9a14186...master · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

53 files changed+1240−389

since splitsnapshots

unifiedsplit

.devcontainer/Dockerfile+1−1

@@ -1,4 +1,4 @@

1−FROM mcr.microsoft.com/vscode/devcontainers/go:1-1.25

1+FROM mcr.microsoft.com/vscode/devcontainers/go:1-1.26

33SHELL ["/bin/bash", "-o", "pipefail", "-c"]

.github/ISSUE_TEMPLATE/config.yml+2−2

@@ -1,6 +1,6 @@

11blank_issues_enabled: false

22contact_links:

3− - name: OAuth2-Proxy Slack

4− url: https://gophers.slack.com/messages/CM2RSS25N

3+ - name: OAuth2 Proxy Slack

4+ url: https://cloud-native.slack.com/archives/C098Y5URZ2N

55 about: Feel free to ask any questions here.

.github/renovate.json5+9

@@ -46,6 +46,15 @@

4646 depNameTemplate: "alpine",

4747 datasourceTemplate: "docker",

4848 },

49+ {

50+ customType: "regex",

51+ fileMatch: [

52+ "^Makefile",

53+ ],

54+ matchStrings: [

55+ "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+?GOLANGCILINT_VERSION \\?= (?<currentValue>.*)\\s",

56+ ],

57+ },

4958 {

5059 customType: "regex",

5160 fileMatch: ["(^|/)\\.github/workflows/[^/]+\\.ya?ml$"],

.github/workflows/ci.yml+8−14

@@ -19,7 +19,7 @@ jobs:

1919 runs-on: ubuntu-latest

2020 steps:

2121 - name: Check out code

22− uses: actions/checkout@v6

22+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

2323 with:

2424 fetch-depth: 0

2525

@@ -30,17 +30,11 @@ jobs:

3030 id: go-version

3131

3232 - name: Set up Go

33− uses: actions/setup-go@v6

33+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

3434 with:

3535 go-version: ${{ steps.go-version.outputs.version }}

3636 check-latest: true

3737

38− - name: Install golangci-lint

39− uses: golangci/golangci-lint-action@v9

40− with:

41− install-only: true

42− version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint

43−

4438 - name: Verify Code Generation

4539 run: |

4640 make verify-generate

@@ -74,14 +68,14 @@ jobs:

7468

7569 - name: Upload Coverage Report

7670 if: github.event_name == 'push'

77− uses: qltysh/qlty-action/coverage@v2

71+ uses: qltysh/qlty-action/coverage@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0

7872 with:

7973 oidc: true

8074 files: lcov.info

8175

8276 - name: Run Trivy vulnerability scanner

8377 if: (!startsWith(github.head_ref, 'release'))

84− uses: aquasecurity/trivy-action@0.35.0

78+ uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0

8579 with:

8680 scan-type: 'rootfs'

8781 scan-ref: './oauth2-proxy'

@@ -93,7 +87,7 @@ jobs:

9387

9488 - name: Upload Trivy scan results

9589 if: (!startsWith(github.head_ref, 'release'))

96− uses: github/codeql-action/upload-sarif@v4

90+ uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

9791 with:

9892 sarif_file: 'trivy-results.sarif'

9993

@@ -101,16 +95,16 @@ jobs:

10195 runs-on: ubuntu-latest

10296 steps:

10397 - name: Check out code

104− uses: actions/checkout@v6

98+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

10599 with:

106100 fetch-depth: 0

107101

108102 - name: Set up QEMU

109− uses: docker/setup-qemu-action@v3

103+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

110104

111105 - name: Set up Docker Buildx

112106 id: buildx

113− uses: docker/setup-buildx-action@v3

107+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

114108

115109 - name: Docker Build

116110 if: (!startsWith(github.head_ref, 'release'))

.github/workflows/codeql.yml+4−4

@@ -32,18 +32,18 @@ jobs:

3232

3333 steps:

3434 - name: Checkout repository

35− uses: actions/checkout@v6

35+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

3636

3737 # Initializes the CodeQL tools for scanning.

3838 - name: Initialize CodeQL

39− uses: github/codeql-action/init@v3

39+ uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

4040 with:

4141 languages: go

4242

4343 # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).

4444 # If this step fails, then you should remove it and run the build manually (see below)

4545 - name: Autobuild

46− uses: github/codeql-action/autobuild@v3

46+ uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

4747

4848 # ℹ️ Command-line programs to run using the OS shell.

4949 # 📚 https://git.io/JvXDl

@@ -57,4 +57,4 @@ jobs:

5757 # make release

5858

5959 - name: Perform CodeQL Analysis

60− uses: github/codeql-action/analyze@v3

60+ uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

.github/workflows/create-release.yml+2−2

@@ -17,7 +17,7 @@ jobs:

1717 runs-on: ubuntu-latest

1818 steps:

1919 - name: Check out code

20− uses: actions/checkout@v6

20+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

2121 with:

2222 ref: master

2323 fetch-depth: 0

@@ -54,7 +54,7 @@ jobs:

5454 git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"

5555

5656 - name: Setup node

57− uses: actions/setup-node@v6

57+ uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

5858 with:

5959 node-version-file: docs/package.json

6060

.github/workflows/docs.yml+7−7

@@ -14,13 +14,13 @@ jobs:

1414 if: github.event_name == 'pull_request'

1515 runs-on: ubuntu-latest

1616 steps:

17− - uses: actions/checkout@v6

17+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

1818

1919 - name: Setup Pages

2020 id: pages

21− uses: actions/configure-pages@v5

21+ uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

2222

23− - uses: actions/setup-node@v6

23+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

2424 with:

2525 # renovate: datasource=node-version depName=node

2626 node-version: 24

@@ -35,9 +35,9 @@ jobs:

3535 if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'

3636 runs-on: ubuntu-latest

3737 steps:

38− - uses: actions/checkout@v6

38+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

3939

40− - uses: actions/setup-node@v6

40+ - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

4141 with:

4242 # renovate: datasource=node-version depName=node

4343 node-version: 24

@@ -49,7 +49,7 @@ jobs:

4949 npm run build

5050

5151 - name: Upload artifact

52− uses: actions/upload-pages-artifact@v3

52+ uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0

5353 with:

5454 path: ./docs/build

5555

@@ -65,4 +65,4 @@ jobs:

6565 steps:

6666 - name: Deploy to GitHub Pages

6767 id: deployment

68− uses: actions/deploy-pages@v4

68+ uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/labeler.yml+1−1

@@ -9,7 +9,7 @@ jobs:

99 pull-requests: write

1010 runs-on: ubuntu-latest

1111 steps:

12− - uses: actions/labeler@v6

12+ - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0

1313 with:

1414 sync-labels: true

1515 dot: true

.github/workflows/nightly.yml+4−4

@@ -12,21 +12,21 @@ jobs:

1212 if: github.repository == 'oauth2-proxy/oauth2-proxy'

1313 steps:

1414 - name: Check out code

15− uses: actions/checkout@v6

15+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

1616 with:

1717 ref: master

1818 fetch-depth: 0

1919 fetch-tags: true

2020

2121 - name: Set up QEMU

22− uses: docker/setup-qemu-action@v3

22+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

2323

2424 - name: Set up Docker Buildx

2525 id: buildx

26− uses: docker/setup-buildx-action@v3

26+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

2727

2828 - name: Login to quay.io

29− uses: docker/login-action@v3

29+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

3030 with:

3131 registry: quay.io/oauth2-proxy

3232 username: ${{ secrets.REGISTRY_USERNAME_NIGHTLY }}

.github/workflows/publish-release.yml+7−13

@@ -20,7 +20,7 @@ jobs:

2020 tag: ${{ steps.tag.outputs.version }}

2121 steps:

2222 - name: Check out code

23− uses: actions/checkout@v6

23+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

2424 with:

2525 ref: ${{ github.event.pull_request.merge_commit_sha }}

2626 fetch-depth: 0

@@ -50,17 +50,11 @@ jobs:

5050 id: go-version

5151

5252 - name: Set up Go

53− uses: actions/setup-go@v6

53+ uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

5454 with:

5555 go-version: ${{ steps.go-version.outputs.version }}

5656 check-latest: true

5757

58− - name: Install golangci-lint

59− uses: golangci/golangci-lint-action@v9

60− with:

61− install-only: true

62− version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint

63−

6458 - name: Get go dependencies

6559 run: |

6660 go mod download

@@ -70,7 +64,7 @@ jobs:

7064

7165 # Upload artifacts in case of workflow failure

7266 - name: Upload Artifacts

73− uses: actions/upload-artifact@v7

67+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

7468 with:

7569 name: oauth2-proxy-artifacts

7670 path: |

@@ -106,21 +100,21 @@ jobs:

106100 runs-on: ubuntu-latest

107101 steps:

108102 - name: Check out code

109− uses: actions/checkout@v6

103+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

110104 with:

111105 ref: ${{ needs.publish.outputs.tag }}

112106 fetch-depth: 0

113107 fetch-tags: true

114108

115109 - name: Set up QEMU

116− uses: docker/setup-qemu-action@v3

110+ uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

117111

118112 - name: Set up Docker Buildx

119113 id: buildx

120− uses: docker/setup-buildx-action@v3

114+ uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

121115

122116 - name: Login to quay.io

123− uses: docker/login-action@v3

117+ uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

124118 with:

125119 registry: quay.io/oauth2-proxy

126120 username: ${{ secrets.REGISTRY_USERNAME }}

.github/workflows/stale.yml+1−1

@@ -10,7 +10,7 @@ jobs:

1010 runs-on: ubuntu-latest

1111

1212 steps:

13− - uses: actions/stale@v10

13+ - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0

1414 with:

1515 repo-token: ${{ secrets.GITHUB_TOKEN }}

1616 days-before-stale: 180

CHANGELOG.md+54

@@ -6,8 +6,62 @@

77## Breaking Changes

9+## Changes since v7.15.4

10+

11+# V7.15.4

12+

13+## Release Highlights

14+

15+- 🔵 Golang version upgrade to v1.26.7

16+ - Upgrade of all dependencies to their latest versions

17+- 🕵️‍♀️ Vulnerabilities have been addressed

18+ - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818)

19+ - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821)

20+ - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822)

21+ - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505)

22+ - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600)

23+ - [CVE-2026-56852](https://nvd.nist.gov/vuln/detail/CVE-2026-56852)

24+ - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853)

25+ - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858)

26+ - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859)

27+ - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860)

28+ - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862)

29+

30+## Important Notes

31+

32+## Breaking Changes

33+

34+## Changes since v7.15.3

35+

36+- [#3493](https://github.com/oauth2-proxy/oauth2-proxy/pull/3493) chore(deps): update gomod @tuunit

37+

38+# V7.15.3

39+

40+## Release Highlights

41+

42+- 🔵 Golang version upgrade to v1.26.4

43+ - Upgrade of all dependencies to their latest versions

44+- 🕵️‍♀️ Vulnerabilities have ben addressed

45+ - [CVE-2026-33811](https://nvd.nist.gov/vuln/detail/)

46+ - [CVE-2026-33814](https://nvd.nist.gov/vuln/detail/)

47+ - [CVE-2026-39820](https://nvd.nist.gov/vuln/detail/)

48+ - [CVE-2026-39836](https://nvd.nist.gov/vuln/detail/)

49+ - [CVE-2026-42499](https://nvd.nist.gov/vuln/detail/)

50+ - [CVE-2026-42504](https://nvd.nist.gov/vuln/detail/)

51+ - [CVE-2026-39823](https://nvd.nist.gov/vuln/detail/)

52+ - [CVE-2026-39826](https://nvd.nist.gov/vuln/detail/)

53+ - [CVE-2026-39825](https://nvd.nist.gov/vuln/detail/)

54+ - [CVE-2026-27145](https://nvd.nist.gov/vuln/detail/)

55+ - [CVE-2026-42507](https://nvd.nist.gov/vuln/detail/)

56+

57+## Important Notes

58+

59+## Breaking Changes

60+

961## Changes since v7.15.2

1062

63+- [#3477](https://github.com/oauth2-proxy/oauth2-proxy/pull/3477) chore(dep): bump go to 1.26 and migrate of reverse proxy handling

64+

1165# V7.15.2

1266

1367## Release Highlights

Makefile+9−4

@@ -25,7 +25,8 @@ help: ## Display this help

2525

2626

2727GO ?= go

28−GOLANGCILINT ?= golangci-lint

28+# renovate: datasource=github-tags depName=golangci/golangci-lint

29+GOLANGCILINT_VERSION ?= v2.11.4

2930

3031BINARY := oauth2-proxy

3132VERSION ?= $(shell git describe --always --dirty --tags 2>/dev/null || echo "undefined")

@@ -66,7 +67,7 @@ DOCKER_BUILDX_PUSH := $(DOCKER_BUILDX) --push

6667DOCKER_BUILDX_PUSH_X_PLATFORM := $(DOCKER_BUILDX_PUSH) --platform ${DOCKER_BUILD_PLATFORM}

6768

6869DOCKER_BUILD_PLATFORM_ALPINE ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v6,linux/arm/v7,linux/s390x

69−DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.23.3

70+DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.24.1

7071DOCKER_BUILDX_ARGS_ALPINE ?= --build-arg RUNTIME_IMAGE=${DOCKER_BUILD_RUNTIME_IMAGE_ALPINE} ${DOCKER_BUILDX_COMMON_ARGS}

7172DOCKER_BUILDX_X_PLATFORM_ALPINE := docker buildx build ${DOCKER_BUILDX_ARGS_ALPINE} --platform ${DOCKER_BUILD_PLATFORM_ALPINE}

7273DOCKER_BUILDX_PUSH_X_PLATFORM_ALPINE := $(DOCKER_BUILDX_X_PLATFORM_ALPINE) --push

@@ -143,7 +144,7 @@ verify-generate: generate ## Verify command to check if alpha config docs are in

143144##@ Miscellaneous

144145

145146.PHONY: test

146−test: lint ## Run all Go tests

147+test: ## Run all Go tests

147148 GO111MODULE=on $(GO) test $(TESTCOVER) -v -race ./...

148149

149150.PHONY: release

@@ -157,7 +158,11 @@ clean: ## Cleanup release and build files

157158

158159.PHONY: lint

159160lint: validate-go-version ## Lint all files using golangci-lint

160− GO111MODULE=on $(GOLANGCILINT) run

161+ GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m

162+

163+.PHONY: lint-fix

164+lint-fix: validate-go-version ## Lint all files and apply fixes using golangci-lint

165+ GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m --fix

161166

162167.PHONY: validate-go-version

163168validate-go-version: ## Validate Go environment requirements

README.md+4−4

@@ -12,7 +12,7 @@

1212

1313OAuth2 Proxy is a flexible, open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. It provides a simple and secure way to protect your web applications with OAuth2 / OIDC authentication. As a reverse proxy, it intercepts requests to your application and redirects users to an OAuth2 provider for authentication. As a middleware, it can be seamlessly integrated into your existing infrastructure to handle authentication for multiple applications.

1414

15−OAuth2 Proxy supports a lot of OAuth2 as well as OIDC providers. Either through a generic OIDC client or a specific implementation for Google, Microsoft Entra ID, GitHub, login.gov and others. Through specialised provider implementations oauth2-proxy can extract more details about the user like preferred usernames and groups. Those details can then be forwarded as HTTP headers to your upstream applications.

15+OAuth2 Proxy supports a lot of OAuth2 as well as OIDC providers. Either through a generic OIDC client or a specific implementation for Google, Microsoft Entra ID, GitHub, login.gov and others. Through specialised provider implementations OAuth2 Proxy can extract more details about the user like preferred usernames and groups. Those details can then be forwarded as HTTP headers to your upstream applications.

1616

1717![Simplified Architecture](docs/static/img/simplified-architecture.svg)

1818

@@ -23,7 +23,7 @@ OAuth2 Proxy's [Installation Docs](https://oauth2-proxy.github.io/oauth2-proxy/i

2323## Releases

2424

2525### Binaries

26−We publish oauth2-proxy as compiled binaries on GitHub for all major architectures as well as more exotic ones like `ppc64le` as well as `s390x`.

26+We publish OAuth2 Proxy as compiled binaries on GitHub for all major architectures as well as more exotic ones like `ppc64le` as well as `s390x`.

2727

2828Check out the [latest release](https://github.com/oauth2-proxy/oauth2-proxy/releases/latest).

2929

@@ -49,9 +49,9 @@ SAP Open Source Program

4949Microsoft Azure credits for open source projects

5050

5151## Getting Involved

52−[![Slack](https://img.shields.io/badge/slack-Gopher_%23oauth2--proxy-red?logo=slack)](https://gophers.slack.com/archives/CM2RSS25N)

52+[![Slack](https://img.shields.io/badge/slack-CNCF_%23oauth2--proxy-blue?logo=slack)](https://cloud-native.slack.com/archives/C098Y5URZ2N)

5353

54−Join the #oauth2-proxy [Slack channel](https://gophers.slack.com/archives/CM2RSS25N) to chat with other users of oauth2-proxy or reach out to the maintainers directly. Use the [public invite link](https://invite.slack.golangbridge.org/) to get an invite for the Gopher Slack space.

54+Join the #oauth2-proxy [Slack channel](https://cloud-native.slack.com/archives/C098Y5URZ2N) to chat with other users of OAuth2 Proxy or reach out to the maintainers directly. Use the [public invite link](https://slack.cncf.io/) to get an invite for the CNCF space.

5555

5656OAuth2 Proxy is a community-driven project. We rely on the contribut️ions of our users to continually improve it. While review times can vary, we appreciate your patience and understanding. As a volunteer-driven project, we strive to keep this project stable and might take longer to merge changes.

5757

contrib/local-environment/Makefile+2−2

@@ -49,8 +49,8 @@ kubernetes-down:

4949

5050.PHONY: traefik-up

5151traefik-up:

52− docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml up -d

52+ docker compose -f docker-compose-traefik.yaml up -d

5353

5454.PHONY: traefik-%

5555traefik-%:

56− docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml $*

56+ docker compose -f docker-compose-traefik.yaml $*

contrib/local-environment/dex-traefik.yamlnew file+25

@@ -0,0 +1,25 @@

1+# This configuration is intended to be used with the Traefik local environment.

2+# Dex uses in-memory storage because this environment is disposable.

3+issuer: http://dex.localtest.me/dex

4+storage:

5+ type: memory

6+web:

7+ http: 0.0.0.0:5556

8+oauth2:

9+ skipApprovalScreen: true

10+expiry:

11+ signingKeys: "4h"

12+ idTokens: "1h"

13+staticClients:

14+ - id: oauth2-proxy

15+ redirectURIs:

16+ - "http://oauth2-proxy.localtest.me/oauth2/callback"

17+ name: "OAuth2 Proxy"

18+ secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

19+enablePasswordDB: true

20+staticPasswords:

21+ - email: "admin@example.com"

22+ # bcrypt hash of the string "password"

23+ hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"

24+ username: "admin"

25+ userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"

contrib/local-environment/dex.yaml+1−6

@@ -3,11 +3,7 @@

33# This should configure Dex to run on port 5556 and provides a static login

44issuer: http://dex.localtest.me:5556/dex

55storage:

6− type: etcd

7− config:

8− endpoints:

9− - http://etcd:2379

10− namespace: dex/

6+ type: memory

117web:

128 http: 0.0.0.0:5556

139oauth2:

@@ -21,7 +17,6 @@ staticClients:

2117 # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.

2218 - "http://oauth2-proxy.localtest.me:4180/oauth2/callback" # For basic proxy example.

2319 - "http://oauth2-proxy.localtest.me:8080/oauth2/callback" # For nginx example.

24− - "http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback" # For traefik example.

2520 name: "OAuth2 Proxy"

2621 secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

2722enablePasswordDB: true

contrib/local-environment/docker-compose-alpha-config.yaml+2−15

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex and HTTPBin as an example upstream.

4+# HTTPBin as an example upstream.

55# This file also uses alpha configuration when configuring OAuth2 Proxy.

66#

77# This file is an extension of the main compose file and must be used with it

@@ -14,7 +14,7 @@ version: "3.0"

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

1818 command: --config /oauth2-proxy.cfg --alpha-config /oauth2-proxy-alpha-config.yaml

1919 hostname: oauth2-proxy

2020 volumes:

@@ -43,25 +43,12 @@ services:

4343 dex:

4444 aliases:

4545 - dex.localtest.me

46− etcd: {}

47− depends_on:

48− - etcd

4946 httpbin:

5047 container_name: httpbin

5148 image: kennethreitz/httpbin

5249 ports: []

5350 networks:

5451 httpbin: {}

55− etcd:

56− container_name: etcd

57− image: gcr.io/etcd-development/etcd:v3.6.8

58− entrypoint: /usr/local/bin/etcd

59− command:

60− - --listen-client-urls=http://0.0.0.0:2379

61− - --advertise-client-urls=http://etcd:2379

62− networks:

63− etcd: {}

6452networks:

6553 dex: {}

66− etcd: {}

6754 httpbin: {}

contrib/local-environment/docker-compose-gitea.yaml+2−2

@@ -14,7 +14,7 @@ version: '3.0'

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

1818 command: --config /oauth2-proxy.cfg

1919 hostname: oauth2-proxy

2020 volumes:

@@ -39,7 +39,7 @@ services:

3939 httpbin: {}

4040

4141 gitea:

42− image: gitea/gitea:1.25.5

42+ image: gitea/gitea:1.27.2

4343 container_name: gitea

4444 environment:

4545 - USER_UID=1000

contrib/local-environment/docker-compose-keycloak.yaml+2−2

@@ -14,7 +14,7 @@ version: "3.0"

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

1818 command: --config /oauth2-proxy.cfg

1919 hostname: oauth2-proxy

2020 volumes:

@@ -40,7 +40,7 @@ services:

4040

4141 keycloak:

4242 container_name: keycloak

43− image: keycloak/keycloak:25.0

43+ image: keycloak/keycloak:26.7

4444 hostname: keycloak

4545 command:

4646 - "start-dev"

contrib/local-environment/docker-compose-nginx.yaml+4−29

@@ -1,28 +1,18 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex, nginx as a reverse proxy and other http services for upstreams

4+# nginx as a reverse proxy and other HTTP services for upstreams.

55#

66# This file is an extension of the main compose file and must be used with it

77# docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml <command>

88# Alternatively:

99# make nginx-<command> (eg make nginx-up, make nginx-down)

1010#

11−# Access one of the following URLs to initiate a login flow:

12−# - http://oauth2-proxy.localhost

13−# - http://httpbin.oauth2-proxy.localhost

14−#

15−# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16−#

17−# Note, the above URLs should work with Chrome, but you may need to add hosts

18−# entries for other browsers

19−# 127.0.0.1 oauth2-proxy.localhost

20−# 127.0.0.1 httpbin.oauth2-proxy.localhost

21−# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

11+# Access http://oauth2-proxy.localtest.me:8080 to initiate a login flow.

2212version: "3.0"

2313services:

2414 oauth2-proxy:

25− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

15+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

2616 ports: []

2717 hostname: oauth2-proxy

2818 container_name: oauth2-proxy

@@ -33,7 +23,6 @@ services:

3323 networks:

3424 oauth2-proxy: {}

3525 dex: {}

36− etcd: {}

3726 httpbin: {}

3827 depends_on:

3928 - dex

@@ -42,7 +31,7 @@ services:

4231 depends_on:

4332 - oauth2-proxy

4433 container_name: nginx

45− image: nginx:1.29

34+ image: nginx:1.31

4635 restart: unless-stopped

4736 ports:

4837 - 8080:8080/tcp

@@ -52,7 +41,6 @@ services:

5241 networks:

5342 oauth2-proxy: {}

5443 dex: {}

55− etcd: {}

5644 httpbin: {}

5745 dex:

5846 container_name: dex

@@ -68,26 +56,13 @@ services:

6856 dex:

6957 aliases:

7058 - dex.localtest.me

71− etcd: {}

72− depends_on:

73− - etcd

7459 httpbin:

7560 container_name: httpbin

7661 image: kennethreitz/httpbin

7762 ports: []

7863 networks:

7964 httpbin: {}

80− etcd:

81− container_name: etcd

82− image: gcr.io/etcd-development/etcd:v3.6.8

83− entrypoint: /usr/local/bin/etcd

84− command:

85− - --listen-client-urls=http://0.0.0.0:2379

86− - --advertise-client-urls=http://etcd:2379

87− networks:

88− etcd: {}

8965networks:

9066 dex: {}

91− etcd: {}

9267 httpbin: {}

9368 oauth2-proxy: {}

contrib/local-environment/docker-compose-traefik.yaml+42−18

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

3−# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# HTTPBin as an example upstream.

3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider

4+# and HTTPBin as an example upstream.

55#

66# This can either be created using docker-compose

77# docker-compose -f docker-compose-traefik.yaml <command>

@@ -9,32 +9,51 @@

99# make traefik-<command> (eg. make traefik-up, make traefik-down)

1010#

1111# Access one of the following URLs to initiate a login flow:

12−# - http://oauth2-proxy.localhost

13−# - http://httpbin.oauth2-proxy.localhost

12+# - http://oauth2-proxy.localtest.me

13+# - http://httpbin.localtest.me

14+# - http://dex.localtest.me/dex

1415#

15−# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16−#

17−# Note, the above URLs should work with Chrome, but you may need to add hosts

18−# entries for other browsers

19−# 127.0.0.1 oauth2-proxy.localhost

20−# 127.0.0.1 httpbin.oauth2-proxy.localhost

21−# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

22−version: '3.0'

16+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.localtest.me

2317services:

2418

2519 oauth2-proxy:

26− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

20+ container_name: oauth2-proxy

21+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

22+ command: --config /oauth2-proxy.cfg

2723 ports: []

2824 hostname: oauth2-proxy

2925 volumes:

3026 - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"

27+ restart: unless-stopped

28+ networks:

29+ oauth2-proxy: {}

30+ dex: {}

31+ depends_on:

32+ - dex

33+ - httpbin

34+

35+ dex:

36+ container_name: dex

37+ image: ghcr.io/dexidp/dex:v2.45.1

38+ command: dex serve /dex.yaml

39+ hostname: dex

40+ volumes:

41+ - "./dex-traefik.yaml:/dex.yaml"

42+ restart: unless-stopped

3143 networks:

32− oauth2-proxy:

44+ dex: {}

45+

46+ httpbin:

47+ container_name: httpbin

48+ image: kennethreitz/httpbin

49+ ports: []

50+ networks:

51+ httpbin: {}

3352

3453 # Reverse proxy

3554 gateway:

3655 container_name: traefik

37− image: traefik:v2.11.40

56+ image: traefik:v3.7.10

3857 volumes:

3958 - "./traefik:/etc/traefik"

4059 ports:

@@ -43,8 +62,13 @@ services:

4362 depends_on:

4463 - oauth2-proxy

4564 networks:

46− oauth2-proxy:

47− httpbin:

65+ oauth2-proxy: {}

66+ httpbin: {}

67+ dex:

68+ aliases:

69+ - dex.localtest.me

4870

4971networks:

50− oauth2-proxy:

72+ dex: {}

73+ httpbin: {}

74+ oauth2-proxy: {}

contrib/local-environment/docker-compose.yaml+2−15

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex and HTTPBin as an example upstream.

4+# HTTPBin as an example upstream.

55#

66# This can either be created using docker-compose

77# docker-compose -f docker-compose.yaml <command>

@@ -13,7 +13,7 @@ version: "3.0"

1313services:

1414 oauth2-proxy:

1515 container_name: oauth2-proxy

16− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2

16+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

1717 command: --config /oauth2-proxy.cfg

1818 hostname: oauth2-proxy

1919 volumes:

@@ -41,25 +41,12 @@ services:

4141 dex:

4242 aliases:

4343 - dex.localtest.me

44− etcd: {}

45− depends_on:

46− - etcd

4744 httpbin:

4845 container_name: httpbin

4946 image: kennethreitz/httpbin

5047 ports: []

5148 networks:

5249 httpbin: {}

53− etcd:

54− container_name: etcd

55− image: gcr.io/etcd-development/etcd:v3.6.8

56− entrypoint: /usr/local/bin/etcd

57− command:

58− - --listen-client-urls=http://0.0.0.0:2379

59− - --advertise-client-urls=http://etcd:2379

60− networks:

61− etcd: {}

6250networks:

6351 dex: {}

64− etcd: {}

6552 httpbin: {}

contrib/local-environment/kubernetes/Chart.lock+3−3

@@ -1,7 +1,7 @@

11dependencies:

22- name: dex

33 repository: https://charts.dexidp.io

4− version: 0.24.0

4+ version: 0.24.1

55- name: oauth2-proxy

66 repository: https://oauth2-proxy.github.io/manifests

77 version: 7.18.0

@@ -11,5 +11,5 @@ dependencies:

1111- name: hello-world

1212 repository: https://conservis.github.io/helm-charts

1313 version: 1.1.0

14−digest: sha256:fee913531bfb67e5555e995d8fb040c330e6eb4b5a8c777ceb9841135ea9bb84

15−generated: "2025-10-28T06:46:35.38300324Z"

14+digest: sha256:3fff8bf99cebcd20a73c984423d5f1c2dfa1e5a394f82a5dc60d9aaffe5361b7

15+generated: "2026-08-18T07:33:03.791274914Z"

contrib/local-environment/kubernetes/Chart.yaml+1−1

@@ -3,7 +3,7 @@ description: K8S example based on https://kind.sigs.k8s.io

33name: kubernetes

44dependencies:

55 - name: dex

6− version: 0.24.0

6+ version: 0.24.1

77 repository: https://charts.dexidp.io

88 - name: oauth2-proxy

99 version: &chartVersion 7.18.0

contrib/local-environment/oauth2-proxy-traefik.cfg+4−4

@@ -2,14 +2,14 @@ http_address="0.0.0.0:4180"

22cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

33provider="oidc"

44email_domains=["example.com"]

5−oidc_issuer_url="http://dex.localhost:5556/dex"

5+oidc_issuer_url="http://dex.localtest.me/dex"

66client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

77client_id="oauth2-proxy"

88cookie_secure="false"

10−redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"

11−cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.

12−whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.

10+redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"

11+cookie_domains=".localtest.me" # Required so cookie can be read on all subdomains.

12+whitelist_domains=".localtest.me" # Required to allow redirection back to original requested target.

1313

1414# Mandatory option when using oauth2-proxy with traefik

1515reverse_proxy="true"

contrib/local-environment/traefik/dynamic.yaml+11−4

@@ -1,22 +1,25 @@

11http:

22 routers:

33 oauth2-proxy-route:

4− rule: "Host(`oauth2-proxy.oauth2-proxy.localhost`)"

4+ rule: "Host(`oauth2-proxy.localtest.me`)"

55 middlewares:

66 - auth-headers

77 service: oauth-backend

8+ dex-route:

9+ rule: "Host(`dex.localtest.me`)"

10+ service: dex-service

811 httpbin-route:

9− rule: "Host(`httpbin.oauth2-proxy.localhost`)"

12+ rule: "Host(`httpbin.localtest.me`)"

1013 service: httpbin-service

1114 middlewares:

1215 - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin

1316 httpbin-route-2:

14− rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/no-auto-redirect`)"

17+ rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/no-auto-redirect`)"

1518 service: httpbin-service

1619 middlewares:

1720 - oauth-auth-wo-redirect # unauthenticated session will return a 401

1821 services-oauth2-route:

19− rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/oauth2/`)"

22+ rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/oauth2/`)"

2023 middlewares:

2124 - auth-headers

2225 service: oauth-backend

@@ -30,6 +33,10 @@ http:

3033 loadBalancer:

3134 servers:

3235 - url: http://oauth2-proxy:4180

36+ dex-service:

37+ loadBalancer:

38+ servers:

39+ - url: http://dex:5556

3340

3441 middlewares:

3542 auth-headers:

contrib/local-environment/traefik/traefik.yaml+2

@@ -5,3 +5,5 @@ log:

55providers:

66 file:

77 filename: /etc/traefik/dynamic.yaml

8+ # Routes are static for this example; disabling watch avoids host inotify limits.

9+ watch: false

docs/docs/configuration/alpha_config.md+12−1

@@ -167,6 +167,17 @@ injectResponseHeaders:

167167* `claimSource` - `claim` (session claims either from id token or from profile URL)

168168* `secretSource` - `value` (base64), `fromFile` (file path)

169169

170+#### Claim value serialization

171+

172+`claimSource` converts the selected claim into one or more string header values. Scalars

173+produce one value, while arrays produce one value per element. Values that cannot be

174+converted directly to strings, such as objects, are JSON-encoded individually.

175+

176+Each non-empty value is added separately under the configured header name. An array of

177+objects therefore produces multiple header values containing one JSON object each, not a

178+single JSON array. HTTP libraries and intermediaries may expose repeated values as a

179+comma-joined string, so consumers should retrieve and parse each header value separately.

180+

170181**Request option:** `preserveRequestValue: true` retains existing header values

171182

172183**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

@@ -678,7 +689,7 @@ Requests will be proxied to this upstream if the path matches the request path.

678689| Field | Type | Description |

679690| ----- | ---- | ----------- |

680691| `id` | _string_ | ID should be a unique identifier for the upstream. This value is required for all upstreams. |

681−| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Path can also take a pattern when used with RewriteTarget. Path segments can be captured and matched using regular experessions. Eg: - `^/foo$`: Match only the explicit path `/foo` - `^/bar/$`: Match any path prefixed with `/bar/` - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |

692+| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Without RewriteTarget, Path follows gorilla/mux route syntax. Eg: - `/foo`: Match only the explicit path `/foo` - `/bar/`: Match any path prefixed with `/bar/` - `/baz/{path:.*}`: Match any path prefixed with `/baz/` When RewriteTarget is set, Path is treated as a regular expression. Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the remaining path for use with RewriteTarget. |

682693| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem (for a `file:` upstream). Use the Path to capture segments for reuse within the rewrite target. Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite the request `/baz/abc/123` to `/foo/abc/123` before proxying to the upstream server. Or if the upstream were `file:///app`, a request for `/baz/info.html` would return the contents of the file `/app/foo/info.html`. |

683694| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File based URL. It may include a path, in which case all requests will be served under that path. Eg: - http://localhost:8080 - https://service.localhost - https://service.localhost/path - file://host/path If the URI's path is "/base" and the incoming request was for "/dir", the upstream request will be for "/base/dir". |

684695| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts. This option is insecure and will allow potential Man-In-The-Middle attacks between OAuth2 Proxy and the upstream server. Defaults to false. |

docs/docs/configuration/alpha_config.md.tmpl+11

@@ -167,6 +167,17 @@ injectResponseHeaders:

167167* `claimSource` - `claim` (session claims either from id token or from profile URL)

168168* `secretSource` - `value` (base64), `fromFile` (file path)

169169

170+#### Claim value serialization

171+

172+`claimSource` converts the selected claim into one or more string header values. Scalars

173+produce one value, while arrays produce one value per element. Values that cannot be

174+converted directly to strings, such as objects, are JSON-encoded individually.

175+

176+Each non-empty value is added separately under the configured header name. An array of

177+objects therefore produces multiple header values containing one JSON object each, not a

178+single JSON array. HTTP libraries and intermediaries may expose repeated values as a

179+comma-joined string, so consumers should retrieve and parse each header value separately.

180+

170181**Request option:** `preserveRequestValue: true` retains existing header values

171182

172183**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

docs/docs/configuration/integrations/nginx.md+27−11

@@ -60,23 +60,23 @@ server {

6060 auth_request_set $auth_cookie $upstream_http_set_cookie;

6161 add_header Set-Cookie $auth_cookie;

6262

63− # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb

64− # limit and so the OAuth2 Proxy splits these into multiple parts.

63+ # Large OIDC tokens can make the session cookie exceed the 4KB limit,

64+ # causing OAuth2 Proxy to split the cookie into multiple parts.

6565 # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,

66− # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.

67− auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

66+ # so extract the second part when using the default cookie name, `_oauth2_proxy`.

67+ auth_request_set $auth_cookie_upstream_1 $upstream_cookie__oauth2_proxy_1;

6868

6969 # Extract the Cookie attributes from the first Set-Cookie header and append them

7070 # to the second part ($upstream_cookie_* variables only contain the raw cookie content)

7171 if ($auth_cookie ~* "(; .*)") {

72− set $auth_cookie_name_0 $auth_cookie;

73− set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";

72+ set $auth_cookie_0 $auth_cookie;

73+ set $auth_cookie_1 "_oauth2_proxy_1=$auth_cookie_upstream_1$1";

7474 }

7575

7676 # Send both Set-Cookie headers now if there was a second part

77− if ($auth_cookie_name_upstream_1) {

78− add_header Set-Cookie $auth_cookie_name_0;

79− add_header Set-Cookie $auth_cookie_name_1;

77+ if ($auth_cookie_upstream_1) {

78+ add_header Set-Cookie $auth_cookie_0;

79+ add_header Set-Cookie $auth_cookie_1;

8080 }

8181

8282 proxy_pass http://backend/;

@@ -91,6 +91,24 @@ server {

9191}

9292```

9393

94+### Multi-part session cookies

95+

96+The example above is ready to use with the default `--cookie-name=_oauth2_proxy` setting and handles a session split into two cookies. If you configure a custom cookie name, update both references to the second cookie part:

97+

98+| Cookie configuration | Nginx upstream cookie variable | `Set-Cookie` name |

99+| --- | --- | --- |

100+| Default (`_oauth2_proxy`) | `$upstream_cookie__oauth2_proxy_1` | `_oauth2_proxy_1=` |

101+| `--cookie-name=my_cookie` | `$upstream_cookie_my_cookie_1` | `my_cookie_1=` |

102+

103+For example, with `--cookie-name=my_cookie`, change the relevant lines to:

104+

105+```nginx

106+auth_request_set $auth_cookie_upstream_1 $upstream_cookie_my_cookie_1;

107+set $auth_cookie_1 "my_cookie_1=$auth_cookie_upstream_1$1";

108+```

109+

110+If a session is split into more than two cookies, repeat the extraction for each additional numeric suffix. For consistently large sessions, prefer `--session-store-type=redis` so only a small session ticket is stored in the browser cookie.

111+

94112### Understanding the `error_page` redirect pattern

95113

96114The `auth_request` directive expects the authentication endpoint (`/oauth2/auth`) to return:

@@ -167,8 +185,6 @@ It is recommended to use `--session-store-type=redis` when expecting large sessi

167185For a complete example of integrating oauth2-proxy with Kubernetes Dashboard on AKS using Azure Entra ID, including RBAC configuration and troubleshooting, see the [Kubernetes Dashboard on AKS](../providers/ms_entra_id.md#kubernetes-dashboard-on-aks) section in the Microsoft Entra ID provider documentation.

168186:::

169187

170−You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

171−

172188:::note

173189If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.

174190:::

docs/docs/configuration/providers/atlassian.mdnew file+26

@@ -0,0 +1,26 @@

1+---

2+id: atlassian

3+title: Atlassian Cloud

4+---

6+1. Create an OAuth 2.0 integration in the [Atlassian developer console](https://developer.atlassian.com/console/myapps/).

7+2. Under **Permissions**, add the User identity API with the `read:me` scope.

8+3. Under **Authorization**, set the callback URL to `https://<proxy_host>/oauth2/callback`.

9+4. Copy the client ID and secret from **Settings**.

10+5. Run the proxy with:

11+

12+```shell

13+ --provider=atlassian

14+ --client-id=<client ID>

15+ --client-secret=<secret>

16+ --redirect-url=https://<proxy_host>/oauth2/callback

17+ --cookie-secret=<cookie secret>

18+```

19+

20+A new app works only for the account that created it. Enable sharing under **Distribution** to let other users sign in.

21+Atlassian then admits only accounts with access to the Atlassian site the app is installed on; others are refused at

22+the consent screen.

23+

24+The proxy reads the user's email from `https://api.atlassian.com/me`. Restricting access further is supported by

25+[email](index.md#email-authentication). With `--cookie-refresh` set, the proxy re-validates the token against `/me` on

26+that interval.

docs/docs/configuration/providers/dtt_sso.mdnew file+45

@@ -0,0 +1,45 @@

1+---

2+id: dtt_sso

3+title: DTT SSO

4+---

6+Signs users in with the DTT SSO (auth-server) using the authorization code flow and its HS256 id_token.

8+1. Register a client in the auth-server config, one per protected service, with the proxy's callback as its

9+ only redirect URI:

10+

11+ ```yaml

12+ clients:

13+ redash-gate:

14+ secret: <random secret>

15+ redirect_uri: https://redash.example.com/oauth2/callback

16+ display_name: Redash

17+ ```

18+

19+2. Run the proxy with:

20+

21+ ```shell

22+ --provider=dtt-sso

23+ --client-id=redash-gate

24+ --client-secret-file=/run/secrets/client_secret

25+ --redirect-url=https://redash.example.com/oauth2/callback

26+ --cookie-secret-file=/run/secrets/cookie_secret

27+ --cookie-name=_dtt_sso_redash

28+ --cookie-refresh=5m

29+ ```

30+

31+ Give each instance its own `--cookie-name`: another oauth2-proxy setting its cookie on a parent domain

32+ (the Atlassian proxy uses `_oauth2_proxy` on `.thebestagent.pro`) would otherwise shadow this one.

33+

34+The endpoints default to `https://auth.thebestagent.pro`. For another SSO host set `--login-url`, `--redeem-url`

35+and `--validate-url` to its `/oauth/authorize`, `/oauth/token` and `/oauth/check_token`; the id_token issuer must

36+equal the login URL's origin (the SSO's `site_host`).

37+

38+The scope must stay `openid`, the only scope the SSO accepts.

39+

40+The session carries the SSO `email`, the user UUID as the user, and the SSO `role` as the only group, so

41+`--allowed-group=dtt_admin` restricts access by role. `--authenticated-emails-file` and `--email-domain` restrict

42+by email as usual.

43+

44+With `--cookie-refresh` set, the proxy refreshes the tokens on that interval and re-reads the email and role; a user

45+deleted or signed out in the SSO loses access at the next refresh.

docs/docs/configuration/providers/index.md+2

@@ -9,10 +9,12 @@ with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.

99Valid providers are :

1010

1111- [ADFS](adfs.md)

12+- [Atlassian Cloud](atlassian.md)

1213- [Bitbucket](bitbucket.md)

1314- [Cidaas](cidaas.md)

1415- [CiscoDuo](cisco_duo.md)

1516- [DigitalOcean](digitalocean.md)

17+- [DTT SSO](dtt_sso.md)

1618- [Facebook](facebook.md)

1719- [Gitea](gitea.md)

1820- [GitHub](github.md)

docs/docs/installation.md+1−1

@@ -5,7 +5,7 @@ title: Installation

661. Choose how to deploy:

8− a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.2`)

8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)

1010 b. Using Go to install the latest release

1111 ```bash

docs/docusaurus.config.js+1−1

@@ -105,7 +105,7 @@ const config = {

105105 dropdownActiveClassDisabled: true,

106106 },

107107 {

108− href: 'https://gophers.slack.com/messages/CM2RSS25N',

108+ href: 'https://cloud-native.slack.com/archives/C098Y5URZ2N',

109109 label: 'Slack',

110110 position: 'right',

111111 },

docs/sidebars.js+2

@@ -46,11 +46,13 @@ const sidebars = {

4646 },

4747 items: [

4848 "configuration/providers/adfs",

49+ "configuration/providers/atlassian",

4950 "configuration/providers/azure",

5051 "configuration/providers/bitbucket",

5152 "configuration/providers/cidaas",

5253 "configuration/providers/cisco_duo",

5354 "configuration/providers/digitalocean",

55+ "configuration/providers/dtt_sso",

5456 "configuration/providers/facebook",

5557 "configuration/providers/gitea",

5658 "configuration/providers/github",

docs/versioned_docs/version-7.15.x/installation.md+1−1

@@ -5,7 +5,7 @@ title: Installation

661. Choose how to deploy:

8− a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.2`)

8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)

1010 b. Using Go to install the latest release

1111 ```bash

go.mod+39−43

@@ -1,17 +1,17 @@

11module github.com/oauth2-proxy/oauth2-proxy/v7

3−go 1.25.0

3+go 1.26.0

55require (

66 cloud.google.com/go/compute/metadata v0.9.0

77 github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb

88 github.com/a8m/envsubst v1.4.3

9− github.com/alicebob/miniredis/v2 v2.37.0

9+ github.com/alicebob/miniredis/v2 v2.38.0

1010 github.com/bitly/go-simplejson v0.5.1

11− github.com/bsm/redislock v0.9.4

12− github.com/coreos/go-oidc/v3 v3.18.0

11+ github.com/bsm/redislock v0.10.0

12+ github.com/coreos/go-oidc/v3 v3.20.0

1313 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf

14− github.com/fsnotify/fsnotify v1.9.0

14+ github.com/fsnotify/fsnotify v1.10.1

1515 github.com/go-jose/go-jose/v3 v3.0.5

1616 github.com/go-jose/go-jose/v4 v4.1.4

1717 github.com/go-viper/mapstructure/v2 v2.5.0

@@ -21,67 +21,63 @@ require (

2121 github.com/gorilla/mux v1.8.1

2222 github.com/justinas/alice v1.2.0

2323 github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25

24− github.com/onsi/ginkgo/v2 v2.28.1

25− github.com/onsi/gomega v1.39.1

26− github.com/pierrec/lz4/v4 v4.1.26

27− github.com/prometheus/client_golang v1.23.2

28− github.com/redis/go-redis/v9 v9.18.0

24+ github.com/onsi/ginkgo/v2 v2.32.1

25+ github.com/onsi/gomega v1.42.1

26+ github.com/pierrec/lz4/v4 v4.1.28

27+ github.com/prometheus/client_golang v1.24.1

28+ github.com/redis/go-redis/v9 v9.22.0

2929 github.com/spf13/cast v1.10.0

3030 github.com/spf13/pflag v1.0.10

3131 github.com/spf13/viper v1.21.0

32− github.com/stretchr/testify v1.11.1

32+ github.com/stretchr/testify v1.12.0

3333 github.com/vmihailenco/msgpack/v5 v5.4.1

34− go.yaml.in/yaml/v3 v3.0.4

35− golang.org/x/crypto v0.50.0

36− golang.org/x/net v0.53.0

34+ go.yaml.in/yaml/v3 v3.0.5

35+ golang.org/x/crypto v0.55.0

36+ golang.org/x/net v0.58.0

3737 golang.org/x/oauth2 v0.36.0

38− golang.org/x/sync v0.20.0

39− google.golang.org/api v0.275.0

38+ golang.org/x/sync v0.22.0

39+ google.golang.org/api v0.293.0

4040 gopkg.in/natefinch/lumberjack.v2 v2.2.1

41− k8s.io/apimachinery v0.35.3

41+ k8s.io/apimachinery v0.36.3

4242)

4343

4444require (

45− cloud.google.com/go/auth v0.20.0 // indirect

45+ cloud.google.com/go/auth v0.23.1 // indirect

4646 cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect

47− github.com/Masterminds/semver/v3 v3.4.0 // indirect

47+ github.com/Masterminds/semver/v3 v3.5.0 // indirect

4848 github.com/beorn7/perks v1.0.1 // indirect

4949 github.com/cespare/xxhash/v2 v2.3.0 // indirect

50− github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect

51− github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect

52− github.com/felixge/httpsnoop v1.0.4 // indirect

53− github.com/go-logr/logr v1.4.3 // indirect

50+ github.com/felixge/httpsnoop v1.1.0 // indirect

51+ github.com/go-logr/logr v1.4.4 // indirect

5452 github.com/go-logr/stdr v1.2.2 // indirect

5553 github.com/go-task/slim-sprig/v3 v3.0.0 // indirect

56− github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect

54+ github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect

5755 github.com/google/s2a-go v0.1.9 // indirect

58− github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect

59− github.com/googleapis/gax-go/v2 v2.21.0 // indirect

56+ github.com/googleapis/enterprise-certificate-proxy v0.3.21 // indirect

57+ github.com/googleapis/gax-go/v2 v2.23.0 // indirect

6058 github.com/kylelemons/godebug v1.1.0 // indirect

6159 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

62− github.com/pelletier/go-toml/v2 v2.3.0 // indirect

63− github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect

60+ github.com/pelletier/go-toml/v2 v2.4.3 // indirect

6461 github.com/prometheus/client_model v0.6.2 // indirect

65− github.com/prometheus/common v0.67.5 // indirect

66− github.com/prometheus/procfs v0.20.1 // indirect

62+ github.com/prometheus/common v0.70.1 // indirect

63+ github.com/prometheus/procfs v0.21.1 // indirect

6764 github.com/sagikazarmark/locafero v0.12.0 // indirect

6865 github.com/spf13/afero v1.15.0 // indirect

6966 github.com/subosito/gotenv v1.6.0 // indirect

7067 github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect

71− github.com/yuin/gopher-lua v1.1.1 // indirect

68+ github.com/yuin/gopher-lua v1.1.2 // indirect

7269 go.opentelemetry.io/auto/sdk v1.2.1 // indirect

73− go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect

74− go.opentelemetry.io/otel v1.43.0 // indirect

75− go.opentelemetry.io/otel/metric v1.43.0 // indirect

76− go.opentelemetry.io/otel/trace v1.43.0 // indirect

70+ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect

71+ go.opentelemetry.io/otel v1.45.0 // indirect

72+ go.opentelemetry.io/otel/metric v1.45.0 // indirect

73+ go.opentelemetry.io/otel/trace v1.45.0 // indirect

7774 go.uber.org/atomic v1.11.0 // indirect

78− go.yaml.in/yaml/v2 v2.4.4 // indirect

79− golang.org/x/mod v0.35.0 // indirect

80− golang.org/x/sys v0.43.0 // indirect

81− golang.org/x/text v0.36.0 // indirect

82− golang.org/x/tools v0.44.0 // indirect

83− google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect

84− google.golang.org/grpc v1.80.0 // indirect

85− google.golang.org/protobuf v1.36.11 // indirect

75+ golang.org/x/mod v0.40.0 // indirect

76+ golang.org/x/sys v0.47.0 // indirect

77+ golang.org/x/text v0.41.0 // indirect

78+ golang.org/x/tools v0.49.0 // indirect

79+ google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect

80+ google.golang.org/grpc v1.83.0 // indirect

81+ google.golang.org/protobuf v1.36.12 // indirect

8682 gopkg.in/yaml.v3 v3.0.1 // indirect

8783)

go.sum+91−143

@@ -1,7 +1,5 @@

1−cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=

2−cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=

3−cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=

4−cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=

1+cloud.google.com/go/auth v0.23.1 h1:1tPpBPG02lQHmoiAvs9egyCASqXP0xgobptjZzov/Jg=

2+cloud.google.com/go/auth v0.23.1/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0=

53cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=

64cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=

75cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=

@@ -10,14 +8,14 @@ github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb h1:ZVN4Iat3runWO

108github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb/go.mod h1:WsAABbY4HQBgd3mGuG4KMNTbHJCPvx9IVBHzysbknss=

119github.com/FZambia/sentinel v1.0.0 h1:KJ0ryjKTZk5WMp0dXvSdNqp3lFaW1fNFuEYfrkLOYIc=

1210github.com/FZambia/sentinel v1.0.0/go.mod h1:ytL1Am/RLlAoAXG6Kj5LNuw/TRRQrv2rt2FT26vP5gI=

13−github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=

14−github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

11+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=

12+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

1513github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY=

1614github.com/a8m/envsubst v1.4.3/go.mod h1:4jjHWQlZoaXPoLQUb7H2qT4iLkZDdmEQiOUogdUmqVU=

1715github.com/alicebob/gopher-json v0.0.0-20180125190556-5a6b3ba71ee6/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=

1816github.com/alicebob/miniredis/v2 v2.11.1/go.mod h1:UA48pmi7aSazcGAvcdKcBB49z521IC9VjTTRz2nIaJE=

19−github.com/alicebob/miniredis/v2 v2.37.0 h1:RheObYW32G1aiJIj81XVt78ZHJpHonHLHW7OLIshq68=

20−github.com/alicebob/miniredis/v2 v2.37.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

17+github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e2uP9jiw=

18+github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

2119github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

2220github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=

2321github.com/bitly/go-simplejson v0.5.1 h1:xgwPbetQScXt1gh9BmoJ6j9JMr3TElvuIyjR8pgdoow=

@@ -26,51 +24,41 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=

2624github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=

2725github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=

2826github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=

29−github.com/bsm/redislock v0.9.4 h1:X/Wse1DPpiQgHbVYRE9zv6m070UcKoOGekgvpNhiSvw=

30−github.com/bsm/redislock v0.9.4/go.mod h1:Epf7AJLiSFwLCiZcfi6pWFO/8eAYrYpQXFxEDPoDeAk=

27+github.com/bsm/redislock v0.10.0 h1:NAe1OHDnwPmWEzD+LpWBZXAdZrWld/xj/wmqEcQednQ=

28+github.com/bsm/redislock v0.10.0/go.mod h1:M05WZGjPbX/8ne7LmB7AbOsa2kv7Jzx4fqkLpDFZvJs=

3129github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

3230github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=

3331github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=

3432github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=

3533github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=

36−github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=

37−github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=

38−github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=

39−github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=

34+github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE=

35+github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=

4036github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=

4137github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=

4238github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

43−github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=

44−github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

45−github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=

46−github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=

47−github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=

48−github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=

39+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=

40+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=

4941github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=

5042github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=

51−github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=

52−github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=

43+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=

44+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=

5345github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=

5446github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=

5547github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=

5648github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=

5749github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=

5850github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=

59−github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=

60−github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

6151github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=

6252github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

6353github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=

6454github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=

6555github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=

66−github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=

67−github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

56+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=

57+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

6858github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=

6959github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=

7060github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=

7161github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=

72−github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=

73−github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

7462github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=

7563github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

7664github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=

@@ -84,31 +72,27 @@ github.com/gomodule/redigo v1.7.1-0.20190322064113-39e2c31b7ca3/go.mod h1:B4C85q

8472github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=

8573github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=

8674github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=

87−github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=

88−github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

89−github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=

90−github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

75+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=

76+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=

9177github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=

9278github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=

9379github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

9480github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=

9581github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

96−github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=

97−github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=

98−github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE=

99−github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA=

100−github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI=

101−github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=

82+github.com/googleapis/enterprise-certificate-proxy v0.3.21 h1:OFdQ3tnCX/zaQ0Cedur3D3z7kI6HiLX9g3TiAN4/DFU=

83+github.com/googleapis/enterprise-certificate-proxy v0.3.21/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=

84+github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=

85+github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=

10286github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=

10387github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=

10488github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE=

10589github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=

10690github.com/justinas/alice v1.2.0 h1:+MHSA/vccVCF4Uq37S42jwlkvI2Xzl7zTPCN5BnZNVo=

10791github.com/justinas/alice v1.2.0/go.mod h1:fN5HRH/reO/zrUflLfTN43t3vXvKzvZIENsNEe7i7qA=

108−github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=

109−github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=

110−github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=

111−github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

92+github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=

93+github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=

94+github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=

95+github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=

11296github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=

11397github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=

11498github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=

@@ -125,29 +109,25 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq

125109github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

126110github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25 h1:9bCMuD3TcnjeqjPT2gSlha4asp8NvgcFRYExCaikCxk=

127111github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25/go.mod h1:eDjgYHYDJbPLBLsyZ6qRaugP0mX8vePOhZ5id1fdzJw=

128−github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=

129−github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=

130−github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=

131−github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=

132−github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=

133−github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

134−github.com/pelletier/go-toml/v2 v2.3.0 h1:k59bC/lIZREW0/iVaQR8nDHxVq8OVlIzYCOJf421CaM=

135−github.com/pelletier/go-toml/v2 v2.3.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

136−github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=

137−github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

112+github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=

113+github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

114+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=

115+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=

116+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=

117+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

118+github.com/pierrec/lz4/v4 v4.1.28 h1:pPEPwRJ4kybBTfGt28q7lQsRJQHhC08axprdLD5Ppio=

119+github.com/pierrec/lz4/v4 v4.1.28/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

138120github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

139−github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=

140−github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

141−github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=

142−github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=

121+github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=

122+github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=

143123github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=

144124github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=

145−github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=

146−github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=

147−github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=

148−github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=

149−github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=

150−github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=

125+github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=

126+github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=

127+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=

128+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=

129+github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=

130+github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=

151131github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=

152132github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=

153133github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=

@@ -162,8 +142,8 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=

162142github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=

163143github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

164144github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

165−github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=

166−github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=

145+github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=

146+github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=

167147github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=

168148github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=

169149github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=

@@ -181,74 +161,57 @@ github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV

181161github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=

182162github.com/yuin/gopher-lua v0.0.0-20190206043414-8bfc7677f583/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

183163github.com/yuin/gopher-lua v0.0.0-20191213034115-f46add6fdb5c/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

184−github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=

185−github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=

186−github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=

187−github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=

164+github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=

165+github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=

166+github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=

167+github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=

188168go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=

189169go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=

190−go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=

191−go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=

192170go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=

193−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=

194−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=

195−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=

196−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=

197−go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=

198−go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=

199−go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=

200−go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=

201−go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=

202−go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=

203−go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=

204−go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=

205−go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=

206−go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=

207−go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=

208−go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=

209−go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=

210−go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=

211−go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=

212−go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=

213−go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=

214−go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=

171+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=

172+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=

173+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=

174+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=

175+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=

176+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=

177+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=

178+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=

179+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=

180+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=

181+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=

182+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=

183+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=

215184go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=

216185go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=

217186go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

218187go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=

219188go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=

220189go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=

221−go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=

222−go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=

190+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=

191+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=

223192golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=

224193golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=

225194golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=

226−golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=

227−golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=

228−golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=

229−golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=

195+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=

196+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=

230197golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=

231198golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=

232−golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=

233−golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=

234−golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=

235−golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=

199+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=

200+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=

236201golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=

237202golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=

238203golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=

239204golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=

240205golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=

241−golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=

242−golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=

243−golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=

244−golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=

206+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=

207+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=

245208golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=

246209golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=

247210golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

248211golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

249212golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

250−golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=

251−golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

213+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=

214+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

252215golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

253216golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

254217golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

@@ -258,10 +221,8 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc

258221golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

259222golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

260223golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

261−golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=

262−golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

263−golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=

264−golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

224+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=

225+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

265226golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

266227golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

267228golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=

@@ -273,44 +234,31 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=

273234golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=

274235golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=

275236golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=

276−golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=

277−golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=

278−golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=

279−golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=

237+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=

238+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=

280239golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=

281240golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=

282241golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

283242golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=

284243golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

285244golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=

286−golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=

287−golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=

288−golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=

289−golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=

245+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=

246+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=

290247golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

291−gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=

292−gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=

293248gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=

294−google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=

295−google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=

296−google.golang.org/api v0.275.0 h1:vfY5d9vFVJeWEZT65QDd9hbndr7FyZ2+6mIzGAh71NI=

297−google.golang.org/api v0.275.0/go.mod h1:Fnag/EWUPIcJXuIkP1pjoTgS5vdxlk3eeemL7Do6bvw=

298−google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 h1:JNfk58HZ8lfmXbYK2vx/UvsqIL59TzByCxPIX4TDmsE=

299−google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:x5julN69+ED4PcFk/XWayw35O0lf/nGa4aNgODCmNmw=

249+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=

250+google.golang.org/api v0.293.0 h1:p9XIWOf63U4OgYx120ZwVU8+vl4XTPmWfgVPnmOAS9w=

251+google.golang.org/api v0.293.0/go.mod h1:6n5tjEB1gzwniZTepZ0g5u+wM7Bof5GeULCx/zh8ZE0=

300252google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=

301−google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 h1:CogIeEXn4qWYzzQU0QqvYBM8yDF9cFYzDq9ojSpv0Js=

302−google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=

303−google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=

304−google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=

305−google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

306−google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=

307−google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

308−google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=

309−google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=

310−google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=

311−google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=

312−google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=

313−google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

253+google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=

254+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU=

255+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA=

256+google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 h1:utmqiUzZAEINbLmRyAt1QjVkMyLQ+lvIwCpLaB1rZfw=

257+google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

258+google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=

259+google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=

260+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=

261+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

314262gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

315263gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=

316264gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

@@ -319,5 +267,5 @@ gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYs

319267gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

320268gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

321269gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

322−k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8=

323−k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=

270+k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=

271+k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=

pkg/apis/options/load_test.go+1−1

@@ -282,7 +282,7 @@ var _ = Describe("Load", func() {

282282 Entry("with an invalid config file", &testOptionsTableInput{

283283 configFile: []byte(`slice_option = foo`),

284284 flagSet: func() *pflag.FlagSet { return testOptionsFlagSet },

285− expectedErr: fmt.Errorf("unable to load config file: While parsing config: toml: expected 'false'"),

285+ expectedErr: fmt.Errorf("unable to load config file: While parsing config: toml: expected keyword \"false\""),

286286 expectedOutput: &TestOptions{},

287287 }),

288288 Entry("with an invalid flagset", &testOptionsTableInput{

pkg/apis/options/providers.go+6

@@ -151,6 +151,9 @@ const (

151151 // ADFSProvider is the provider type for ADFS

152152 ADFSProvider ProviderType = "adfs"

153153

154+ // AtlassianProvider is the provider type for Atlassian Cloud

155+ AtlassianProvider ProviderType = "atlassian"

156+

154157 // AzureProvider is the provider type for Azure

155158 AzureProvider ProviderType = "azure"

156159

@@ -166,6 +169,9 @@ const (

166169 // DigitalOceanProvider is the provider type for DigitalOcean

167170 DigitalOceanProvider ProviderType = "digitalocean"

168171

172+ // DTTSSOProvider is the provider type for the DTT SSO

173+ DTTSSOProvider ProviderType = "dtt-sso"

174+

169175 // FacebookProvider is the provider type for Facebook

170176 FacebookProvider ProviderType = "facebook"

171177

pkg/apis/options/upstreams.go+7−5

@@ -62,12 +62,14 @@ type Upstream struct {

6262

6363 // Path is used to map requests to the upstream server.

6464 // The closest match will take precedence and all Paths must be unique.

65− // Path can also take a pattern when used with RewriteTarget.

66− // Path segments can be captured and matched using regular experessions.

65+ // Without RewriteTarget, Path follows gorilla/mux route syntax.

6766 // Eg:

68− // - `^/foo$`: Match only the explicit path `/foo`

69− // - `^/bar/$`: Match any path prefixed with `/bar/`

70− // - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget

67+ // - `/foo`: Match only the explicit path `/foo`

68+ // - `/bar/`: Match any path prefixed with `/bar/`

69+ // - `/baz/{path:.*}`: Match any path prefixed with `/baz/`

70+ // When RewriteTarget is set, Path is treated as a regular expression.

71+ // Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the

72+ // remaining path for use with RewriteTarget.

7173 Path string `yaml:"path,omitempty"`

7274

7375 // RewriteTarget allows users to rewrite the request path before it is sent to

pkg/upstream/http.go+55−16

@@ -123,7 +123,7 @@ func (t *unixRoundTripper) RoundTrip(req *http.Request) (*http.Response, error)

123123// The proxy should render an error page if there are failures connecting to the

124124// upstream server.

125125func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler ProxyErrorHandler) http.Handler {

126− proxy := httputil.NewSingleHostReverseProxy(target)

126+ proxy := newSingleHostReverseProxy(target)

127127

128128 // Inherit default transport options from Go's stdlib

129129 transport := http.DefaultTransport.(*http.Transport).Clone()

@@ -155,7 +155,7 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr

155155 }

156156

157157 // Ensure we always pass the original request path

158− setProxyDirector(proxy)

158+ setProxyRewrite(proxy)

159159

160160 // TODO (@tuunit) - this should be inverted or get a better name in the future to set the upstream host header

161161 // only if PassHostHeader is explicitly set to true. Currently this would be a breaking change.

@@ -179,32 +179,71 @@ func newReverseProxy(target *url.URL, upstream options.Upstream, errorHandler Pr

179179 return proxy

180180}

181181

182−// setProxyUpstreamHostHeader sets the proxy.Director so that upstream requests

182+func newSingleHostReverseProxy(target *url.URL) *httputil.ReverseProxy {

183+ return &httputil.ReverseProxy{

184+ Rewrite: func(proxyReq *httputil.ProxyRequest) {

185+ proxyReq.SetURL(target)

186+ proxyReq.Out.Host = proxyReq.In.Host

187+ setProxyForwardingHeaders(proxyReq)

188+ },

189+ }

190+}

191+

192+// setProxyUpstreamHostHeader sets the proxy.Rewrite so that upstream requests

183193// receive a host header matching the target URL.

184194func setProxyUpstreamHostHeader(proxy *httputil.ReverseProxy, target *url.URL) {

185− director := proxy.Director

186− proxy.Director = func(req *http.Request) {

187− director(req)

188− req.Host = target.Host

195+ rewrite := proxy.Rewrite

196+ proxy.Rewrite = func(proxyReq *httputil.ProxyRequest) {

197+ rewrite(proxyReq)

198+ proxyReq.Out.Host = target.Host

189199 }

190200}

191201

192−// setProxyDirector sets the proxy.Director so that request URIs are escaped

202+// setProxyRewrite sets the proxy.Rewrite so that request URIs are escaped

193203// when proxying to usptream servers.

194−func setProxyDirector(proxy *httputil.ReverseProxy) {

195− director := proxy.Director

196− proxy.Director = func(req *http.Request) {

197− director(req)

204+func setProxyRewrite(proxy *httputil.ReverseProxy) {

205+ rewrite := proxy.Rewrite

206+ proxy.Rewrite = func(proxyReq *httputil.ProxyRequest) {

207+ rewrite(proxyReq)

198208 // use RequestURI so that we aren't unescaping encoded slashes in the request path

199− req.URL.Opaque = req.RequestURI

200− req.URL.RawQuery = ""

201− req.URL.ForceQuery = false

209+ proxyReq.Out.URL.Opaque = proxyReq.In.RequestURI

210+ proxyReq.Out.URL.RawQuery = ""

211+ proxyReq.Out.URL.ForceQuery = false

212+ }

213+}

214+

215+func setProxyForwardingHeaders(proxyReq *httputil.ProxyRequest) {

216+ // TODO (@tuunit): Preserve the legacy Director-based forwarding header behavior

217+ // for backwards compatibility. Harden this with saner defaults and/or

218+ // explicit flags in the future.

219+ for _, header := range []string{"Forwarded", "X-Forwarded-Host", "X-Forwarded-Proto"} {

220+ if values, ok := proxyReq.In.Header[header]; ok {

221+ proxyReq.Out.Header[header] = append([]string(nil), values...)

222+ }

223+ }

224+

225+ prior, ok := proxyReq.In.Header["X-Forwarded-For"]

226+ if ok {

227+ proxyReq.Out.Header["X-Forwarded-For"] = append([]string(nil), prior...)

228+ }

229+

230+ clientIP, _, err := net.SplitHostPort(proxyReq.In.RemoteAddr)

231+ if err != nil {

232+ return

233+ }

234+

235+ omit := ok && prior == nil

236+ if len(prior) > 0 {

237+ clientIP = strings.Join(prior, ", ") + ", " + clientIP

238+ }

239+ if !omit {

240+ proxyReq.Out.Header.Set("X-Forwarded-For", clientIP)

202241 }

203242}

204243

205244// newWebSocketReverseProxy creates a new reverse proxy for proxying websocket connections.

206245func newWebSocketReverseProxy(u *url.URL, skipTLSVerify *bool, passHostHeader *bool) http.Handler {

207− wsProxy := httputil.NewSingleHostReverseProxy(u)

246+ wsProxy := newSingleHostReverseProxy(u)

208247

209248 // Inherit default transport options from Go's stdlib

210249 transport := http.DefaultTransport.(*http.Transport).Clone()

pkg/upstream/http_test.go+55−1

@@ -361,7 +361,12 @@ var _ = Describe("HTTP Upstream Suite", func() {

361361 return http.HandlerFunc(func(_ http.ResponseWriter, req *http.Request) {

362362 proxy, ok := h.(*httputil.ReverseProxy)

363363 Expect(ok).To(BeTrue())

364− proxy.Director(req)

364+ outReq := req.Clone(req.Context())

365+ proxy.Rewrite(&httputil.ProxyRequest{

366+ In: req,

367+ Out: outReq,

368+ })

369+ req.Host = outReq.Host

365370 })

366371 }

367372 httpUpstream.handler = requestInterceptor(httpUpstream.handler)

@@ -370,6 +375,54 @@ var _ = Describe("HTTP Upstream Suite", func() {

370375 Expect(req.Host).To(Equal(strings.TrimPrefix(serverAddr, "http://")))

371376 })

372377

378+ It("ServeHTTP preserves forwarding headers when using Rewrite", func() {

379+ req := httptest.NewRequest("", "http://example.localhost/foo", nil)

380+ req.RemoteAddr = "192.0.2.10:1234"

381+ req.Header.Set("Forwarded", "for=192.0.2.1;proto=https;host=example.localhost")

382+ req.Header.Set("X-Forwarded-Host", "forwarded.example.localhost")

383+ req.Header.Set("X-Forwarded-Proto", "https")

384+ req.Header.Set("X-Forwarded-For", "192.0.2.1")

385+ req = middlewareapi.AddRequestScope(req, &middlewareapi.RequestScope{})

386+ rw := httptest.NewRecorder()

387+

388+ upstream := options.Upstream{

389+ ID: "preserveForwardedHeaders",

390+ PassHostHeader: ptr.To(true),

391+ ProxyWebSockets: ptr.To(false),

392+ InsecureSkipTLSVerify: ptr.To(false),

393+ FlushInterval: &defaultFlushInterval,

394+ Timeout: &defaultTimeout,

395+ }

396+

397+ u, err := url.Parse(serverAddr)

398+ Expect(err).ToNot(HaveOccurred())

399+

400+ handler := newHTTPUpstreamProxy(upstream, u, nil, nil)

401+ httpUpstream, ok := handler.(*httpUpstreamProxy)

402+ Expect(ok).To(BeTrue())

403+

404+ requestInterceptor := func(h http.Handler) http.Handler {

405+ return http.HandlerFunc(func(_ http.ResponseWriter, req *http.Request) {

406+ proxy, ok := h.(*httputil.ReverseProxy)

407+ Expect(ok).To(BeTrue())

408+

409+ outReq := req.Clone(req.Context())

410+ proxy.Rewrite(&httputil.ProxyRequest{

411+ In: req,

412+ Out: outReq,

413+ })

414+

415+ Expect(outReq.Header.Values("Forwarded")).To(Equal([]string{"for=192.0.2.1;proto=https;host=example.localhost"}))

416+ Expect(outReq.Header.Values("X-Forwarded-Host")).To(Equal([]string{"forwarded.example.localhost"}))

417+ Expect(outReq.Header.Values("X-Forwarded-Proto")).To(Equal([]string{"https"}))

418+ Expect(outReq.Header.Values("X-Forwarded-For")).To(Equal([]string{"192.0.2.1, 192.0.2.10"}))

419+ })

420+ }

421+ httpUpstream.handler = requestInterceptor(httpUpstream.handler)

422+

423+ httpUpstream.ServeHTTP(rw, req)

424+ })

425+

373426 type newUpstreamTableInput struct {

374427 proxyWebSockets bool

375428 flushInterval time.Duration

@@ -405,6 +458,7 @@ var _ = Describe("HTTP Upstream Suite", func() {

405458

406459 proxy, ok := upstreamProxy.handler.(*httputil.ReverseProxy)

407460 Expect(ok).To(BeTrue())

461+ Expect(proxy.Rewrite).ToNot(BeNil())

408462 Expect(proxy.FlushInterval).To(Equal(in.flushInterval))

409463 transport, ok := proxy.Transport.(*http.Transport)

410464 Expect(ok).To(BeTrue())

pkg/upstream/proxy_test.go+1−1

@@ -79,7 +79,7 @@ var _ = Describe("Proxy Suite", func() {

7979 {

8080 ID: "bad-http-backend",

8181 Path: "/bad-http/",

82− URI: "http://::1",

82+ URI: invalidServer,

8383 },

8484 {

8585 ID: "single-path-backend",

pkg/upstream/upstream_suite_test.go+1−1

@@ -24,7 +24,7 @@ var (

2424 serverAddr string

2525 unixServer *httptest.Server

2626 unixServerAddr string

27− invalidServer = "http://::1"

27+ invalidServer = "http://127.0.0.1:1"

2828)

2929

3030func TestUpstreamSuite(t *testing.T) {

pkg/validation/sessions_test.go+2−2

@@ -193,8 +193,8 @@ var _ = Describe("Sessions", func() {

193193 unreachableRedisDelMsg = "unable to delete the redis initialization key: dial tcp 127.0.0.1:65535: connect: connection refused"

194194 unreachableSentinelSetMsg = "unable to set a redis initialization key: redis: all sentinels specified in configuration are unreachable: redis: nil"

195195 unrechableSentinelDelMsg = "unable to delete the redis initialization key: redis: all sentinels specified in configuration are unreachable: redis: nil"

196− refusedSentinelSetMsg = "unable to set a redis initialization key: redis: all sentinels specified in configuration are unreachable: context deadline exceeded"

197− refusedSentinelDelMsg = "unable to delete the redis initialization key: redis: all sentinels specified in configuration are unreachable: context deadline exceeded"

196+ refusedSentinelSetMsg = "unable to set a redis initialization key: redis: all sentinels specified in configuration are unreachable: dial tcp 127.0.0.1:65535: connect: connection refused"

197+ refusedSentinelDelMsg = "unable to delete the redis initialization key: redis: all sentinels specified in configuration are unreachable: dial tcp 127.0.0.1:65535: connect: connection refused"

198198 )

199199

200200 type redisStoreTableInput struct {

providers/atlassian-cloud.gonew file+99

@@ -0,0 +1,99 @@

1+package providers

3+import (

4+ "context"

5+ "errors"

6+ "net/url"

8+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

9+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

10+)

11+

12+// AtlassianProvider represents an Atlassian Cloud based Identity Provider

13+type AtlassianProvider struct {

14+ *ProviderData

15+}

16+

17+var _ Provider = (*AtlassianProvider)(nil)

18+

19+const (

20+ atlassianProviderName = "Atlassian"

21+ atlassianDefaultScope = "read:me"

22+ atlassianPrompt = "consent"

23+ atlassianAudience = "api.atlassian.com"

24+)

25+

26+var (

27+ atlassianDefaultLoginURL = &url.URL{

28+ Scheme: "https",

29+ Host: "auth.atlassian.com",

30+ Path: "/authorize",

31+ }

32+

33+ atlassianDefaultRedeemURL = &url.URL{

34+ Scheme: "https",

35+ Host: "auth.atlassian.com",

36+ Path: "/oauth/token",

37+ }

38+

39+ // atlassianDefaultProfileURL returns the signed-in user's profile.

40+ atlassianDefaultProfileURL = &url.URL{

41+ Scheme: "https",

42+ Host: "api.atlassian.com",

43+ Path: "/me",

44+ }

45+)

46+

47+// NewAtlassianProvider initiates a new AtlassianProvider

48+func NewAtlassianProvider(p *ProviderData) *AtlassianProvider {

49+ p.setProviderDefaults(providerDefaults{

50+ name: atlassianProviderName,

51+ loginURL: atlassianDefaultLoginURL,

52+ redeemURL: atlassianDefaultRedeemURL,

53+ profileURL: atlassianDefaultProfileURL,

54+ validateURL: atlassianDefaultProfileURL,

55+ scope: atlassianDefaultScope,

56+ })

57+ return &AtlassianProvider{ProviderData: p}

58+}

59+

60+// GetLoginURL adds the audience and prompt parameters Atlassian requires.

61+func (p *AtlassianProvider) GetLoginURL(redirectURI, state, _ string, extraParams url.Values) string {

62+ params := url.Values{}

63+ for k, v := range extraParams {

64+ params[k] = v

65+ }

66+ params.Del("approval_prompt")

67+ if params.Get("prompt") == "" {

68+ params.Set("prompt", atlassianPrompt)

69+ }

70+ params.Set("audience", atlassianAudience)

71+

72+ loginURL := makeLoginURL(p.ProviderData, redirectURI, state, params)

73+ return loginURL.String()

74+}

75+

76+// EnrichSession sets the session's email from the Atlassian profile.

77+func (p *AtlassianProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {

78+ var profile struct {

79+ Email string `json:"email"`

80+ }

81+ err := requests.New(p.ProfileURL.String()).

82+ WithContext(ctx).

83+ WithHeaders(makeOIDCHeader(s.AccessToken)).

84+ Do().

85+ UnmarshalInto(&profile)

86+ if err != nil {

87+ return err

88+ }

89+ if profile.Email == "" {

90+ return errors.New("no email in Atlassian profile")

91+ }

92+ s.Email = profile.Email

93+ return nil

94+}

95+

96+// ValidateSession validates the AccessToken

97+func (p *AtlassianProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

98+ return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))

99+}

providers/atlassian-cloud_test.gonew file+93

@@ -0,0 +1,93 @@

1+package providers

3+import (

4+ "context"

5+ "net/http"

6+ "net/http/httptest"

7+ "net/url"

8+ "testing"

10+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

11+ . "github.com/onsi/gomega"

12+)

13+

14+func testAtlassianBackend(status int, body string) *httptest.Server {

15+ return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

16+ if r.URL.Path != "/me" || r.Header.Get("Authorization") != "Bearer imaginary_access_token" {

17+ w.WriteHeader(http.StatusUnauthorized)

18+ return

19+ }

20+ w.WriteHeader(status)

21+ _, _ = w.Write([]byte(body))

22+ }))

23+}

24+

25+func testAtlassianProvider(backend *httptest.Server) *AtlassianProvider {

26+ p := NewAtlassianProvider(&ProviderData{})

27+ u, _ := url.Parse(backend.URL)

28+ updateURL(p.ProfileURL, u.Host)

29+ updateURL(p.ValidateURL, u.Host)

30+ return p

31+}

32+

33+func TestNewAtlassianProvider(t *testing.T) {

34+ g := NewWithT(t)

35+

36+ providerData := NewAtlassianProvider(&ProviderData{}).Data()

37+ g.Expect(providerData.ProviderName).To(Equal("Atlassian"))

38+ g.Expect(providerData.LoginURL.String()).To(Equal("https://auth.atlassian.com/authorize"))

39+ g.Expect(providerData.RedeemURL.String()).To(Equal("https://auth.atlassian.com/oauth/token"))

40+ g.Expect(providerData.ProfileURL.String()).To(Equal("https://api.atlassian.com/me"))

41+ g.Expect(providerData.ValidateURL.String()).To(Equal("https://api.atlassian.com/me"))

42+ g.Expect(providerData.Scope).To(Equal("read:me"))

43+}

44+

45+func TestAtlassianProviderGetLoginURL(t *testing.T) {

46+ g := NewWithT(t)

47+ p := NewAtlassianProvider(&ProviderData{ClientID: "client"})

48+

49+ loginURL, err := url.Parse(p.GetLoginURL("https://proxy/oauth2/callback", "state", "",

50+ url.Values{"approval_prompt": {"force"}}))

51+ g.Expect(err).ToNot(HaveOccurred())

52+

53+ q := loginURL.Query()

54+ g.Expect(q.Get("audience")).To(Equal("api.atlassian.com"))

55+ g.Expect(q.Get("prompt")).To(Equal("consent"))

56+ g.Expect(q.Has("approval_prompt")).To(BeFalse())

57+ g.Expect(q.Get("scope")).To(Equal("read:me"))

58+

59+ loginURL, err = url.Parse(p.GetLoginURL("https://proxy/oauth2/callback", "state", "",

60+ url.Values{"prompt": {"login"}}))

61+ g.Expect(err).ToNot(HaveOccurred())

62+ g.Expect(loginURL.Query().Get("prompt")).To(Equal("login"))

63+}

64+

65+func TestAtlassianProviderEnrichSession(t *testing.T) {

66+ g := NewWithT(t)

67+ b := testAtlassianBackend(http.StatusOK, `{"account_id":"abc","email":"user@example.com"}`)

68+ defer b.Close()

69+ p := testAtlassianProvider(b)

70+

71+ session := CreateAuthorizedSession()

72+ g.Expect(p.EnrichSession(context.Background(), session)).To(Succeed())

73+ g.Expect(session.Email).To(Equal("user@example.com"))

74+}

75+

76+func TestAtlassianProviderEnrichSessionWithoutEmail(t *testing.T) {

77+ g := NewWithT(t)

78+ b := testAtlassianBackend(http.StatusOK, `{"account_id":"abc"}`)

79+ defer b.Close()

80+ p := testAtlassianProvider(b)

81+

82+ g.Expect(p.EnrichSession(context.Background(), CreateAuthorizedSession())).ToNot(Succeed())

83+}

84+

85+func TestAtlassianProviderValidateSession(t *testing.T) {

86+ g := NewWithT(t)

87+ b := testAtlassianBackend(http.StatusOK, `{"email":"user@example.com"}`)

88+ defer b.Close()

89+ p := testAtlassianProvider(b)

90+

91+ g.Expect(p.ValidateSession(context.Background(), CreateAuthorizedSession())).To(BeTrue())

92+ g.Expect(p.ValidateSession(context.Background(), &sessions.SessionState{AccessToken: "wrong"})).To(BeFalse())

93+}

providers/dtt_sso.gonew file+202

@@ -0,0 +1,202 @@

1+package providers

3+import (

4+ "bytes"

5+ "context"

6+ "encoding/base64"

7+ "errors"

8+ "fmt"

9+ "net/http"

10+ "net/url"

11+ "time"

12+

13+ "github.com/golang-jwt/jwt/v5"

14+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

15+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

16+)

17+

18+// DTTSSOProvider signs users in with the DTT SSO (auth-server).

19+type DTTSSOProvider struct {

20+ *ProviderData

21+}

22+

23+var _ Provider = (*DTTSSOProvider)(nil)

24+

25+const (

26+ dttSSOProviderName = "DTT SSO"

27+ dttSSODefaultScope = "openid"

28+)

29+

30+var (

31+ dttSSODefaultLoginURL = &url.URL{

32+ Scheme: "https",

33+ Host: "auth.thebestagent.pro",

34+ Path: "/oauth/authorize",

35+ }

36+

37+ dttSSODefaultRedeemURL = &url.URL{

38+ Scheme: "https",

39+ Host: "auth.thebestagent.pro",

40+ Path: "/oauth/token",

41+ }

42+

43+ dttSSODefaultValidateURL = &url.URL{

44+ Scheme: "https",

45+ Host: "auth.thebestagent.pro",

46+ Path: "/oauth/check_token",

47+ }

48+)

49+

50+// NewDTTSSOProvider initiates a new DTTSSOProvider

51+func NewDTTSSOProvider(p *ProviderData) *DTTSSOProvider {

52+ p.setProviderDefaults(providerDefaults{

53+ name: dttSSOProviderName,

54+ loginURL: dttSSODefaultLoginURL,

55+ redeemURL: dttSSODefaultRedeemURL,

56+ profileURL: nil,

57+ validateURL: dttSSODefaultValidateURL,

58+ scope: dttSSODefaultScope,

59+ })

60+ return &DTTSSOProvider{ProviderData: p}

61+}

62+

63+// dttSSOTokenResponse is the SSO's /oauth/token response.

64+type dttSSOTokenResponse struct {

65+ AccessToken string `json:"access_token"`

66+ RefreshToken string `json:"refresh_token"`

67+ ExpiresIn int64 `json:"expires_in"`

68+ IDToken string `json:"id_token"`

69+}

70+

71+// dttSSOClaims holds the id_token claims the provider uses.

72+type dttSSOClaims struct {

73+ jwt.RegisteredClaims

74+ Email string `json:"email"`

75+ Role string `json:"role"`

76+ UserID string `json:"user_id"`

77+}

78+

79+// Redeem exchanges the authorization code for a session.

80+func (p *DTTSSOProvider) Redeem(ctx context.Context, redirectURL, code, _ string) (*sessions.SessionState, error) {

81+ if code == "" {

82+ return nil, ErrMissingCode

83+ }

84+ return p.requestTokens(ctx, url.Values{

85+ "grant_type": {"authorization_code"},

86+ "code": {code},

87+ "redirect_uri": {redirectURL},

88+ })

89+}

90+

91+// RefreshSession renews the tokens and re-reads the email and role.

92+func (p *DTTSSOProvider) RefreshSession(ctx context.Context, s *sessions.SessionState) (bool, error) {

93+ if s == nil || s.RefreshToken == "" {

94+ return false, nil

95+ }

96+ refreshed, err := p.requestTokens(ctx, url.Values{

97+ "grant_type": {"refresh_token"},

98+ "refresh_token": {s.RefreshToken},

99+ })

100+ if err != nil {

101+ return false, fmt.Errorf("unable to redeem refresh token: %v", err)

102+ }

103+ s.AccessToken = refreshed.AccessToken

104+ s.RefreshToken = refreshed.RefreshToken

105+ s.IDToken = refreshed.IDToken

106+ s.Email = refreshed.Email

107+ s.User = refreshed.User

108+ s.Groups = refreshed.Groups

109+ s.CreatedAt = refreshed.CreatedAt

110+ s.ExpiresOn = refreshed.ExpiresOn

111+ return true, nil

112+}

113+

114+// ValidateSession checks the access token with the SSO's check_token endpoint.

115+func (p *DTTSSOProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

116+ return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))

117+}

118+

119+// requestTokens calls the token endpoint and builds a session from the verified id_token.

120+//

121+// The SSO compares the Basic credentials byte for byte, so they are sent unescaped

122+// rather than through golang.org/x/oauth2, which URL-escapes them.

123+func (p *DTTSSOProvider) requestTokens(ctx context.Context, params url.Values) (*sessions.SessionState, error) {

124+ clientSecret, err := p.GetClientSecret()

125+ if err != nil {

126+ return nil, err

127+ }

128+ credentials := base64.StdEncoding.EncodeToString([]byte(p.ClientID + ":" + clientSecret))

129+

130+ result := requests.New(p.RedeemURL.String()).

131+ WithContext(ctx).

132+ WithMethod(http.MethodPost).

133+ WithBody(bytes.NewBufferString(params.Encode())).

134+ SetHeader("Content-Type", "application/x-www-form-urlencoded").

135+ SetHeader("Authorization", "Basic "+credentials).

136+ Do()

137+ if result.Error() != nil {

138+ return nil, result.Error()

139+ }

140+ if result.StatusCode() != http.StatusOK {

141+ return nil, fmt.Errorf("token request failed: status %d - %s", result.StatusCode(), result.Body())

142+ }

143+

144+ var token dttSSOTokenResponse

145+ if err := result.UnmarshalInto(&token); err != nil {

146+ return nil, err

147+ }

148+ if token.AccessToken == "" {

149+ return nil, errors.New("token response carried no access_token")

150+ }

151+ claims, err := p.verifyIDToken(token.IDToken, clientSecret)

152+ if err != nil {

153+ return nil, err

154+ }

155+

156+ s := &sessions.SessionState{

157+ AccessToken: token.AccessToken,

158+ RefreshToken: token.RefreshToken,

159+ IDToken: token.IDToken,

160+ Email: claims.Email,

161+ User: claims.UserID,

162+ }

163+ if claims.Role != "" {

164+ s.Groups = []string{claims.Role}

165+ }

166+ s.CreatedAtNow()

167+ if token.ExpiresIn > 0 {

168+ s.ExpiresIn(time.Duration(token.ExpiresIn) * time.Second)

169+ }

170+ return s, nil

171+}

172+

173+// verifyIDToken checks the id_token's HS256 signature (keyed on the client secret),

174+// issuer, audience and expiry.

175+//

176+// go-jose is not used: it rejects HMAC keys under 32 bytes, and SSO client secrets

177+// can be shorter.

178+func (p *DTTSSOProvider) verifyIDToken(raw, clientSecret string) (*dttSSOClaims, error) {

179+ if raw == "" {

180+ return nil, errors.New("token response carried no id_token; the scope must be exactly \"openid\"")

181+ }

182+ var claims dttSSOClaims

183+ _, err := jwt.ParseWithClaims(raw, &claims,

184+ func(*jwt.Token) (any, error) { return []byte(clientSecret), nil },

185+ jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),

186+ jwt.WithIssuer(p.issuer()),

187+ jwt.WithAudience(p.ClientID),

188+ jwt.WithExpirationRequired(),

189+ )

190+ if err != nil {

191+ return nil, fmt.Errorf("verifying id_token: %v", err)

192+ }

193+ if claims.Email == "" {

194+ return nil, errors.New("id_token carries no email")

195+ }

196+ return &claims, nil

197+}

198+

199+// issuer is the SSO's site host, the origin of the login URL.

200+func (p *DTTSSOProvider) issuer() string {

201+ return p.LoginURL.Scheme + "://" + p.LoginURL.Host

202+}

providers/dtt_sso_test.gonew file+237

@@ -0,0 +1,237 @@

1+package providers

3+import (

4+ "context"

5+ "encoding/base64"

6+ "encoding/json"

7+ "net/http"

8+ "net/http/httptest"

9+ "net/url"

10+ "testing"

11+ "time"

12+

13+ "github.com/golang-jwt/jwt/v5"

14+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

15+ . "github.com/onsi/gomega"

16+)

17+

18+const (

19+ dttSSOTestClientID = "redash-gate"

20+ // Shorter than 32 bytes, and contains characters golang.org/x/oauth2 would

21+ // URL-escape in Basic auth.

22+ dttSSOTestSecret = "s3cr+t/abc=="

23+)

24+

25+// dttSSOTestServer mimics the SSO's token and check_token endpoints.

26+type dttSSOTestServer struct {

27+ *httptest.Server

28+ claims map[string]interface{}

29+ signingKey []byte

30+ lastForm url.Values

31+ validTokens map[string]bool

32+ tokenCounter int

33+}

34+

35+func newDTTSSOTestServer() *dttSSOTestServer {

36+ s := &dttSSOTestServer{

37+ signingKey: []byte(dttSSOTestSecret),

38+ validTokens: map[string]bool{},

39+ }

40+ s.Server = httptest.NewServer(http.HandlerFunc(s.handle))

41+ u, _ := url.Parse(s.URL)

42+ s.claims = map[string]interface{}{

43+ "iss": "http://" + u.Host,

44+ "aud": dttSSOTestClientID,

45+ "sub": "0b5c1e1a-1111-2222-3333-444455556666",

46+ "user_id": "0b5c1e1a-1111-2222-3333-444455556666",

47+ "email": "admin@example.com",

48+ "role": "dtt_admin",

49+ "exp": time.Now().Add(time.Hour).Unix(),

50+ }

51+ return s

52+}

53+

54+func (s *dttSSOTestServer) handle(w http.ResponseWriter, r *http.Request) {

55+ switch r.URL.Path {

56+ case "/oauth/token":

57+ want := "Basic " + base64.StdEncoding.EncodeToString([]byte(dttSSOTestClientID+":"+dttSSOTestSecret))

58+ if r.Header.Get("Authorization") != want {

59+ w.WriteHeader(http.StatusUnauthorized)

60+ return

61+ }

62+ _ = r.ParseForm()

63+ s.lastForm = r.PostForm

64+ if r.PostForm.Get("grant_type") == "refresh_token" && !s.validTokens["refresh-"+r.PostForm.Get("refresh_token")] {

65+ w.WriteHeader(http.StatusBadRequest)

66+ _, _ = w.Write([]byte(`{"error":"invalid_grant","error_description":"Invalid refresh token"}`))

67+ return

68+ }

69+ s.tokenCounter++

70+ access := "access-" + string(rune('0'+s.tokenCounter))

71+ refresh := "refresh-" + string(rune('0'+s.tokenCounter))

72+ s.validTokens[access] = true

73+ s.validTokens["refresh-"+refresh] = true

74+ w.Header().Set("Content-Type", "application/json")

75+ _ = json.NewEncoder(w).Encode(map[string]interface{}{

76+ "access_token": access,

77+ "token_type": "bearer",

78+ "expires_in": 3600,

79+ "refresh_token": refresh,

80+ "id_token": s.idToken(),

81+ "scope": "openid",

82+ })

83+ case "/oauth/check_token":

84+ token := r.Header.Get("Authorization")

85+ if len(token) > len("Bearer ") && s.validTokens[token[len("Bearer "):]] {

86+ _, _ = w.Write([]byte(`{"user_id":"0b5c1e1a-1111-2222-3333-444455556666","real_user_id":null,"issued_by":"redash-gate"}`))

87+ return

88+ }

89+ w.WriteHeader(http.StatusUnauthorized)

90+ _, _ = w.Write([]byte("Invalid access token"))

91+ default:

92+ w.WriteHeader(http.StatusNotFound)

93+ }

94+}

95+

96+func (s *dttSSOTestServer) idToken() string {

97+ if s.claims == nil {

98+ return ""

99+ }

100+ raw, err := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims(s.claims)).SignedString(s.signingKey)

101+ if err != nil {

102+ panic(err)

103+ }

104+ return raw

105+}

106+

107+func testDTTSSOProvider(server *dttSSOTestServer) *DTTSSOProvider {

108+ p := NewDTTSSOProvider(&ProviderData{ClientID: dttSSOTestClientID, ClientSecret: dttSSOTestSecret})

109+ u, _ := url.Parse(server.URL)

110+ updateURL(p.LoginURL, u.Host)

111+ updateURL(p.RedeemURL, u.Host)

112+ updateURL(p.ValidateURL, u.Host)

113+ return p

114+}

115+

116+func TestNewDTTSSOProvider(t *testing.T) {

117+ g := NewWithT(t)

118+

119+ providerData := NewDTTSSOProvider(&ProviderData{}).Data()

120+ g.Expect(providerData.ProviderName).To(Equal("DTT SSO"))

121+ g.Expect(providerData.LoginURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/authorize"))

122+ g.Expect(providerData.RedeemURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/token"))

123+ g.Expect(providerData.ValidateURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/check_token"))

124+ g.Expect(providerData.Scope).To(Equal("openid"))

125+}

126+

127+func TestDTTSSOProviderRedeem(t *testing.T) {

128+ g := NewWithT(t)

129+ server := newDTTSSOTestServer()

130+ defer server.Close()

131+ p := testDTTSSOProvider(server)

132+

133+ s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

134+ g.Expect(err).ToNot(HaveOccurred())

135+ g.Expect(s.Email).To(Equal("admin@example.com"))

136+ g.Expect(s.User).To(Equal("0b5c1e1a-1111-2222-3333-444455556666"))

137+ g.Expect(s.Groups).To(Equal([]string{"dtt_admin"}))

138+ g.Expect(s.AccessToken).To(Equal("access-1"))

139+ g.Expect(s.RefreshToken).To(Equal("refresh-1"))

140+ g.Expect(s.IDToken).ToNot(BeEmpty())

141+ g.Expect(s.ExpiresOn).ToNot(BeNil())

142+ g.Expect(*s.ExpiresOn).To(BeTemporally("~", time.Now().Add(time.Hour), time.Minute))

143+

144+ g.Expect(server.lastForm.Get("grant_type")).To(Equal("authorization_code"))

145+ g.Expect(server.lastForm.Get("code")).To(Equal("the-code"))

146+ g.Expect(server.lastForm.Get("redirect_uri")).To(Equal("https://redash.example.com/oauth2/callback"))

147+}

148+

149+func TestDTTSSOProviderRedeemRejectsBadIDTokens(t *testing.T) {

150+ testCases := map[string]func(s *dttSSOTestServer){

151+ "signed with another secret": func(s *dttSSOTestServer) { s.signingKey = []byte("some-other-client-secret") },

152+ "other audience": func(s *dttSSOTestServer) { s.claims["aud"] = "frappe-gate" },

153+ "other issuer": func(s *dttSSOTestServer) { s.claims["iss"] = "https://evil.example.com" },

154+ "expired": func(s *dttSSOTestServer) { s.claims["exp"] = time.Now().Add(-time.Minute).Unix() },

155+ "no email": func(s *dttSSOTestServer) { delete(s.claims, "email") },

156+ "no id_token": func(s *dttSSOTestServer) { s.claims = nil },

157+ }

158+ for name, tamper := range testCases {

159+ t.Run(name, func(t *testing.T) {

160+ g := NewWithT(t)

161+ server := newDTTSSOTestServer()

162+ defer server.Close()

163+ tamper(server)

164+

165+ _, err := testDTTSSOProvider(server).Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

166+ g.Expect(err).To(HaveOccurred())

167+ })

168+ }

169+}

170+

171+func TestDTTSSOProviderRedeemRejectsUnsignedIDToken(t *testing.T) {

172+ g := NewWithT(t)

173+ server := newDTTSSOTestServer()

174+ defer server.Close()

175+ p := testDTTSSOProvider(server)

176+

177+ header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none"}`))

178+ payload, _ := json.Marshal(server.claims)

179+ unsigned := header + "." + base64.RawURLEncoding.EncodeToString(payload) + "."

180+

181+ _, err := p.verifyIDToken(unsigned, dttSSOTestSecret)

182+ g.Expect(err).To(HaveOccurred())

183+}

184+

185+func TestDTTSSOProviderRefreshSession(t *testing.T) {

186+ g := NewWithT(t)

187+ server := newDTTSSOTestServer()

188+ defer server.Close()

189+ p := testDTTSSOProvider(server)

190+

191+ s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

192+ g.Expect(err).ToNot(HaveOccurred())

193+ nonce := []byte("keep-me")

194+ s.Nonce = nonce

195+

196+ server.claims["role"] = "agent"

197+ server.claims["email"] = "renamed@example.com"

198+ refreshed, err := p.RefreshSession(context.Background(), s)

199+ g.Expect(err).ToNot(HaveOccurred())

200+ g.Expect(refreshed).To(BeTrue())

201+ g.Expect(s.AccessToken).To(Equal("access-2"))

202+ g.Expect(s.RefreshToken).To(Equal("refresh-2"))

203+ g.Expect(s.Groups).To(Equal([]string{"agent"}))

204+ g.Expect(s.Email).To(Equal("renamed@example.com"))

205+ g.Expect(s.Nonce).To(Equal(nonce))

206+ g.Expect(server.lastForm.Get("grant_type")).To(Equal("refresh_token"))

207+ g.Expect(server.lastForm.Get("refresh_token")).To(Equal("refresh-1"))

208+}

209+

210+func TestDTTSSOProviderRefreshSessionFailures(t *testing.T) {

211+ g := NewWithT(t)

212+ server := newDTTSSOTestServer()

213+ defer server.Close()

214+ p := testDTTSSOProvider(server)

215+

216+ refreshed, err := p.RefreshSession(context.Background(), &sessions.SessionState{})

217+ g.Expect(err).ToNot(HaveOccurred())

218+ g.Expect(refreshed).To(BeFalse())

219+

220+ refreshed, err = p.RefreshSession(context.Background(), &sessions.SessionState{RefreshToken: "revoked"})

221+ g.Expect(err).To(HaveOccurred())

222+ g.Expect(refreshed).To(BeFalse())

223+}

224+

225+func TestDTTSSOProviderValidateSession(t *testing.T) {

226+ g := NewWithT(t)

227+ server := newDTTSSOTestServer()

228+ defer server.Close()

229+ p := testDTTSSOProvider(server)

230+

231+ s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

232+ g.Expect(err).ToNot(HaveOccurred())

233+ g.Expect(p.ValidateSession(context.Background(), s)).To(BeTrue())

234+

235+ delete(server.validTokens, s.AccessToken)

236+ g.Expect(p.ValidateSession(context.Background(), s)).To(BeFalse())

237+}

providers/providers.go+7−3

@@ -40,6 +40,8 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

4040 switch providerConfig.Type {

4141 case options.ADFSProvider:

4242 return NewADFSProvider(providerData, providerConfig), nil

43+ case options.AtlassianProvider:

44+ return NewAtlassianProvider(providerData), nil

4345 case options.AzureProvider:

4446 return NewAzureProvider(providerData, providerConfig.AzureConfig), nil

4547 case options.MicrosoftEntraIDProvider:

@@ -50,6 +52,8 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

5052 return NewCIDAASProvider(providerData, providerConfig), nil

5153 case options.DigitalOceanProvider:

5254 return NewDigitalOceanProvider(providerData), nil

55+ case options.DTTSSOProvider:

56+ return NewDTTSSOProvider(providerData), nil

5357 case options.FacebookProvider:

5458 return NewFacebookProvider(providerData), nil

5559 case options.GitHubProvider:

@@ -189,9 +193,9 @@ func parseCodeChallengeMethod(providerConfig options.Provider) string {

189193

190194func providerRequiresOIDCProviderVerifier(providerType options.ProviderType) (bool, error) {

191195 switch providerType {

192− case options.BitbucketProvider, options.DigitalOceanProvider, options.FacebookProvider, options.GitHubProvider,

193− options.GoogleProvider, options.KeycloakProvider, options.LinkedInProvider, options.LoginGovProvider,

194− options.NextCloudProvider, options.SourceHutProvider:

196+ case options.AtlassianProvider, options.BitbucketProvider, options.DigitalOceanProvider, options.DTTSSOProvider,

197+ options.FacebookProvider, options.GitHubProvider, options.GoogleProvider, options.KeycloakProvider,

198+ options.LinkedInProvider, options.LoginGovProvider, options.NextCloudProvider, options.SourceHutProvider:

195199 return false, nil

196200 case options.OIDCProvider, options.ADFSProvider, options.AzureProvider, options.CidaasProvider,

197201 options.GitLabProvider, options.KeycloakOIDCProvider, options.MicrosoftEntraIDProvider: