+ }

62+ _ = r.ParseForm()

63+ s.lastForm = r.PostForm

64+ if r.PostForm.Get("grant_type") == "refresh_token" && !s.validTokens["refresh-"+r.PostForm.Get("refresh_token")] {

65+ w.WriteHeader(http.StatusBadRequest)

66+ _, _ = w.Write([]byte(`{"error":"invalid_grant","error_description":"Invalid refresh token"}`))

67+ return

68+ }

69+ s.tokenCounter++

70+ access := "access-" + string(rune('0'+s.tokenCounter))

71+ refresh := "refresh-" + string(rune('0'+s.tokenCounter))

72+ s.validTokens[access] = true

73+ s.validTokens["refresh-"+refresh] = true

74+ w.Header().Set("Content-Type", "application/json")

75+ _ = json.NewEncoder(w).Encode(map[string]interface{}{

76+ "access_token": access,

77+ "token_type": "bearer",

78+ "expires_in": 3600,

79+ "refresh_token": refresh,

80+ "id_token": s.idToken(),

81+ "scope": "openid",

82+ })

83+ case "/oauth/check_token":

84+ token := r.Header.Get("Authorization")

85+ if len(token) > len("Bearer ") && s.validTokens[token[len("Bearer "):]] {

86+ _, _ = w.Write([]byte(`{"user_id":"0b5c1e1a-1111-2222-3333-444455556666","real_user_id":null,"issued_by":"redash-gate"}`))

87+ return

88+ }

89+ w.WriteHeader(http.StatusUnauthorized)

90+ _, _ = w.Write([]byte("Invalid access token"))

91+ default:

92+ w.WriteHeader(http.StatusNotFound)

93+ }

94+}

95+

96+func (s *dttSSOTestServer) idToken() string {

97+ if s.claims == nil {

98+ return ""

99+ }

100+ raw, err := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims(s.claims)).SignedString(s.signingKey)

101+ if err != nil {

102+ panic(err)

103+ }

104+ return raw

105+}

106+

107+func testDTTSSOProvider(server *dttSSOTestServer) *DTTSSOProvider {

108+ p := NewDTTSSOProvider(&ProviderData{ClientID: dttSSOTestClientID, ClientSecret: dttSSOTestSecret})

109+ u, _ := url.Parse(server.URL)

110+ updateURL(p.LoginURL, u.Host)

111+ updateURL(p.RedeemURL, u.Host)

112+ updateURL(p.ValidateURL, u.Host)

113+ return p

114+}

115+

116+func TestNewDTTSSOProvider(t *testing.T) {

117+ g := NewWithT(t)

118+

119+ providerData := NewDTTSSOProvider(&ProviderData{}).Data()

120+ g.Expect(providerData.ProviderName).To(Equal("DTT SSO"))

121+ g.Expect(providerData.LoginURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/authorize"))

122+ g.Expect(providerData.RedeemURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/token"))

123+ g.Expect(providerData.ValidateURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/check_token"))

124+ g.Expect(providerData.Scope).To(Equal("openid"))

125+}

126+

127+func TestDTTSSOProviderRedeem(t *testing.T) {

128+ g := NewWithT(t)

129+ server := newDTTSSOTestServer()

130+ defer server.Close()

131+ p := testDTTSSOProvider(server)

132+

133+ s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

134+ g.Expect(err).ToNot(HaveOccurred())

135+ g.Expect(s.Email).To(Equal("admin@example.com"))

136+ g.Expect(s.User).To(Equal("0b5c1e1a-1111-2222-3333-444455556666"))

137+ g.Expect(s.Groups).To(Equal([]string{"dtt_admin"}))

138+ g.Expect(s.AccessToken).To(Equal("access-1"))

139+ g.Expect(s.RefreshToken).To(Equal("refresh-1"))

140+ g.Expect(s.IDToken).ToNot(BeEmpty())

141+ g.Expect(s.ExpiresOn).ToNot(BeNil())

142+ g.Expect(*s.ExpiresOn).To(BeTemporally("~", time.Now().Add(time.Hour), time.Minute))

143+

144+ g.Expect(server.lastForm.Get("grant_type")).To(Equal("authorization_code"))

145+ g.Expect(server.lastForm.Get("code")).To(Equal("the-code"))

146+ g.Expect(server.lastForm.Get("redirect_uri")).To(Equal("https://redash.example.com/oauth2/callback"))

147+}

148+

149+func TestDTTSSOProviderRedeemRejectsBadIDTokens(t *testing.T) {

150+ testCases := map[string]func(s *dttSSOTestServer){

151+ "signed with another secret": func(s *dttSSOTestServer) { s.signingKey = []byte("some-other-client-secret") },

152+ "other audience": func(s *dttSSOTestServer) { s.claims["aud"] = "frappe-gate" },

153+ "other issuer": func(s *dttSSOTestServer) { s.claims["iss"] = "https://evil.example.com" },

154+ "expired": func(s *dttSSOTestServer) { s.claims["exp"] = time.Now().Add(-time.Minute).Unix() },

155+ "no email": func(s *dttSSOTestServer) { delete(s.claims, "email") },

156+ "no id_token": func(s *dttSSOTestServer) { s.claims = nil },

157+ }

158+ for name, tamper := range testCases {

159+ t.Run(name, func(t *testing.T) {

160+ g := NewWithT(t)

161+ server := newDTTSSOTestServer()

162+ defer server.Close()

163+ tamper(server)

164+

165+ _, err := testDTTSSOProvider(server).Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

166+ g.Expect(err).To(HaveOccurred())

167+ })

168+ }

169+}

170+

171+func TestDTTSSOProviderRedeemRejectsUnsignedIDToken(t *testing.T) {

172+ g := NewWithT(t)

173+ server := newDTTSSOTestServer()

174+ defer server.Close()

175+ p := testDTTSSOProvider(server)

176+

177+ header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none"}`))

178+ payload, _ := json.Marshal(server.claims)

179+ unsigned := header + "." + base64.RawURLEncoding.EncodeToString(payload) + "."

180+

181+ _, err := p.verifyIDToken(unsigned, dttSSOTestSecret)

182+ g.Expect(err).To(HaveOccurred())

183+}

184+

185+func TestDTTSSOProviderRefreshSession(t *testing.T) {

186+ g := NewWithT(t)

187+ server := newDTTSSOTestServer()

188+ defer server.Close()

189+ p := testDTTSSOProvider(server)

190+

191+ s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

192+ g.Expect(err).ToNot(HaveOccurred())

193+ nonce := []byte("keep-me")

194+ s.Nonce = nonce

195+

196+ server.claims["role"] = "agent"

197+ server.claims["email"] = "renamed@example.com"

198+ refreshed, err := p.RefreshSession(context.Background(), s)

199+ g.Expect(err).ToNot(HaveOccurred())

200+ g.Expect(refreshed).To(BeTrue())

201+ g.Expect(s.AccessToken).To(Equal("access-2"))

202+ g.Expect(s.RefreshToken).To(Equal("refresh-2"))

203+ g.Expect(s.Groups).To(Equal([]string{"agent"}))

204+ g.Expect(s.Email).To(Equal("renamed@example.com"))

205+ g.Expect(s.Nonce).To(Equal(nonce))

206+ g.Expect(server.lastForm.Get("grant_type")).To(Equal("refresh_token"))

207+ g.Expect(server.lastForm.Get("refresh_token")).To(Equal("refresh-1"))

208+}

209+

210+func TestDTTSSOProviderRefreshSessionFailures(t *testing.T) {

211+ g := NewWithT(t)

212+ server := newDTTSSOTestServer()

213+ defer server.Close()

214+ p := testDTTSSOProvider(server)

215+

216+ refreshed, err := p.RefreshSession(context.Background(), &sessions.SessionState{})

217+ g.Expect(err).ToNot(HaveOccurred())

218+ g.Expect(refreshed).To(BeFalse())

219+

220+ refreshed, err = p.RefreshSession(context.Background(), &sessions.SessionState{RefreshToken: "revoked"})

221+ g.Expect(err).To(HaveOccurred())

222+ g.Expect(refreshed).To(BeFalse())

223+}

224+

225+func TestDTTSSOProviderValidateSession(t *testing.T) {

226+ g := NewWithT(t)

227+ server := newDTTSSOTestServer()

228+ defer server.Close()

229+ p := testDTTSSOProvider(server)

230+

231+ s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

232+ g.Expect(err).ToNot(HaveOccurred())

233+ g.Expect(p.ValidateSession(context.Background(), s)).To(BeTrue())

234+

235+ delete(server.validTokens, s.AccessToken)

236+ g.Expect(p.ValidateSession(context.Background(), s)).To(BeFalse())

237+}

providers/providers.go+7−3

@@ -40,6 +40,8 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

40 switch providerConfig.Type {

41 case options.ADFSProvider:

42 return NewADFSProvider(providerData, providerConfig), nil

43+ case options.AtlassianProvider:

44+ return NewAtlassianProvider(providerData), nil

43 case options.AzureProvider:

45 case options.AzureProvider:

44 return NewAzureProvider(providerData, providerConfig.AzureConfig), nil

46 return NewAzureProvider(providerData, providerConfig.AzureConfig), nil

45 case options.MicrosoftEntraIDProvider:

47 case options.MicrosoftEntraIDProvider:

@@ -50,6 +52,8 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

50 return NewCIDAASProvider(providerData, providerConfig), nil

52 return NewCIDAASProvider(providerData, providerConfig), nil

51 case options.DigitalOceanProvider:

53 case options.DigitalOceanProvider:

52 return NewDigitalOceanProvider(providerData), nil

54 return NewDigitalOceanProvider(providerData), nil

55+ case options.DTTSSOProvider:

56+ return NewDTTSSOProvider(providerData), nil

53 case options.FacebookProvider:

57 case options.FacebookProvider:

54 return NewFacebookProvider(providerData), nil

58 return NewFacebookProvider(providerData), nil

55 case options.GitHubProvider:

59 case options.GitHubProvider:

@@ -189,9 +193,9 @@ func parseCodeChallengeMethod(providerConfig options.Provider) string {

189

193

190func providerRequiresOIDCProviderVerifier(providerType options.ProviderType) (bool, error) {

194func providerRequiresOIDCProviderVerifier(providerType options.ProviderType) (bool, error) {

191 switch providerType {

195 switch providerType {

192− case options.BitbucketProvider, options.DigitalOceanProvider, options.FacebookProvider, options.GitHubProvider,

196+ case options.AtlassianProvider, options.BitbucketProvider, options.DigitalOceanProvider, options.DTTSSOProvider,

193− options.GoogleProvider, options.KeycloakProvider, options.LinkedInProvider, options.LoginGovProvider,

197+ options.FacebookProvider, options.GitHubProvider, options.GoogleProvider, options.KeycloakProvider,

194− options.NextCloudProvider, options.SourceHutProvider:

198+ options.LinkedInProvider, options.LoginGovProvider, options.NextCloudProvider, options.SourceHutProvider:

195 return false, nil

199 return false, nil

196 case options.OIDCProvider, options.ADFSProvider, options.AzureProvider, options.CidaasProvider,

200 case options.OIDCProvider, options.ADFSProvider, options.AzureProvider, options.CidaasProvider,

197 options.GitLabProvider, options.KeycloakOIDCProvider, options.MicrosoftEntraIDProvider:

201 options.GitLabProvider, options.KeycloakOIDCProvider, options.MicrosoftEntraIDProvider: