master..14af295 · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

45 files changed+436−1043

unifiedsplit

.github/renovate.json5−9

@@ -46,15 +46,6 @@

4646 depNameTemplate: "alpine",

4747 datasourceTemplate: "docker",

4848 },

49− {

50− customType: "regex",

51− fileMatch: [

52− "^Makefile",

53− ],

54− matchStrings: [

55− "# renovate: datasource=(?<datasource>.*?) depName=(?<depName>.*?)\\s+?GOLANGCILINT_VERSION \\?= (?<currentValue>.*)\\s",

56− ],

57− },

5849 {

5950 customType: "regex",

6051 fileMatch: ["(^|/)\\.github/workflows/[^/]+\\.ya?ml$"],

.github/workflows/ci.yml+14−8

@@ -19,7 +19,7 @@ jobs:

1919 runs-on: ubuntu-latest

2020 steps:

2121 - name: Check out code

22− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

22+ uses: actions/checkout@v7

2323 with:

2424 fetch-depth: 0

2525

@@ -30,11 +30,17 @@ jobs:

3030 id: go-version

3131

3232 - name: Set up Go

33− uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

33+ uses: actions/setup-go@v6

3434 with:

3535 go-version: ${{ steps.go-version.outputs.version }}

3636 check-latest: true

3737

38+ - name: Install golangci-lint

39+ uses: golangci/golangci-lint-action@v9

40+ with:

41+ install-only: true

42+ version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint

43+

3844 - name: Verify Code Generation

3945 run: |

4046 make verify-generate

@@ -68,14 +74,14 @@ jobs:

6874

6975 - name: Upload Coverage Report

7076 if: github.event_name == 'push'

71− uses: qltysh/qlty-action/coverage@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0

77+ uses: qltysh/qlty-action/coverage@v2

7278 with:

7379 oidc: true

7480 files: lcov.info

7581

7682 - name: Run Trivy vulnerability scanner

7783 if: (!startsWith(github.head_ref, 'release'))

78− uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0

84+ uses: aquasecurity/trivy-action@0.35.0

7985 with:

8086 scan-type: 'rootfs'

8187 scan-ref: './oauth2-proxy'

@@ -87,7 +93,7 @@ jobs:

8793

8894 - name: Upload Trivy scan results

8995 if: (!startsWith(github.head_ref, 'release'))

90− uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

96+ uses: github/codeql-action/upload-sarif@v4

9197 with:

9298 sarif_file: 'trivy-results.sarif'

9399

@@ -95,16 +101,16 @@ jobs:

95101 runs-on: ubuntu-latest

96102 steps:

97103 - name: Check out code

98− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

104+ uses: actions/checkout@v7

99105 with:

100106 fetch-depth: 0

101107

102108 - name: Set up QEMU

103− uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

109+ uses: docker/setup-qemu-action@v3

104110

105111 - name: Set up Docker Buildx

106112 id: buildx

107− uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

113+ uses: docker/setup-buildx-action@v3

108114

109115 - name: Docker Build

110116 if: (!startsWith(github.head_ref, 'release'))

.github/workflows/codeql.yml+4−4

@@ -32,18 +32,18 @@ jobs:

3232

3333 steps:

3434 - name: Checkout repository

35− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

35+ uses: actions/checkout@v7

3636

3737 # Initializes the CodeQL tools for scanning.

3838 - name: Initialize CodeQL

39− uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

39+ uses: github/codeql-action/init@v3

4040 with:

4141 languages: go

4242

4343 # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).

4444 # If this step fails, then you should remove it and run the build manually (see below)

4545 - name: Autobuild

46− uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

46+ uses: github/codeql-action/autobuild@v3

4747

4848 # ℹ️ Command-line programs to run using the OS shell.

4949 # 📚 https://git.io/JvXDl

@@ -57,4 +57,4 @@ jobs:

5757 # make release

5858

5959 - name: Perform CodeQL Analysis

60− uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

60+ uses: github/codeql-action/analyze@v3

.github/workflows/create-release.yml+2−2

@@ -17,7 +17,7 @@ jobs:

1717 runs-on: ubuntu-latest

1818 steps:

1919 - name: Check out code

20− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

20+ uses: actions/checkout@v7

2121 with:

2222 ref: master

2323 fetch-depth: 0

@@ -54,7 +54,7 @@ jobs:

5454 git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"

5555

5656 - name: Setup node

57− uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

57+ uses: actions/setup-node@v6

5858 with:

5959 node-version-file: docs/package.json

6060

.github/workflows/docs.yml+7−7

@@ -14,13 +14,13 @@ jobs:

1414 if: github.event_name == 'pull_request'

1515 runs-on: ubuntu-latest

1616 steps:

17− - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

17+ - uses: actions/checkout@v7

1818

1919 - name: Setup Pages

2020 id: pages

21− uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

21+ uses: actions/configure-pages@v5

2222

23− - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

23+ - uses: actions/setup-node@v6

2424 with:

2525 # renovate: datasource=node-version depName=node

2626 node-version: 24

@@ -35,9 +35,9 @@ jobs:

3535 if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'

3636 runs-on: ubuntu-latest

3737 steps:

38− - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

38+ - uses: actions/checkout@v7

3939

40− - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

40+ - uses: actions/setup-node@v6

4141 with:

4242 # renovate: datasource=node-version depName=node

4343 node-version: 24

@@ -49,7 +49,7 @@ jobs:

4949 npm run build

5050

5151 - name: Upload artifact

52− uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0

52+ uses: actions/upload-pages-artifact@v5

5353 with:

5454 path: ./docs/build

5555

@@ -65,4 +65,4 @@ jobs:

6565 steps:

6666 - name: Deploy to GitHub Pages

6767 id: deployment

68− uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

68+ uses: actions/deploy-pages@v4

.github/workflows/labeler.yml+1−1

@@ -9,7 +9,7 @@ jobs:

99 pull-requests: write

1010 runs-on: ubuntu-latest

1111 steps:

12− - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0

12+ - uses: actions/labeler@v6

1313 with:

1414 sync-labels: true

1515 dot: true

.github/workflows/nightly.yml+4−4

@@ -12,21 +12,21 @@ jobs:

1212 if: github.repository == 'oauth2-proxy/oauth2-proxy'

1313 steps:

1414 - name: Check out code

15− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

15+ uses: actions/checkout@v7

1616 with:

1717 ref: master

1818 fetch-depth: 0

1919 fetch-tags: true

2020

2121 - name: Set up QEMU

22− uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

22+ uses: docker/setup-qemu-action@v3

2323

2424 - name: Set up Docker Buildx

2525 id: buildx

26− uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

26+ uses: docker/setup-buildx-action@v3

2727

2828 - name: Login to quay.io

29− uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

29+ uses: docker/login-action@v3

3030 with:

3131 registry: quay.io/oauth2-proxy

3232 username: ${{ secrets.REGISTRY_USERNAME_NIGHTLY }}

.github/workflows/publish-release.yml+13−7

@@ -20,7 +20,7 @@ jobs:

2020 tag: ${{ steps.tag.outputs.version }}

2121 steps:

2222 - name: Check out code

23− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

23+ uses: actions/checkout@v7

2424 with:

2525 ref: ${{ github.event.pull_request.merge_commit_sha }}

2626 fetch-depth: 0

@@ -50,11 +50,17 @@ jobs:

5050 id: go-version

5151

5252 - name: Set up Go

53− uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

53+ uses: actions/setup-go@v6

5454 with:

5555 go-version: ${{ steps.go-version.outputs.version }}

5656 check-latest: true

5757

58+ - name: Install golangci-lint

59+ uses: golangci/golangci-lint-action@v9

60+ with:

61+ install-only: true

62+ version: v2.11.4 # renovate: datasource=github-tags depName=golangci/golangci-lint

63+

5864 - name: Get go dependencies

5965 run: |

6066 go mod download

@@ -64,7 +70,7 @@ jobs:

6470

6571 # Upload artifacts in case of workflow failure

6672 - name: Upload Artifacts

67− uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

73+ uses: actions/upload-artifact@v7

6874 with:

6975 name: oauth2-proxy-artifacts

7076 path: |

@@ -100,21 +106,21 @@ jobs:

100106 runs-on: ubuntu-latest

101107 steps:

102108 - name: Check out code

103− uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

109+ uses: actions/checkout@v7

104110 with:

105111 ref: ${{ needs.publish.outputs.tag }}

106112 fetch-depth: 0

107113 fetch-tags: true

108114

109115 - name: Set up QEMU

110− uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

116+ uses: docker/setup-qemu-action@v3

111117

112118 - name: Set up Docker Buildx

113119 id: buildx

114− uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

120+ uses: docker/setup-buildx-action@v3

115121

116122 - name: Login to quay.io

117− uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

123+ uses: docker/login-action@v3

118124 with:

119125 registry: quay.io/oauth2-proxy

120126 username: ${{ secrets.REGISTRY_USERNAME }}

.github/workflows/stale.yml+1−1

@@ -10,7 +10,7 @@ jobs:

1010 runs-on: ubuntu-latest

1111

1212 steps:

13− - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0

13+ - uses: actions/stale@v10

1414 with:

1515 repo-token: ${{ secrets.GITHUB_TOKEN }}

1616 days-before-stale: 180

CHANGELOG.md−27

@@ -6,35 +6,8 @@

77## Breaking Changes

9−## Changes since v7.15.4

10−

11−# V7.15.4

12−

13−## Release Highlights

14−

15−- 🔵 Golang version upgrade to v1.26.7

16− - Upgrade of all dependencies to their latest versions

17−- 🕵️‍♀️ Vulnerabilities have been addressed

18− - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818)

19− - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821)

20− - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822)

21− - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505)

22− - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600)

23− - [CVE-2026-56852](https://nvd.nist.gov/vuln/detail/CVE-2026-56852)

24− - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853)

25− - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858)

26− - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859)

27− - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860)

28− - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862)

29−

30−## Important Notes

31−

32−## Breaking Changes

33−

349## Changes since v7.15.3

3510

36−- [#3493](https://github.com/oauth2-proxy/oauth2-proxy/pull/3493) chore(deps): update gomod @tuunit

37−

3811# V7.15.3

3912

4013## Release Highlights

Makefile+4−9

@@ -25,8 +25,7 @@ help: ## Display this help

2525

2626

2727GO ?= go

28−# renovate: datasource=github-tags depName=golangci/golangci-lint

29−GOLANGCILINT_VERSION ?= v2.11.4

28+GOLANGCILINT ?= golangci-lint

3029

3130BINARY := oauth2-proxy

3231VERSION ?= $(shell git describe --always --dirty --tags 2>/dev/null || echo "undefined")

@@ -67,7 +66,7 @@ DOCKER_BUILDX_PUSH := $(DOCKER_BUILDX) --push

6766DOCKER_BUILDX_PUSH_X_PLATFORM := $(DOCKER_BUILDX_PUSH) --platform ${DOCKER_BUILD_PLATFORM}

6867

6968DOCKER_BUILD_PLATFORM_ALPINE ?= linux/amd64,linux/arm64,linux/ppc64le,linux/arm/v6,linux/arm/v7,linux/s390x

70−DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.24.1

69+DOCKER_BUILD_RUNTIME_IMAGE_ALPINE ?= alpine:3.23.3

7170DOCKER_BUILDX_ARGS_ALPINE ?= --build-arg RUNTIME_IMAGE=${DOCKER_BUILD_RUNTIME_IMAGE_ALPINE} ${DOCKER_BUILDX_COMMON_ARGS}

7271DOCKER_BUILDX_X_PLATFORM_ALPINE := docker buildx build ${DOCKER_BUILDX_ARGS_ALPINE} --platform ${DOCKER_BUILD_PLATFORM_ALPINE}

7372DOCKER_BUILDX_PUSH_X_PLATFORM_ALPINE := $(DOCKER_BUILDX_X_PLATFORM_ALPINE) --push

@@ -144,7 +143,7 @@ verify-generate: generate ## Verify command to check if alpha config docs are in

144143##@ Miscellaneous

145144

146145.PHONY: test

147−test: ## Run all Go tests

146+test: lint ## Run all Go tests

148147 GO111MODULE=on $(GO) test $(TESTCOVER) -v -race ./...

149148

150149.PHONY: release

@@ -158,11 +157,7 @@ clean: ## Cleanup release and build files

158157

159158.PHONY: lint

160159lint: validate-go-version ## Lint all files using golangci-lint

161− GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m

162−

163−.PHONY: lint-fix

164−lint-fix: validate-go-version ## Lint all files and apply fixes using golangci-lint

165− GO111MODULE=on $(GO) run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCILINT_VERSION) run --timeout 10m --fix

160+ GO111MODULE=on $(GOLANGCILINT) run

166161

167162.PHONY: validate-go-version

168163validate-go-version: ## Validate Go environment requirements

README.md+1−1

@@ -51,7 +51,7 @@ Microsoft Azure credits for open source projects

5151## Getting Involved

5252[![Slack](https://img.shields.io/badge/slack-CNCF_%23oauth2--proxy-blue?logo=slack)](https://cloud-native.slack.com/archives/C098Y5URZ2N)

5353

54−Join the #oauth2-proxy [Slack channel](https://cloud-native.slack.com/archives/C098Y5URZ2N) to chat with other users of OAuth2 Proxy or reach out to the maintainers directly. Use the [public invite link](https://slack.cncf.io/) to get an invite for the CNCF space.

54+Join the #oauth2-proxy [Slack channel](https://cloud-native.slack.com/archives/C098Y5URZ2N) to chat with other users of OAuth2 Proxy or reach out to the maintainers directly. Use the [public invite link](https://communityinviter.com/apps/cloud-native/cncf) to get an invite for the Gopher Slack space.

5555

5656OAuth2 Proxy is a community-driven project. We rely on the contribut️ions of our users to continually improve it. While review times can vary, we appreciate your patience and understanding. As a volunteer-driven project, we strive to keep this project stable and might take longer to merge changes.

5757

contrib/local-environment/Makefile+2−2

@@ -49,8 +49,8 @@ kubernetes-down:

4949

5050.PHONY: traefik-up

5151traefik-up:

52− docker compose -f docker-compose-traefik.yaml up -d

52+ docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml up -d

5353

5454.PHONY: traefik-%

5555traefik-%:

56− docker compose -f docker-compose-traefik.yaml $*

56+ docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml $*

contrib/local-environment/dex-traefik.yamldeleted−25

@@ -1,25 +0,0 @@

1−# This configuration is intended to be used with the Traefik local environment.

2−# Dex uses in-memory storage because this environment is disposable.

3−issuer: http://dex.localtest.me/dex

4−storage:

5− type: memory

6−web:

7− http: 0.0.0.0:5556

8−oauth2:

9− skipApprovalScreen: true

10−expiry:

11− signingKeys: "4h"

12− idTokens: "1h"

13−staticClients:

14− - id: oauth2-proxy

15− redirectURIs:

16− - "http://oauth2-proxy.localtest.me/oauth2/callback"

17− name: "OAuth2 Proxy"

18− secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

19−enablePasswordDB: true

20−staticPasswords:

21− - email: "admin@example.com"

22− # bcrypt hash of the string "password"

23− hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"

24− username: "admin"

25− userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"

contrib/local-environment/dex.yaml+6−1

@@ -3,7 +3,11 @@

33# This should configure Dex to run on port 5556 and provides a static login

44issuer: http://dex.localtest.me:5556/dex

55storage:

6− type: memory

6+ type: etcd

7+ config:

8+ endpoints:

9+ - http://etcd:2379

10+ namespace: dex/

711web:

812 http: 0.0.0.0:5556

913oauth2:

@@ -17,6 +21,7 @@ staticClients:

1721 # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.

1822 - "http://oauth2-proxy.localtest.me:4180/oauth2/callback" # For basic proxy example.

1923 - "http://oauth2-proxy.localtest.me:8080/oauth2/callback" # For nginx example.

24+ - "http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback" # For traefik example.

2025 name: "OAuth2 Proxy"

2126 secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

2227enablePasswordDB: true

contrib/local-environment/docker-compose-alpha-config.yaml+15−2

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# HTTPBin as an example upstream.

4+# etcd for storage for Dex and HTTPBin as an example upstream.

55# This file also uses alpha configuration when configuring OAuth2 Proxy.

66#

77# This file is an extension of the main compose file and must be used with it

@@ -14,7 +14,7 @@ version: "3.0"

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

1818 command: --config /oauth2-proxy.cfg --alpha-config /oauth2-proxy-alpha-config.yaml

1919 hostname: oauth2-proxy

2020 volumes:

@@ -43,12 +43,25 @@ services:

4343 dex:

4444 aliases:

4545 - dex.localtest.me

46+ etcd: {}

47+ depends_on:

48+ - etcd

4649 httpbin:

4750 container_name: httpbin

4851 image: kennethreitz/httpbin

4952 ports: []

5053 networks:

5154 httpbin: {}

55+ etcd:

56+ container_name: etcd

57+ image: gcr.io/etcd-development/etcd:v3.6.12

58+ entrypoint: /usr/local/bin/etcd

59+ command:

60+ - --listen-client-urls=http://0.0.0.0:2379

61+ - --advertise-client-urls=http://etcd:2379

62+ networks:

63+ etcd: {}

5264networks:

5365 dex: {}

66+ etcd: {}

5467 httpbin: {}

contrib/local-environment/docker-compose-gitea.yaml+2−2

@@ -14,7 +14,7 @@ version: '3.0'

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

1818 command: --config /oauth2-proxy.cfg

1919 hostname: oauth2-proxy

2020 volumes:

@@ -39,7 +39,7 @@ services:

3939 httpbin: {}

4040

4141 gitea:

42− image: gitea/gitea:1.27.2

42+ image: gitea/gitea:1.26.2

4343 container_name: gitea

4444 environment:

4545 - USER_UID=1000

contrib/local-environment/docker-compose-keycloak.yaml+2−2

@@ -14,7 +14,7 @@ version: "3.0"

1414services:

1515 oauth2-proxy:

1616 container_name: oauth2-proxy

17− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

17+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

1818 command: --config /oauth2-proxy.cfg

1919 hostname: oauth2-proxy

2020 volumes:

@@ -40,7 +40,7 @@ services:

4040

4141 keycloak:

4242 container_name: keycloak

43− image: keycloak/keycloak:26.7

43+ image: keycloak/keycloak:25.0

4444 hostname: keycloak

4545 command:

4646 - "start-dev"

contrib/local-environment/docker-compose-nginx.yaml+28−3

@@ -1,18 +1,28 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# nginx as a reverse proxy and other HTTP services for upstreams.

4+# etcd for storage for Dex, nginx as a reverse proxy and other http services for upstreams

55#

66# This file is an extension of the main compose file and must be used with it

77# docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml <command>

88# Alternatively:

99# make nginx-<command> (eg make nginx-up, make nginx-down)

1010#

11−# Access http://oauth2-proxy.localtest.me:8080 to initiate a login flow.

11+# Access one of the following URLs to initiate a login flow:

12+# - http://oauth2-proxy.localhost

13+# - http://httpbin.oauth2-proxy.localhost

14+#

15+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16+#

17+# Note, the above URLs should work with Chrome, but you may need to add hosts

18+# entries for other browsers

19+# 127.0.0.1 oauth2-proxy.localhost

20+# 127.0.0.1 httpbin.oauth2-proxy.localhost

21+# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

1222version: "3.0"

1323services:

1424 oauth2-proxy:

15− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

25+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

1626 ports: []

1727 hostname: oauth2-proxy

1828 container_name: oauth2-proxy

@@ -23,6 +33,7 @@ services:

2333 networks:

2434 oauth2-proxy: {}

2535 dex: {}

36+ etcd: {}

2637 httpbin: {}

2738 depends_on:

2839 - dex

@@ -41,6 +52,7 @@ services:

4152 networks:

4253 oauth2-proxy: {}

4354 dex: {}

55+ etcd: {}

4456 httpbin: {}

4557 dex:

4658 container_name: dex

@@ -56,13 +68,26 @@ services:

5668 dex:

5769 aliases:

5870 - dex.localtest.me

71+ etcd: {}

72+ depends_on:

73+ - etcd

5974 httpbin:

6075 container_name: httpbin

6176 image: kennethreitz/httpbin

6277 ports: []

6378 networks:

6479 httpbin: {}

80+ etcd:

81+ container_name: etcd

82+ image: gcr.io/etcd-development/etcd:v3.6.12

83+ entrypoint: /usr/local/bin/etcd

84+ command:

85+ - --listen-client-urls=http://0.0.0.0:2379

86+ - --advertise-client-urls=http://etcd:2379

87+ networks:

88+ etcd: {}

6589networks:

6690 dex: {}

91+ etcd: {}

6792 httpbin: {}

6893 oauth2-proxy: {}

contrib/local-environment/docker-compose-traefik.yaml+18−42

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

3−# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider

4−# and HTTPBin as an example upstream.

3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4+# HTTPBin as an example upstream.

55#

66# This can either be created using docker-compose

77# docker-compose -f docker-compose-traefik.yaml <command>

@@ -9,51 +9,32 @@

99# make traefik-<command> (eg. make traefik-up, make traefik-down)

1010#

1111# Access one of the following URLs to initiate a login flow:

12−# - http://oauth2-proxy.localtest.me

13−# - http://httpbin.localtest.me

14−# - http://dex.localtest.me/dex

12+# - http://oauth2-proxy.localhost

13+# - http://httpbin.oauth2-proxy.localhost

1514#

16−# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.localtest.me

15+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16+#

17+# Note, the above URLs should work with Chrome, but you may need to add hosts

18+# entries for other browsers

19+# 127.0.0.1 oauth2-proxy.localhost

20+# 127.0.0.1 httpbin.oauth2-proxy.localhost

21+# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

22+version: '3.0'

1723services:

1824

1925 oauth2-proxy:

20− container_name: oauth2-proxy

21− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

22− command: --config /oauth2-proxy.cfg

26+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

2327 ports: []

2428 hostname: oauth2-proxy

2529 volumes:

2630 - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"

27− restart: unless-stopped

28− networks:

29− oauth2-proxy: {}

30− dex: {}

31− depends_on:

32− - dex

33− - httpbin

34−

35− dex:

36− container_name: dex

37− image: ghcr.io/dexidp/dex:v2.45.1

38− command: dex serve /dex.yaml

39− hostname: dex

40− volumes:

41− - "./dex-traefik.yaml:/dex.yaml"

42− restart: unless-stopped

4331 networks:

44− dex: {}

45−

46− httpbin:

47− container_name: httpbin

48− image: kennethreitz/httpbin

49− ports: []

50− networks:

51− httpbin: {}

32+ oauth2-proxy:

5233

5334 # Reverse proxy

5435 gateway:

5536 container_name: traefik

56− image: traefik:v3.7.10

37+ image: traefik:v2.11.50

5738 volumes:

5839 - "./traefik:/etc/traefik"

5940 ports:

@@ -62,13 +43,8 @@ services:

6243 depends_on:

6344 - oauth2-proxy

6445 networks:

65− oauth2-proxy: {}

66− httpbin: {}

67− dex:

68− aliases:

69− - dex.localtest.me

46+ oauth2-proxy:

47+ httpbin:

7048

7149networks:

72− dex: {}

73− httpbin: {}

74− oauth2-proxy: {}

50+ oauth2-proxy:

contrib/local-environment/docker-compose.yaml+15−2

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# HTTPBin as an example upstream.

4+# etcd for storage for Dex and HTTPBin as an example upstream.

55#

66# This can either be created using docker-compose

77# docker-compose -f docker-compose.yaml <command>

@@ -13,7 +13,7 @@ version: "3.0"

1313services:

1414 oauth2-proxy:

1515 container_name: oauth2-proxy

16− image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4

16+ image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

1717 command: --config /oauth2-proxy.cfg

1818 hostname: oauth2-proxy

1919 volumes:

@@ -41,12 +41,25 @@ services:

4141 dex:

4242 aliases:

4343 - dex.localtest.me

44+ etcd: {}

45+ depends_on:

46+ - etcd

4447 httpbin:

4548 container_name: httpbin

4649 image: kennethreitz/httpbin

4750 ports: []

4851 networks:

4952 httpbin: {}

53+ etcd:

54+ container_name: etcd

55+ image: gcr.io/etcd-development/etcd:v3.6.12

56+ entrypoint: /usr/local/bin/etcd

57+ command:

58+ - --listen-client-urls=http://0.0.0.0:2379

59+ - --advertise-client-urls=http://etcd:2379

60+ networks:

61+ etcd: {}

5062networks:

5163 dex: {}

64+ etcd: {}

5265 httpbin: {}

contrib/local-environment/kubernetes/Chart.lock+3−3

@@ -1,7 +1,7 @@

11dependencies:

22- name: dex

33 repository: https://charts.dexidp.io

4− version: 0.24.1

4+ version: 0.24.0

55- name: oauth2-proxy

66 repository: https://oauth2-proxy.github.io/manifests

77 version: 7.18.0

@@ -11,5 +11,5 @@ dependencies:

1111- name: hello-world

1212 repository: https://conservis.github.io/helm-charts

1313 version: 1.1.0

14−digest: sha256:3fff8bf99cebcd20a73c984423d5f1c2dfa1e5a394f82a5dc60d9aaffe5361b7

15−generated: "2026-08-18T07:33:03.791274914Z"

14+digest: sha256:fee913531bfb67e5555e995d8fb040c330e6eb4b5a8c777ceb9841135ea9bb84

15+generated: "2025-10-28T06:46:35.38300324Z"

contrib/local-environment/kubernetes/Chart.yaml+1−1

@@ -3,7 +3,7 @@ description: K8S example based on https://kind.sigs.k8s.io

33name: kubernetes

44dependencies:

55 - name: dex

6− version: 0.24.1

6+ version: 0.24.0

77 repository: https://charts.dexidp.io

88 - name: oauth2-proxy

99 version: &chartVersion 7.18.0

contrib/local-environment/oauth2-proxy-traefik.cfg+4−4

@@ -2,14 +2,14 @@ http_address="0.0.0.0:4180"

22cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

33provider="oidc"

44email_domains=["example.com"]

5−oidc_issuer_url="http://dex.localtest.me/dex"

5+oidc_issuer_url="http://dex.localhost:5556/dex"

66client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

77client_id="oauth2-proxy"

88cookie_secure="false"

10−redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"

11−cookie_domains=".localtest.me" # Required so cookie can be read on all subdomains.

12−whitelist_domains=".localtest.me" # Required to allow redirection back to original requested target.

10+redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"

11+cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.

12+whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.

1313

1414# Mandatory option when using oauth2-proxy with traefik

1515reverse_proxy="true"

contrib/local-environment/traefik/dynamic.yaml+4−11

@@ -1,25 +1,22 @@

11http:

22 routers:

33 oauth2-proxy-route:

4− rule: "Host(`oauth2-proxy.localtest.me`)"

4+ rule: "Host(`oauth2-proxy.oauth2-proxy.localhost`)"

55 middlewares:

66 - auth-headers

77 service: oauth-backend

8− dex-route:

9− rule: "Host(`dex.localtest.me`)"

10− service: dex-service

118 httpbin-route:

12− rule: "Host(`httpbin.localtest.me`)"

9+ rule: "Host(`httpbin.oauth2-proxy.localhost`)"

1310 service: httpbin-service

1411 middlewares:

1512 - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin

1613 httpbin-route-2:

17− rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/no-auto-redirect`)"

14+ rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/no-auto-redirect`)"

1815 service: httpbin-service

1916 middlewares:

2017 - oauth-auth-wo-redirect # unauthenticated session will return a 401

2118 services-oauth2-route:

22− rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/oauth2/`)"

19+ rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/oauth2/`)"

2320 middlewares:

2421 - auth-headers

2522 service: oauth-backend

@@ -33,10 +30,6 @@ http:

3330 loadBalancer:

3431 servers:

3532 - url: http://oauth2-proxy:4180

36− dex-service:

37− loadBalancer:

38− servers:

39− - url: http://dex:5556

4033

4134 middlewares:

4235 auth-headers:

contrib/local-environment/traefik/traefik.yaml−2

@@ -5,5 +5,3 @@ log:

55providers:

66 file:

77 filename: /etc/traefik/dynamic.yaml

8− # Routes are static for this example; disabling watch avoids host inotify limits.

9− watch: false

docs/docs/configuration/alpha_config.md+1−12

@@ -167,17 +167,6 @@ injectResponseHeaders:

167167* `claimSource` - `claim` (session claims either from id token or from profile URL)

168168* `secretSource` - `value` (base64), `fromFile` (file path)

169169

170−#### Claim value serialization

171−

172−`claimSource` converts the selected claim into one or more string header values. Scalars

173−produce one value, while arrays produce one value per element. Values that cannot be

174−converted directly to strings, such as objects, are JSON-encoded individually.

175−

176−Each non-empty value is added separately under the configured header name. An array of

177−objects therefore produces multiple header values containing one JSON object each, not a

178−single JSON array. HTTP libraries and intermediaries may expose repeated values as a

179−comma-joined string, so consumers should retrieve and parse each header value separately.

180−

181170**Request option:** `preserveRequestValue: true` retains existing header values

182171

183172**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

@@ -689,7 +678,7 @@ Requests will be proxied to this upstream if the path matches the request path.

689678| Field | Type | Description |

690679| ----- | ---- | ----------- |

691680| `id` | _string_ | ID should be a unique identifier for the upstream. This value is required for all upstreams. |

692−| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Without RewriteTarget, Path follows gorilla/mux route syntax. Eg: - `/foo`: Match only the explicit path `/foo` - `/bar/`: Match any path prefixed with `/bar/` - `/baz/{path:.*}`: Match any path prefixed with `/baz/` When RewriteTarget is set, Path is treated as a regular expression. Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the remaining path for use with RewriteTarget. |

681+| `path` | _string_ | Path is used to map requests to the upstream server. The closest match will take precedence and all Paths must be unique. Path can also take a pattern when used with RewriteTarget. Path segments can be captured and matched using regular experessions. Eg: - `^/foo$`: Match only the explicit path `/foo` - `^/bar/$`: Match any path prefixed with `/bar/` - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget |

693682| `rewriteTarget` | _string_ | RewriteTarget allows users to rewrite the request path before it is sent to the upstream server (for an HTTP/HTTPS upstream) or mapped to the filesystem (for a `file:` upstream). Use the Path to capture segments for reuse within the rewrite target. Eg: With a Path of `^/baz/(.*)`, a RewriteTarget of `/foo/$1` would rewrite the request `/baz/abc/123` to `/foo/abc/123` before proxying to the upstream server. Or if the upstream were `file:///app`, a request for `/baz/info.html` would return the contents of the file `/app/foo/info.html`. |

694683| `uri` | _string_ | The URI of the upstream server. This may be an HTTP(S) server of a File based URL. It may include a path, in which case all requests will be served under that path. Eg: - http://localhost:8080 - https://service.localhost - https://service.localhost/path - file://host/path If the URI's path is "/base" and the incoming request was for "/dir", the upstream request will be for "/base/dir". |

695684| `insecureSkipTLSVerify` | _bool_ | InsecureSkipTLSVerify will skip TLS verification of upstream HTTPS hosts. This option is insecure and will allow potential Man-In-The-Middle attacks between OAuth2 Proxy and the upstream server. Defaults to false. |

docs/docs/configuration/alpha_config.md.tmpl−11

@@ -167,17 +167,6 @@ injectResponseHeaders:

167167* `claimSource` - `claim` (session claims either from id token or from profile URL)

168168* `secretSource` - `value` (base64), `fromFile` (file path)

169169

170−#### Claim value serialization

171−

172−`claimSource` converts the selected claim into one or more string header values. Scalars

173−produce one value, while arrays produce one value per element. Values that cannot be

174−converted directly to strings, such as objects, are JSON-encoded individually.

175−

176−Each non-empty value is added separately under the configured header name. An array of

177−objects therefore produces multiple header values containing one JSON object each, not a

178−single JSON array. HTTP libraries and intermediaries may expose repeated values as a

179−comma-joined string, so consumers should retrieve and parse each header value separately.

180−

181170**Request option:** `preserveRequestValue: true` retains existing header values

182171

183172**Incompatibility:** Remove legacy flags `pass-user-headers`, `set-xauthrequest`

docs/docs/configuration/integrations/nginx.md+11−27

@@ -60,23 +60,23 @@ server {

6060 auth_request_set $auth_cookie $upstream_http_set_cookie;

6161 add_header Set-Cookie $auth_cookie;

6262

63− # Large OIDC tokens can make the session cookie exceed the 4KB limit,

64− # causing OAuth2 Proxy to split the cookie into multiple parts.

63+ # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb

64+ # limit and so the OAuth2 Proxy splits these into multiple parts.

6565 # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,

66− # so extract the second part when using the default cookie name, `_oauth2_proxy`.

67− auth_request_set $auth_cookie_upstream_1 $upstream_cookie__oauth2_proxy_1;

66+ # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.

67+ auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

6868

6969 # Extract the Cookie attributes from the first Set-Cookie header and append them

7070 # to the second part ($upstream_cookie_* variables only contain the raw cookie content)

7171 if ($auth_cookie ~* "(; .*)") {

72− set $auth_cookie_0 $auth_cookie;

73− set $auth_cookie_1 "_oauth2_proxy_1=$auth_cookie_upstream_1$1";

72+ set $auth_cookie_name_0 $auth_cookie;

73+ set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";

7474 }

7575

7676 # Send both Set-Cookie headers now if there was a second part

77− if ($auth_cookie_upstream_1) {

78− add_header Set-Cookie $auth_cookie_0;

79− add_header Set-Cookie $auth_cookie_1;

77+ if ($auth_cookie_name_upstream_1) {

78+ add_header Set-Cookie $auth_cookie_name_0;

79+ add_header Set-Cookie $auth_cookie_name_1;

8080 }

8181

8282 proxy_pass http://backend/;

@@ -91,24 +91,6 @@ server {

9191}

9292```

9393

94−### Multi-part session cookies

95−

96−The example above is ready to use with the default `--cookie-name=_oauth2_proxy` setting and handles a session split into two cookies. If you configure a custom cookie name, update both references to the second cookie part:

97−

98−| Cookie configuration | Nginx upstream cookie variable | `Set-Cookie` name |

99−| --- | --- | --- |

100−| Default (`_oauth2_proxy`) | `$upstream_cookie__oauth2_proxy_1` | `_oauth2_proxy_1=` |

101−| `--cookie-name=my_cookie` | `$upstream_cookie_my_cookie_1` | `my_cookie_1=` |

102−

103−For example, with `--cookie-name=my_cookie`, change the relevant lines to:

104−

105−```nginx

106−auth_request_set $auth_cookie_upstream_1 $upstream_cookie_my_cookie_1;

107−set $auth_cookie_1 "my_cookie_1=$auth_cookie_upstream_1$1";

108−```

109−

110−If a session is split into more than two cookies, repeat the extraction for each additional numeric suffix. For consistently large sessions, prefer `--session-store-type=redis` so only a small session ticket is stored in the browser cookie.

111−

11294### Understanding the `error_page` redirect pattern

11395

11496The `auth_request` directive expects the authentication endpoint (`/oauth2/auth`) to return:

@@ -185,6 +167,8 @@ It is recommended to use `--session-store-type=redis` when expecting large sessi

185167For a complete example of integrating oauth2-proxy with Kubernetes Dashboard on AKS using Azure Entra ID, including RBAC configuration and troubleshooting, see the [Kubernetes Dashboard on AKS](../providers/ms_entra_id.md#kubernetes-dashboard-on-aks) section in the Microsoft Entra ID provider documentation.

186168:::

187169

170+You have to substitute *name* with the actual cookie name you configured via --cookie-name parameter. If you don't set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".

171+

188172:::note

189173If you set up your OAuth2 provider to rotate your client secret, you can use the `client-secret-file` option to reload the secret when it is updated.

190174:::

docs/docs/configuration/providers/atlassian.mddeleted−26

@@ -1,26 +0,0 @@

1−---

2−id: atlassian

3−title: Atlassian Cloud

4−---

5−

6−1. Create an OAuth 2.0 integration in the [Atlassian developer console](https://developer.atlassian.com/console/myapps/).

7−2. Under **Permissions**, add the User identity API with the `read:me` scope.

8−3. Under **Authorization**, set the callback URL to `https://<proxy_host>/oauth2/callback`.

9−4. Copy the client ID and secret from **Settings**.

10−5. Run the proxy with:

11−

12−```shell

13− --provider=atlassian

14− --client-id=<client ID>

15− --client-secret=<secret>

16− --redirect-url=https://<proxy_host>/oauth2/callback

17− --cookie-secret=<cookie secret>

18−```

19−

20−A new app works only for the account that created it. Enable sharing under **Distribution** to let other users sign in.

21−Atlassian then admits only accounts with access to the Atlassian site the app is installed on; others are refused at

22−the consent screen.

23−

24−The proxy reads the user's email from `https://api.atlassian.com/me`. Restricting access further is supported by

25−[email](index.md#email-authentication). With `--cookie-refresh` set, the proxy re-validates the token against `/me` on

26−that interval.

docs/docs/configuration/providers/dtt_sso.mddeleted−45

@@ -1,45 +0,0 @@

1−---

2−id: dtt_sso

3−title: DTT SSO

4−---

5−

6−Signs users in with the DTT SSO (auth-server) using the authorization code flow and its HS256 id_token.

7−

8−1. Register a client in the auth-server config, one per protected service, with the proxy's callback as its

9− only redirect URI:

10−

11− ```yaml

12− clients:

13− redash-gate:

14− secret: <random secret>

15− redirect_uri: https://redash.example.com/oauth2/callback

16− display_name: Redash

17− ```

18−

19−2. Run the proxy with:

20−

21− ```shell

22− --provider=dtt-sso

23− --client-id=redash-gate

24− --client-secret-file=/run/secrets/client_secret

25− --redirect-url=https://redash.example.com/oauth2/callback

26− --cookie-secret-file=/run/secrets/cookie_secret

27− --cookie-name=_dtt_sso_redash

28− --cookie-refresh=5m

29− ```

30−

31− Give each instance its own `--cookie-name`: another oauth2-proxy setting its cookie on a parent domain

32− (the Atlassian proxy uses `_oauth2_proxy` on `.thebestagent.pro`) would otherwise shadow this one.

33−

34−The endpoints default to `https://auth.thebestagent.pro`. For another SSO host set `--login-url`, `--redeem-url`

35−and `--validate-url` to its `/oauth/authorize`, `/oauth/token` and `/oauth/check_token`; the id_token issuer must

36−equal the login URL's origin (the SSO's `site_host`).

37−

38−The scope must stay `openid`, the only scope the SSO accepts.

39−

40−The session carries the SSO `email`, the user UUID as the user, and the SSO `role` as the only group, so

41−`--allowed-group=dtt_admin` restricts access by role. `--authenticated-emails-file` and `--email-domain` restrict

42−by email as usual.

43−

44−With `--cookie-refresh` set, the proxy refreshes the tokens on that interval and re-reads the email and role; a user

45−deleted or signed out in the SSO loses access at the next refresh.

docs/docs/configuration/providers/index.md−2

@@ -9,12 +9,10 @@ with Redirect URI(s) for the domain you intend to run `oauth2-proxy` on.

99Valid providers are :

1010

1111- [ADFS](adfs.md)

12−- [Atlassian Cloud](atlassian.md)

1312- [Bitbucket](bitbucket.md)

1413- [Cidaas](cidaas.md)

1514- [CiscoDuo](cisco_duo.md)

1615- [DigitalOcean](digitalocean.md)

17−- [DTT SSO](dtt_sso.md)

1816- [Facebook](facebook.md)

1917- [Gitea](gitea.md)

2018- [GitHub](github.md)

docs/docs/installation.md+1−1

@@ -5,7 +5,7 @@ title: Installation

661. Choose how to deploy:

8− a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)

8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.3`)

1010 b. Using Go to install the latest release

1111 ```bash

docs/sidebars.js−2

@@ -46,13 +46,11 @@ const sidebars = {

4646 },

4747 items: [

4848 "configuration/providers/adfs",

49− "configuration/providers/atlassian",

5049 "configuration/providers/azure",

5150 "configuration/providers/bitbucket",

5251 "configuration/providers/cidaas",

5352 "configuration/providers/cisco_duo",

5453 "configuration/providers/digitalocean",

55− "configuration/providers/dtt_sso",

5654 "configuration/providers/facebook",

5755 "configuration/providers/gitea",

5856 "configuration/providers/github",

docs/versioned_docs/version-7.15.x/installation.md+1−1

@@ -5,7 +5,7 @@ title: Installation

661. Choose how to deploy:

8− a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.4`)

8+ a. Using a [Prebuilt Binary](https://github.com/oauth2-proxy/oauth2-proxy/releases) (current release is `v7.15.3`)

1010 b. Using Go to install the latest release

1111 ```bash

go.mod+27−23

@@ -21,43 +21,46 @@ require (

2121 github.com/gorilla/mux v1.8.1

2222 github.com/justinas/alice v1.2.0

2323 github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25

24− github.com/onsi/ginkgo/v2 v2.32.1

24+ github.com/onsi/ginkgo/v2 v2.32.0

2525 github.com/onsi/gomega v1.42.1

26− github.com/pierrec/lz4/v4 v4.1.28

26+ github.com/pierrec/lz4/v4 v4.1.27

2727 github.com/prometheus/client_golang v1.24.1

28− github.com/redis/go-redis/v9 v9.22.0

28+ github.com/redis/go-redis/v9 v9.21.0

2929 github.com/spf13/cast v1.10.0

3030 github.com/spf13/pflag v1.0.10

3131 github.com/spf13/viper v1.21.0

32− github.com/stretchr/testify v1.12.0

32+ github.com/stretchr/testify v1.11.1

3333 github.com/vmihailenco/msgpack/v5 v5.4.1

3434 go.yaml.in/yaml/v3 v3.0.5

35− golang.org/x/crypto v0.55.0

36− golang.org/x/net v0.58.0

35+ golang.org/x/crypto v0.54.0

36+ golang.org/x/net v0.57.0

3737 golang.org/x/oauth2 v0.36.0

3838 golang.org/x/sync v0.22.0

39− google.golang.org/api v0.293.0

39+ google.golang.org/api v0.291.0

4040 gopkg.in/natefinch/lumberjack.v2 v2.2.1

4141 k8s.io/apimachinery v0.36.3

4242)

4343

4444require (

45− cloud.google.com/go/auth v0.23.1 // indirect

45+ cloud.google.com/go/auth v0.22.0 // indirect

4646 cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect

4747 github.com/Masterminds/semver/v3 v3.5.0 // indirect

4848 github.com/beorn7/perks v1.0.1 // indirect

4949 github.com/cespare/xxhash/v2 v2.3.0 // indirect

50− github.com/felixge/httpsnoop v1.1.0 // indirect

51− github.com/go-logr/logr v1.4.4 // indirect

50+ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect

51+ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect

52+ github.com/felixge/httpsnoop v1.0.4 // indirect

53+ github.com/go-logr/logr v1.4.3 // indirect

5254 github.com/go-logr/stdr v1.2.2 // indirect

5355 github.com/go-task/slim-sprig/v3 v3.0.0 // indirect

54− github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect

56+ github.com/google/pprof v0.0.0-20260604005048-7023385849c0 // indirect

5557 github.com/google/s2a-go v0.1.9 // indirect

56− github.com/googleapis/enterprise-certificate-proxy v0.3.21 // indirect

58+ github.com/googleapis/enterprise-certificate-proxy v0.3.19 // indirect

5759 github.com/googleapis/gax-go/v2 v2.23.0 // indirect

5860 github.com/kylelemons/godebug v1.1.0 // indirect

5961 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

60− github.com/pelletier/go-toml/v2 v2.4.3 // indirect

62+ github.com/pelletier/go-toml/v2 v2.3.1 // indirect

63+ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect

6164 github.com/prometheus/client_model v0.6.2 // indirect

6265 github.com/prometheus/common v0.70.1 // indirect

6366 github.com/prometheus/procfs v0.21.1 // indirect

@@ -67,17 +70,18 @@ require (

6770 github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect

6871 github.com/yuin/gopher-lua v1.1.2 // indirect

6972 go.opentelemetry.io/auto/sdk v1.2.1 // indirect

70− go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect

71− go.opentelemetry.io/otel v1.45.0 // indirect

72− go.opentelemetry.io/otel/metric v1.45.0 // indirect

73− go.opentelemetry.io/otel/trace v1.45.0 // indirect

73+ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect

74+ go.opentelemetry.io/otel v1.44.0 // indirect

75+ go.opentelemetry.io/otel/metric v1.44.0 // indirect

76+ go.opentelemetry.io/otel/trace v1.44.0 // indirect

7477 go.uber.org/atomic v1.11.0 // indirect

75− golang.org/x/mod v0.40.0 // indirect

78+ go.yaml.in/yaml/v2 v2.4.4 // indirect

79+ golang.org/x/mod v0.37.0 // indirect

7680 golang.org/x/sys v0.47.0 // indirect

77− golang.org/x/text v0.41.0 // indirect

78− golang.org/x/tools v0.49.0 // indirect

79− google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect

80− google.golang.org/grpc v1.83.0 // indirect

81− google.golang.org/protobuf v1.36.12 // indirect

81+ golang.org/x/text v0.40.0 // indirect

82+ golang.org/x/tools v0.47.0 // indirect

83+ google.golang.org/genproto/googleapis/rpc v0.0.0-20260724162435-b2f20204f0df // indirect

84+ google.golang.org/grpc v1.82.1 // indirect

85+ google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect

8286 gopkg.in/yaml.v3 v3.0.1 // indirect

8387)

go.sum+235−59

@@ -1,5 +1,9 @@

1−cloud.google.com/go/auth v0.23.1 h1:1tPpBPG02lQHmoiAvs9egyCASqXP0xgobptjZzov/Jg=

2−cloud.google.com/go/auth v0.23.1/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0=

1+cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=

2+cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=

3+cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=

4+cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=

5+cloud.google.com/go/auth v0.22.0 h1:Xp9wAKkLoeaYb5pYZZoQGz4E9sdPxIbzS3gywZE3ciQ=

6+cloud.google.com/go/auth v0.22.0/go.mod h1:M9o2Oz+YI2jAfxewJgb1vyI3vceHF+eohmxyzmrl+9s=

37cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=

48cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=

59cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=

@@ -8,12 +12,16 @@ github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb h1:ZVN4Iat3runWO

812github.com/Bose/minisentinel v0.0.0-20200130220412-917c5a9223bb/go.mod h1:WsAABbY4HQBgd3mGuG4KMNTbHJCPvx9IVBHzysbknss=

913github.com/FZambia/sentinel v1.0.0 h1:KJ0ryjKTZk5WMp0dXvSdNqp3lFaW1fNFuEYfrkLOYIc=

1014github.com/FZambia/sentinel v1.0.0/go.mod h1:ytL1Am/RLlAoAXG6Kj5LNuw/TRRQrv2rt2FT26vP5gI=

15+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=

16+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

1117github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=

1218github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=

1319github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY=

1420github.com/a8m/envsubst v1.4.3/go.mod h1:4jjHWQlZoaXPoLQUb7H2qT4iLkZDdmEQiOUogdUmqVU=

1521github.com/alicebob/gopher-json v0.0.0-20180125190556-5a6b3ba71ee6/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=

1622github.com/alicebob/miniredis/v2 v2.11.1/go.mod h1:UA48pmi7aSazcGAvcdKcBB49z521IC9VjTTRz2nIaJE=

23+github.com/alicebob/miniredis/v2 v2.37.0 h1:RheObYW32G1aiJIj81XVt78ZHJpHonHLHW7OLIshq68=

24+github.com/alicebob/miniredis/v2 v2.37.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

1725github.com/alicebob/miniredis/v2 v2.38.0 h1:nZAzCR+Lj+Vxk4ZXzm2NuKq2O33RXj1XxJ2e2uP9jiw=

1826github.com/alicebob/miniredis/v2 v2.38.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=

1927github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

@@ -24,6 +32,8 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=

2432github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=

2533github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=

2634github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=

35+github.com/bsm/redislock v0.9.4 h1:X/Wse1DPpiQgHbVYRE9zv6m070UcKoOGekgvpNhiSvw=

36+github.com/bsm/redislock v0.9.4/go.mod h1:Epf7AJLiSFwLCiZcfi6pWFO/8eAYrYpQXFxEDPoDeAk=

2737github.com/bsm/redislock v0.10.0 h1:NAe1OHDnwPmWEzD+LpWBZXAdZrWld/xj/wmqEcQednQ=

2838github.com/bsm/redislock v0.10.0/go.mod h1:M05WZGjPbX/8ne7LmB7AbOsa2kv7Jzx4fqkLpDFZvJs=

2939github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=

@@ -31,15 +41,25 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL

3141github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=

3242github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=

3343github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=

44+github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=

45+github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=

46+github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A=

47+github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=

3448github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE=

3549github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=

3650github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=

3751github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=

3852github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

39−github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=

40−github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=

53+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=

54+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

55+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=

56+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=

57+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=

58+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=

4159github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=

4260github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=

61+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=

62+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=

4363github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=

4464github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=

4565github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=

@@ -48,17 +68,21 @@ github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZ

4868github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=

4969github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=

5070github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=

71+github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=

72+github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

5173github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=

5274github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=

5375github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=

5476github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=

5577github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=

56−github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=

57−github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

78+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=

79+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

5880github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=

5981github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=

6082github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=

6183github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=

84+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=

85+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

6286github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=

6387github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=

6488github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=

@@ -72,15 +96,29 @@ github.com/gomodule/redigo v1.7.1-0.20190322064113-39e2c31b7ca3/go.mod h1:B4C85q

7296github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=

7397github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=

7498github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=

75−github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=

76−github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=

99+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=

100+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

101+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=

102+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

103+github.com/google/pprof v0.0.0-20260604005048-7023385849c0 h1:h1QTMDl6q9wDvDCJVpKQSjgleGFYnd2fOxmg2K+6BGE=

104+github.com/google/pprof v0.0.0-20260604005048-7023385849c0/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=

77105github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=

78106github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=

79107github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

80108github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=

81109github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

82−github.com/googleapis/enterprise-certificate-proxy v0.3.21 h1:OFdQ3tnCX/zaQ0Cedur3D3z7kI6HiLX9g3TiAN4/DFU=

83−github.com/googleapis/enterprise-certificate-proxy v0.3.21/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=

110+github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=

111+github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=

112+github.com/googleapis/enterprise-certificate-proxy v0.3.16 h1:F/VPrx0YPBdksZJQdCAp0WUsqnNmZpUZszzfYt0M5Dw=

113+github.com/googleapis/enterprise-certificate-proxy v0.3.16/go.mod h1:9Yb0eAkH/Xqhvv3zbeKf/+wMJqCeocWc6KIhDvEAuYE=

114+github.com/googleapis/enterprise-certificate-proxy v0.3.19 h1:mMOE7DN2+p76/EdIrmAy9B9bH+yC4563vmnJ34QR8i4=

115+github.com/googleapis/enterprise-certificate-proxy v0.3.19/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=

116+github.com/googleapis/gax-go/v2 v2.19.0 h1:fYQaUOiGwll0cGj7jmHT/0nPlcrZDFPrZRhTsoCr8hE=

117+github.com/googleapis/gax-go/v2 v2.19.0/go.mod h1:w2ROXVdfGEVFXzmlciUU4EdjHgWvB5h2n6x/8XSTTJA=

118+github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI=

119+github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=

120+github.com/googleapis/gax-go/v2 v2.22.0 h1:PjIWBpgGIVKGoCXuiCoP64altEJCj3/Ei+kSU5vlZD4=

121+github.com/googleapis/gax-go/v2 v2.22.0/go.mod h1:irWBbALSr0Sk3qlqb9SyJ1h68WjgeFuiOzI4Rqw5+aY=

84122github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=

85123github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=

86124github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=

@@ -89,10 +127,11 @@ github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE

89127github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=

90128github.com/justinas/alice v1.2.0 h1:+MHSA/vccVCF4Uq37S42jwlkvI2Xzl7zTPCN5BnZNVo=

91129github.com/justinas/alice v1.2.0/go.mod h1:fN5HRH/reO/zrUflLfTN43t3vXvKzvZIENsNEe7i7qA=

92−github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=

93−github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=

130+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=

131+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=

132+github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=

133+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=

94134github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=

95−github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=

96135github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=

97136github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=

98137github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=

@@ -109,25 +148,57 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq

109148github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=

110149github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25 h1:9bCMuD3TcnjeqjPT2gSlha4asp8NvgcFRYExCaikCxk=

111150github.com/oauth2-proxy/mockoidc v0.0.0-20240214162133-caebfff84d25/go.mod h1:eDjgYHYDJbPLBLsyZ6qRaugP0mX8vePOhZ5id1fdzJw=

112−github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=

113−github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

151+github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=

152+github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=

153+github.com/onsi/ginkgo/v2 v2.29.0 h1:rfh+ZFjgJhYWRoIqVf3Uwx/W20yLrcrE2h2GmYVRaag=

154+github.com/onsi/ginkgo/v2 v2.29.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

155+github.com/onsi/ginkgo/v2 v2.30.0 h1:zxM/9XneXFIy64j6/wAmBIX4zRC7Hu6U8XFNZvDnCQc=

156+github.com/onsi/ginkgo/v2 v2.30.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

157+github.com/onsi/ginkgo/v2 v2.32.0 h1:Hw7s2pVrQo/8Yz5N77qdnpHaoc+c6cC9WIV1Jce+J6E=

158+github.com/onsi/ginkgo/v2 v2.32.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=

159+github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=

160+github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=

161+github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=

162+github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=

114163github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=

115164github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=

116−github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=

117−github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

118−github.com/pierrec/lz4/v4 v4.1.28 h1:pPEPwRJ4kybBTfGt28q7lQsRJQHhC08axprdLD5Ppio=

119−github.com/pierrec/lz4/v4 v4.1.28/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

165+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=

166+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

167+github.com/pelletier/go-toml/v2 v2.3.0 h1:k59bC/lIZREW0/iVaQR8nDHxVq8OVlIzYCOJf421CaM=

168+github.com/pelletier/go-toml/v2 v2.3.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

169+github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=

170+github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=

171+github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=

172+github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

173+github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk=

174+github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=

120175github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

176+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=

177+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

178+github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=

179+github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=

121180github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=

122181github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=

123182github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=

124183github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=

184+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=

185+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=

186+github.com/prometheus/common v0.68.1 h1:omjRRl4QP4komogpXuhfeOiisQg7xdy8VM1UY+pStaY=

187+github.com/prometheus/common v0.68.1/go.mod h1:ZzL3f6u94qUxh9p+tJTrF+FvBS1XXbbRAZCQkytAL0Y=

125188github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=

126189github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=

190+github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=

191+github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=

127192github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=

128193github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=

129−github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=

130−github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=

194+github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=

195+github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=

196+github.com/redis/go-redis/v9 v9.20.0 h1:WnQYxLkgO2xiXTCJY0ldIiI8dNqCDlQAG+AtaH7a2a0=

197+github.com/redis/go-redis/v9 v9.20.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=

198+github.com/redis/go-redis/v9 v9.20.1 h1:sfCU6A8P3dXbKyWes02uxA2baehGux9dZHfEKtsTB1w=

199+github.com/redis/go-redis/v9 v9.20.1/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=

200+github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAtL9E=

201+github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=

131202github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=

132203github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=

133204github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=

@@ -142,8 +213,8 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=

142213github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=

143214github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

144215github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

145−github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI=

146−github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw=

216+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=

217+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=

147218github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=

148219github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=

149220github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=

@@ -161,55 +232,107 @@ github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV

161232github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=

162233github.com/yuin/gopher-lua v0.0.0-20190206043414-8bfc7677f583/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

163234github.com/yuin/gopher-lua v0.0.0-20191213034115-f46add6fdb5c/go.mod h1:gqRgreBUhTSL0GeU64rtZ3Uq3wtjOa/TB2YfrtkCbVQ=

235+github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=

236+github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=

164237github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=

165238github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=

239+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=

240+github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=

166241github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=

167−github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=

168242go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=

169243go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=

244+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=

245+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=

170246go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=

171−go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=

172−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=

173−go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=

174−go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=

175−go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=

176−go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=

177−go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=

178−go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=

179−go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=

180−go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=

181−go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=

182−go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=

183−go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=

247+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=

248+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=

249+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=

250+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=

251+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=

252+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=

253+go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=

254+go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=

255+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=

256+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=

257+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=

258+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=

259+go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=

260+go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=

261+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=

262+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=

263+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=

264+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=

265+go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=

266+go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=

267+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=

268+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=

269+go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=

270+go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=

271+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=

272+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=

273+go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=

274+go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=

275+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=

276+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=

277+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=

278+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=

184279go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=

185280go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=

186281go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=

187282go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=

188283go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=

189284go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=

285+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=

286+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=

190287go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=

191288go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=

192289golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=

193290golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=

194291golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=

195−golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=

196−golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=

292+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=

293+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=

294+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=

295+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=

296+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=

297+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=

298+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=

299+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=

300+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=

301+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=

197302golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=

198303golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=

199−golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=

200−golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=

304+golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=

305+golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=

306+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=

307+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=

308+golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=

309+golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=

310+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=

311+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=

201312golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=

202313golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=

203314golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=

204315golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=

205316golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=

206−golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=

207−golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=

317+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=

318+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=

319+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=

320+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=

321+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=

322+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=

323+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=

324+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=

325+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=

326+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=

208327golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=

209328golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=

210329golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

211330golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

212331golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

332+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=

333+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

334+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=

335+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

213336golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=

214337golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=

215338golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

@@ -221,6 +344,14 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc

221344golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

222345golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

223346golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

347+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=

348+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

349+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=

350+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

351+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=

352+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

353+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=

354+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

224355golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=

225356golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

226357golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

@@ -234,31 +365,70 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=

234365golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=

235366golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=

236367golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=

237−golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=

238−golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=

368+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=

369+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=

370+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=

371+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=

372+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=

373+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=

374+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=

375+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=

376+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=

377+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=

239378golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=

240379golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=

241380golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

242381golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=

243382golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

244383golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=

245−golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=

246−golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=

384+golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=

385+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=

386+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=

387+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=

388+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=

389+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=

390+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=

391+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=

247392golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

393+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=

394+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=

248395gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=

249−gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=

250−google.golang.org/api v0.293.0 h1:p9XIWOf63U4OgYx120ZwVU8+vl4XTPmWfgVPnmOAS9w=

251−google.golang.org/api v0.293.0/go.mod h1:6n5tjEB1gzwniZTepZ0g5u+wM7Bof5GeULCx/zh8ZE0=

396+google.golang.org/api v0.272.0 h1:eLUQZGnAS3OHn31URRf9sAmRk3w2JjMx37d2k8AjJmA=

397+google.golang.org/api v0.272.0/go.mod h1:wKjowi5LNJc5qarNvDCvNQBn3rVK8nSy6jg2SwRwzIA=

398+google.golang.org/api v0.275.0 h1:vfY5d9vFVJeWEZT65QDd9hbndr7FyZ2+6mIzGAh71NI=

399+google.golang.org/api v0.275.0/go.mod h1:Fnag/EWUPIcJXuIkP1pjoTgS5vdxlk3eeemL7Do6bvw=

400+google.golang.org/api v0.283.0 h1:0lkp8u0MPwJVHqRL+nJlMAoZVVzbmiXmFHXMOTmSPik=

401+google.golang.org/api v0.283.0/go.mod h1:6Wssta4c5n9qHq5CBhmlai5h/PUa1djdDAIhYEHyvcM=

402+google.golang.org/api v0.284.0 h1:i+cKTgeQRcRySkP7QTl5PDO7/pAm8EcMFIUMlNbk4Vc=

403+google.golang.org/api v0.284.0/go.mod h1:AU44fU+XVZOCcd8uLaBIa/ZgzgPf/0qqY3+m7lQaado=

404+google.golang.org/api v0.291.0 h1:wfPbbY+mr9c7wZLqqzrHJLft/q8iFKREd6IgTBUene0=

405+google.golang.org/api v0.291.0/go.mod h1:at7kwWbuonglBFEBoeMDAV1bguHqL3qf0BHFsv3coa0=

406+google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5 h1:JNfk58HZ8lfmXbYK2vx/UvsqIL59TzByCxPIX4TDmsE=

407+google.golang.org/genproto v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:x5julN69+ED4PcFk/XWayw35O0lf/nGa4aNgODCmNmw=

252408google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=

253−google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=

254−google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU=

255−google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA=

256−google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 h1:utmqiUzZAEINbLmRyAt1QjVkMyLQ+lvIwCpLaB1rZfw=

257−google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

258−google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=

259−google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=

260−google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=

261−google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

409+google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 h1:CogIeEXn4qWYzzQU0QqvYBM8yDF9cFYzDq9ojSpv0Js=

410+google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=

411+google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=

412+google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=

413+google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

414+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=

415+google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

416+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=

417+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

418+google.golang.org/genproto/googleapis/rpc v0.0.0-20260724162435-b2f20204f0df h1:O3ig1i5WDDzsVzRp+cCdgelT9vXnlnOFdlEeFtL4HCc=

419+google.golang.org/genproto/googleapis/rpc v0.0.0-20260724162435-b2f20204f0df/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=

420+google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=

421+google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=

422+google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=

423+google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=

424+google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=

425+google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=

426+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=

427+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=

428+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=

429+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

430+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=

431+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

262432gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

263433gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=

264434gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

@@ -267,5 +437,11 @@ gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYs

267437gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

268438gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

269439gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

440+k8s.io/apimachinery v0.35.3 h1:MeaUwQCV3tjKP4bcwWGgZ/cp/vpsRnQzqO6J6tJyoF8=

441+k8s.io/apimachinery v0.35.3/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=

442+k8s.io/apimachinery v0.36.1 h1:G63Gjx2W+q0YD+72Vo8oY0nDnePVwnuzTmmy5ENrVSA=

443+k8s.io/apimachinery v0.36.1/go.mod h1:ibYOR00vW/I1kzvi5SF0dRuJ52BvKtfvRdOn35GPQ+8=

444+k8s.io/apimachinery v0.36.2 h1:0PE/W/WNy1UX61NLbXY5TMbJ6UwLL6E6lAPkYrKFxbQ=

445+k8s.io/apimachinery v0.36.2/go.mod h1:fvf/HOLXq9RId0rnDIbN1OEBvHXdQbLMM8nu0LcBUf4=

270446k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=

271447k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=

pkg/apis/options/load_test.go+1−1

@@ -282,7 +282,7 @@ var _ = Describe("Load", func() {

282282 Entry("with an invalid config file", &testOptionsTableInput{

283283 configFile: []byte(`slice_option = foo`),

284284 flagSet: func() *pflag.FlagSet { return testOptionsFlagSet },

285− expectedErr: fmt.Errorf("unable to load config file: While parsing config: toml: expected keyword \"false\""),

285+ expectedErr: fmt.Errorf("unable to load config file: While parsing config: toml: expected 'false'"),

286286 expectedOutput: &TestOptions{},

287287 }),

288288 Entry("with an invalid flagset", &testOptionsTableInput{

pkg/apis/options/providers.go−6

@@ -151,9 +151,6 @@ const (

151151 // ADFSProvider is the provider type for ADFS

152152 ADFSProvider ProviderType = "adfs"

153153

154− // AtlassianProvider is the provider type for Atlassian Cloud

155− AtlassianProvider ProviderType = "atlassian"

156−

157154 // AzureProvider is the provider type for Azure

158155 AzureProvider ProviderType = "azure"

159156

@@ -169,9 +166,6 @@ const (

169166 // DigitalOceanProvider is the provider type for DigitalOcean

170167 DigitalOceanProvider ProviderType = "digitalocean"

171168

172− // DTTSSOProvider is the provider type for the DTT SSO

173− DTTSSOProvider ProviderType = "dtt-sso"

174−

175169 // FacebookProvider is the provider type for Facebook

176170 FacebookProvider ProviderType = "facebook"

177171

pkg/apis/options/upstreams.go+5−7

@@ -62,14 +62,12 @@ type Upstream struct {

6262

6363 // Path is used to map requests to the upstream server.

6464 // The closest match will take precedence and all Paths must be unique.

65− // Without RewriteTarget, Path follows gorilla/mux route syntax.

65+ // Path can also take a pattern when used with RewriteTarget.

66+ // Path segments can be captured and matched using regular experessions.

6667 // Eg:

67− // - `/foo`: Match only the explicit path `/foo`

68− // - `/bar/`: Match any path prefixed with `/bar/`

69− // - `/baz/{path:.*}`: Match any path prefixed with `/baz/`

70− // When RewriteTarget is set, Path is treated as a regular expression.

71− // Eg: `^/baz/(.*)$` matches any path prefixed with `/baz` and captures the

72− // remaining path for use with RewriteTarget.

68+ // - `^/foo$`: Match only the explicit path `/foo`

69+ // - `^/bar/$`: Match any path prefixed with `/bar/`

70+ // - `^/baz/(.*)$`: Match any path prefixed with `/baz` and capture the remaining path for use with RewriteTarget

7371 Path string `yaml:"path,omitempty"`

7472

7573 // RewriteTarget allows users to rewrite the request path before it is sent to

providers/atlassian-cloud.godeleted−99

@@ -1,99 +0,0 @@

1−package providers

2−

3−import (

4− "context"

5− "errors"

6− "net/url"

7−

8− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

9− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

10−)

11−

12−// AtlassianProvider represents an Atlassian Cloud based Identity Provider

13−type AtlassianProvider struct {

14− *ProviderData

15−}

16−

17−var _ Provider = (*AtlassianProvider)(nil)

18−

19−const (

20− atlassianProviderName = "Atlassian"

21− atlassianDefaultScope = "read:me"

22− atlassianPrompt = "consent"

23− atlassianAudience = "api.atlassian.com"

24−)

25−

26−var (

27− atlassianDefaultLoginURL = &url.URL{

28− Scheme: "https",

29− Host: "auth.atlassian.com",

30− Path: "/authorize",

31− }

32−

33− atlassianDefaultRedeemURL = &url.URL{

34− Scheme: "https",

35− Host: "auth.atlassian.com",

36− Path: "/oauth/token",

37− }

38−

39− // atlassianDefaultProfileURL returns the signed-in user's profile.

40− atlassianDefaultProfileURL = &url.URL{

41− Scheme: "https",

42− Host: "api.atlassian.com",

43− Path: "/me",

44− }

45−)

46−

47−// NewAtlassianProvider initiates a new AtlassianProvider

48−func NewAtlassianProvider(p *ProviderData) *AtlassianProvider {

49− p.setProviderDefaults(providerDefaults{

50− name: atlassianProviderName,

51− loginURL: atlassianDefaultLoginURL,

52− redeemURL: atlassianDefaultRedeemURL,

53− profileURL: atlassianDefaultProfileURL,

54− validateURL: atlassianDefaultProfileURL,

55− scope: atlassianDefaultScope,

56− })

57− return &AtlassianProvider{ProviderData: p}

58−}

59−

60−// GetLoginURL adds the audience and prompt parameters Atlassian requires.

61−func (p *AtlassianProvider) GetLoginURL(redirectURI, state, _ string, extraParams url.Values) string {

62− params := url.Values{}

63− for k, v := range extraParams {

64− params[k] = v

65− }

66− params.Del("approval_prompt")

67− if params.Get("prompt") == "" {

68− params.Set("prompt", atlassianPrompt)

69− }

70− params.Set("audience", atlassianAudience)

71−

72− loginURL := makeLoginURL(p.ProviderData, redirectURI, state, params)

73− return loginURL.String()

74−}

75−

76−// EnrichSession sets the session's email from the Atlassian profile.

77−func (p *AtlassianProvider) EnrichSession(ctx context.Context, s *sessions.SessionState) error {

78− var profile struct {

79− Email string `json:"email"`

80− }

81− err := requests.New(p.ProfileURL.String()).

82− WithContext(ctx).

83− WithHeaders(makeOIDCHeader(s.AccessToken)).

84− Do().

85− UnmarshalInto(&profile)

86− if err != nil {

87− return err

88− }

89− if profile.Email == "" {

90− return errors.New("no email in Atlassian profile")

91− }

92− s.Email = profile.Email

93− return nil

94−}

95−

96−// ValidateSession validates the AccessToken

97−func (p *AtlassianProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

98− return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))

99−}

providers/atlassian-cloud_test.godeleted−93

@@ -1,93 +0,0 @@

1−package providers

2−

3−import (

4− "context"

5− "net/http"

6− "net/http/httptest"

7− "net/url"

8− "testing"

9−

10− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

11− . "github.com/onsi/gomega"

12−)

13−

14−func testAtlassianBackend(status int, body string) *httptest.Server {

15− return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

16− if r.URL.Path != "/me" || r.Header.Get("Authorization") != "Bearer imaginary_access_token" {

17− w.WriteHeader(http.StatusUnauthorized)

18− return

19− }

20− w.WriteHeader(status)

21− _, _ = w.Write([]byte(body))

22− }))

23−}

24−

25−func testAtlassianProvider(backend *httptest.Server) *AtlassianProvider {

26− p := NewAtlassianProvider(&ProviderData{})

27− u, _ := url.Parse(backend.URL)

28− updateURL(p.ProfileURL, u.Host)

29− updateURL(p.ValidateURL, u.Host)

30− return p

31−}

32−

33−func TestNewAtlassianProvider(t *testing.T) {

34− g := NewWithT(t)

35−

36− providerData := NewAtlassianProvider(&ProviderData{}).Data()

37− g.Expect(providerData.ProviderName).To(Equal("Atlassian"))

38− g.Expect(providerData.LoginURL.String()).To(Equal("https://auth.atlassian.com/authorize"))

39− g.Expect(providerData.RedeemURL.String()).To(Equal("https://auth.atlassian.com/oauth/token"))

40− g.Expect(providerData.ProfileURL.String()).To(Equal("https://api.atlassian.com/me"))

41− g.Expect(providerData.ValidateURL.String()).To(Equal("https://api.atlassian.com/me"))

42− g.Expect(providerData.Scope).To(Equal("read:me"))

43−}

44−

45−func TestAtlassianProviderGetLoginURL(t *testing.T) {

46− g := NewWithT(t)

47− p := NewAtlassianProvider(&ProviderData{ClientID: "client"})

48−

49− loginURL, err := url.Parse(p.GetLoginURL("https://proxy/oauth2/callback", "state", "",

50− url.Values{"approval_prompt": {"force"}}))

51− g.Expect(err).ToNot(HaveOccurred())

52−

53− q := loginURL.Query()

54− g.Expect(q.Get("audience")).To(Equal("api.atlassian.com"))

55− g.Expect(q.Get("prompt")).To(Equal("consent"))

56− g.Expect(q.Has("approval_prompt")).To(BeFalse())

57− g.Expect(q.Get("scope")).To(Equal("read:me"))

58−

59− loginURL, err = url.Parse(p.GetLoginURL("https://proxy/oauth2/callback", "state", "",

60− url.Values{"prompt": {"login"}}))

61− g.Expect(err).ToNot(HaveOccurred())

62− g.Expect(loginURL.Query().Get("prompt")).To(Equal("login"))

63−}

64−

65−func TestAtlassianProviderEnrichSession(t *testing.T) {

66− g := NewWithT(t)

67− b := testAtlassianBackend(http.StatusOK, `{"account_id":"abc","email":"user@example.com"}`)

68− defer b.Close()

69− p := testAtlassianProvider(b)

70−

71− session := CreateAuthorizedSession()

72− g.Expect(p.EnrichSession(context.Background(), session)).To(Succeed())

73− g.Expect(session.Email).To(Equal("user@example.com"))

74−}

75−

76−func TestAtlassianProviderEnrichSessionWithoutEmail(t *testing.T) {

77− g := NewWithT(t)

78− b := testAtlassianBackend(http.StatusOK, `{"account_id":"abc"}`)

79− defer b.Close()

80− p := testAtlassianProvider(b)

81−

82− g.Expect(p.EnrichSession(context.Background(), CreateAuthorizedSession())).ToNot(Succeed())

83−}

84−

85−func TestAtlassianProviderValidateSession(t *testing.T) {

86− g := NewWithT(t)

87− b := testAtlassianBackend(http.StatusOK, `{"email":"user@example.com"}`)

88− defer b.Close()

89− p := testAtlassianProvider(b)

90−

91− g.Expect(p.ValidateSession(context.Background(), CreateAuthorizedSession())).To(BeTrue())

92− g.Expect(p.ValidateSession(context.Background(), &sessions.SessionState{AccessToken: "wrong"})).To(BeFalse())

93−}

providers/dtt_sso.godeleted−202

@@ -1,202 +0,0 @@

1−package providers

2−

3−import (

4− "bytes"

5− "context"

6− "encoding/base64"

7− "errors"

8− "fmt"

9− "net/http"

10− "net/url"

11− "time"

12−

13− "github.com/golang-jwt/jwt/v5"

14− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

15− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"

16−)

17−

18−// DTTSSOProvider signs users in with the DTT SSO (auth-server).

19−type DTTSSOProvider struct {

20− *ProviderData

21−}

22−

23−var _ Provider = (*DTTSSOProvider)(nil)

24−

25−const (

26− dttSSOProviderName = "DTT SSO"

27− dttSSODefaultScope = "openid"

28−)

29−

30−var (

31− dttSSODefaultLoginURL = &url.URL{

32− Scheme: "https",

33− Host: "auth.thebestagent.pro",

34− Path: "/oauth/authorize",

35− }

36−

37− dttSSODefaultRedeemURL = &url.URL{

38− Scheme: "https",

39− Host: "auth.thebestagent.pro",

40− Path: "/oauth/token",

41− }

42−

43− dttSSODefaultValidateURL = &url.URL{

44− Scheme: "https",

45− Host: "auth.thebestagent.pro",

46− Path: "/oauth/check_token",

47− }

48−)

49−

50−// NewDTTSSOProvider initiates a new DTTSSOProvider

51−func NewDTTSSOProvider(p *ProviderData) *DTTSSOProvider {

52− p.setProviderDefaults(providerDefaults{

53− name: dttSSOProviderName,

54− loginURL: dttSSODefaultLoginURL,

55− redeemURL: dttSSODefaultRedeemURL,

56− profileURL: nil,

57− validateURL: dttSSODefaultValidateURL,

58− scope: dttSSODefaultScope,

59− })

60− return &DTTSSOProvider{ProviderData: p}

61−}

62−

63−// dttSSOTokenResponse is the SSO's /oauth/token response.

64−type dttSSOTokenResponse struct {

65− AccessToken string `json:"access_token"`

66− RefreshToken string `json:"refresh_token"`

67− ExpiresIn int64 `json:"expires_in"`

68− IDToken string `json:"id_token"`

69−}

70−

71−// dttSSOClaims holds the id_token claims the provider uses.

72−type dttSSOClaims struct {

73− jwt.RegisteredClaims

74− Email string `json:"email"`

75− Role string `json:"role"`

76− UserID string `json:"user_id"`

77−}

78−

79−// Redeem exchanges the authorization code for a session.

80−func (p *DTTSSOProvider) Redeem(ctx context.Context, redirectURL, code, _ string) (*sessions.SessionState, error) {

81− if code == "" {

82− return nil, ErrMissingCode

83− }

84− return p.requestTokens(ctx, url.Values{

85− "grant_type": {"authorization_code"},

86− "code": {code},

87− "redirect_uri": {redirectURL},

88− })

89−}

90−

91−// RefreshSession renews the tokens and re-reads the email and role.

92−func (p *DTTSSOProvider) RefreshSession(ctx context.Context, s *sessions.SessionState) (bool, error) {

93− if s == nil || s.RefreshToken == "" {

94− return false, nil

95− }

96− refreshed, err := p.requestTokens(ctx, url.Values{

97− "grant_type": {"refresh_token"},

98− "refresh_token": {s.RefreshToken},

99− })

100− if err != nil {

101− return false, fmt.Errorf("unable to redeem refresh token: %v", err)

102− }

103− s.AccessToken = refreshed.AccessToken

104− s.RefreshToken = refreshed.RefreshToken

105− s.IDToken = refreshed.IDToken

106− s.Email = refreshed.Email

107− s.User = refreshed.User

108− s.Groups = refreshed.Groups

109− s.CreatedAt = refreshed.CreatedAt

110− s.ExpiresOn = refreshed.ExpiresOn

111− return true, nil

112−}

113−

114−// ValidateSession checks the access token with the SSO's check_token endpoint.

115−func (p *DTTSSOProvider) ValidateSession(ctx context.Context, s *sessions.SessionState) bool {

116− return validateToken(ctx, p, s.AccessToken, makeOIDCHeader(s.AccessToken))

117−}

118−

119−// requestTokens calls the token endpoint and builds a session from the verified id_token.

120−//

121−// The SSO compares the Basic credentials byte for byte, so they are sent unescaped

122−// rather than through golang.org/x/oauth2, which URL-escapes them.

123−func (p *DTTSSOProvider) requestTokens(ctx context.Context, params url.Values) (*sessions.SessionState, error) {

124− clientSecret, err := p.GetClientSecret()

125− if err != nil {

126− return nil, err

127− }

128− credentials := base64.StdEncoding.EncodeToString([]byte(p.ClientID + ":" + clientSecret))

129−

130− result := requests.New(p.RedeemURL.String()).

131− WithContext(ctx).

132− WithMethod(http.MethodPost).

133− WithBody(bytes.NewBufferString(params.Encode())).

134− SetHeader("Content-Type", "application/x-www-form-urlencoded").

135− SetHeader("Authorization", "Basic "+credentials).

136− Do()

137− if result.Error() != nil {

138− return nil, result.Error()

139− }

140− if result.StatusCode() != http.StatusOK {

141− return nil, fmt.Errorf("token request failed: status %d - %s", result.StatusCode(), result.Body())

142− }

143−

144− var token dttSSOTokenResponse

145− if err := result.UnmarshalInto(&token); err != nil {

146− return nil, err

147− }

148− if token.AccessToken == "" {

149− return nil, errors.New("token response carried no access_token")

150− }

151− claims, err := p.verifyIDToken(token.IDToken, clientSecret)

152− if err != nil {

153− return nil, err

154− }

155−

156− s := &sessions.SessionState{

157− AccessToken: token.AccessToken,

158− RefreshToken: token.RefreshToken,

159− IDToken: token.IDToken,

160− Email: claims.Email,

161− User: claims.UserID,

162− }

163− if claims.Role != "" {

164− s.Groups = []string{claims.Role}

165− }

166− s.CreatedAtNow()

167− if token.ExpiresIn > 0 {

168− s.ExpiresIn(time.Duration(token.ExpiresIn) * time.Second)

169− }

170− return s, nil

171−}

172−

173−// verifyIDToken checks the id_token's HS256 signature (keyed on the client secret),

174−// issuer, audience and expiry.

175−//

176−// go-jose is not used: it rejects HMAC keys under 32 bytes, and SSO client secrets

177−// can be shorter.

178−func (p *DTTSSOProvider) verifyIDToken(raw, clientSecret string) (*dttSSOClaims, error) {

179− if raw == "" {

180− return nil, errors.New("token response carried no id_token; the scope must be exactly \"openid\"")

181− }

182− var claims dttSSOClaims

183− _, err := jwt.ParseWithClaims(raw, &claims,

184− func(*jwt.Token) (any, error) { return []byte(clientSecret), nil },

185− jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),

186− jwt.WithIssuer(p.issuer()),

187− jwt.WithAudience(p.ClientID),

188− jwt.WithExpirationRequired(),

189− )

190− if err != nil {

191− return nil, fmt.Errorf("verifying id_token: %v", err)

192− }

193− if claims.Email == "" {

194− return nil, errors.New("id_token carries no email")

195− }

196− return &claims, nil

197−}

198−

199−// issuer is the SSO's site host, the origin of the login URL.

200−func (p *DTTSSOProvider) issuer() string {

201− return p.LoginURL.Scheme + "://" + p.LoginURL.Host

202−}

providers/dtt_sso_test.godeleted−237

@@ -1,237 +0,0 @@

1−package providers

2−

3−import (

4− "context"

5− "encoding/base64"

6− "encoding/json"

7− "net/http"

8− "net/http/httptest"

9− "net/url"

10− "testing"

11− "time"

12−

13− "github.com/golang-jwt/jwt/v5"

14− "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"

15− . "github.com/onsi/gomega"

16−)

17−

18−const (

19− dttSSOTestClientID = "redash-gate"

20− // Shorter than 32 bytes, and contains characters golang.org/x/oauth2 would

21− // URL-escape in Basic auth.

22− dttSSOTestSecret = "s3cr+t/abc=="

23−)

24−

25−// dttSSOTestServer mimics the SSO's token and check_token endpoints.

26−type dttSSOTestServer struct {

27− *httptest.Server

28− claims map[string]interface{}

29− signingKey []byte

30− lastForm url.Values

31− validTokens map[string]bool

32− tokenCounter int

33−}

34−

35−func newDTTSSOTestServer() *dttSSOTestServer {

36− s := &dttSSOTestServer{

37− signingKey: []byte(dttSSOTestSecret),

38− validTokens: map[string]bool{},

39− }

40− s.Server = httptest.NewServer(http.HandlerFunc(s.handle))

41− u, _ := url.Parse(s.URL)

42− s.claims = map[string]interface{}{

43− "iss": "http://" + u.Host,

44− "aud": dttSSOTestClientID,

45− "sub": "0b5c1e1a-1111-2222-3333-444455556666",

46− "user_id": "0b5c1e1a-1111-2222-3333-444455556666",

47− "email": "admin@example.com",

48− "role": "dtt_admin",

49− "exp": time.Now().Add(time.Hour).Unix(),

50− }

51− return s

52−}

53−

54−func (s *dttSSOTestServer) handle(w http.ResponseWriter, r *http.Request) {

55− switch r.URL.Path {

56− case "/oauth/token":

57− want := "Basic " + base64.StdEncoding.EncodeToString([]byte(dttSSOTestClientID+":"+dttSSOTestSecret))

58− if r.Header.Get("Authorization") != want {

59− w.WriteHeader(http.StatusUnauthorized)

60− return

61− }

62− _ = r.ParseForm()

63− s.lastForm = r.PostForm

64− if r.PostForm.Get("grant_type") == "refresh_token" && !s.validTokens["refresh-"+r.PostForm.Get("refresh_token")] {

65− w.WriteHeader(http.StatusBadRequest)

66− _, _ = w.Write([]byte(`{"error":"invalid_grant","error_description":"Invalid refresh token"}`))

67− return

68− }

69− s.tokenCounter++

70− access := "access-" + string(rune('0'+s.tokenCounter))

71− refresh := "refresh-" + string(rune('0'+s.tokenCounter))

72− s.validTokens[access] = true

73− s.validTokens["refresh-"+refresh] = true

74− w.Header().Set("Content-Type", "application/json")

75− _ = json.NewEncoder(w).Encode(map[string]interface{}{

76− "access_token": access,

77− "token_type": "bearer",

78− "expires_in": 3600,

79− "refresh_token": refresh,

80− "id_token": s.idToken(),

81− "scope": "openid",

82− })

83− case "/oauth/check_token":

84− token := r.Header.Get("Authorization")

85− if len(token) > len("Bearer ") && s.validTokens[token[len("Bearer "):]] {

86− _, _ = w.Write([]byte(`{"user_id":"0b5c1e1a-1111-2222-3333-444455556666","real_user_id":null,"issued_by":"redash-gate"}`))

87− return

88− }

89− w.WriteHeader(http.StatusUnauthorized)

90− _, _ = w.Write([]byte("Invalid access token"))

91− default:

92− w.WriteHeader(http.StatusNotFound)

93− }

94−}

95−

96−func (s *dttSSOTestServer) idToken() string {

97− if s.claims == nil {

98− return ""

99− }

100− raw, err := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims(s.claims)).SignedString(s.signingKey)

101− if err != nil {

102− panic(err)

103− }

104− return raw

105−}

106−

107−func testDTTSSOProvider(server *dttSSOTestServer) *DTTSSOProvider {

108− p := NewDTTSSOProvider(&ProviderData{ClientID: dttSSOTestClientID, ClientSecret: dttSSOTestSecret})

109− u, _ := url.Parse(server.URL)

110− updateURL(p.LoginURL, u.Host)

111− updateURL(p.RedeemURL, u.Host)

112− updateURL(p.ValidateURL, u.Host)

113− return p

114−}

115−

116−func TestNewDTTSSOProvider(t *testing.T) {

117− g := NewWithT(t)

118−

119− providerData := NewDTTSSOProvider(&ProviderData{}).Data()

120− g.Expect(providerData.ProviderName).To(Equal("DTT SSO"))

121− g.Expect(providerData.LoginURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/authorize"))

122− g.Expect(providerData.RedeemURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/token"))

123− g.Expect(providerData.ValidateURL.String()).To(Equal("https://auth.thebestagent.pro/oauth/check_token"))

124− g.Expect(providerData.Scope).To(Equal("openid"))

125−}

126−

127−func TestDTTSSOProviderRedeem(t *testing.T) {

128− g := NewWithT(t)

129− server := newDTTSSOTestServer()

130− defer server.Close()

131− p := testDTTSSOProvider(server)

132−

133− s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

134− g.Expect(err).ToNot(HaveOccurred())

135− g.Expect(s.Email).To(Equal("admin@example.com"))

136− g.Expect(s.User).To(Equal("0b5c1e1a-1111-2222-3333-444455556666"))

137− g.Expect(s.Groups).To(Equal([]string{"dtt_admin"}))

138− g.Expect(s.AccessToken).To(Equal("access-1"))

139− g.Expect(s.RefreshToken).To(Equal("refresh-1"))

140− g.Expect(s.IDToken).ToNot(BeEmpty())

141− g.Expect(s.ExpiresOn).ToNot(BeNil())

142− g.Expect(*s.ExpiresOn).To(BeTemporally("~", time.Now().Add(time.Hour), time.Minute))

143−

144− g.Expect(server.lastForm.Get("grant_type")).To(Equal("authorization_code"))

145− g.Expect(server.lastForm.Get("code")).To(Equal("the-code"))

146− g.Expect(server.lastForm.Get("redirect_uri")).To(Equal("https://redash.example.com/oauth2/callback"))

147−}

148−

149−func TestDTTSSOProviderRedeemRejectsBadIDTokens(t *testing.T) {

150− testCases := map[string]func(s *dttSSOTestServer){

151− "signed with another secret": func(s *dttSSOTestServer) { s.signingKey = []byte("some-other-client-secret") },

152− "other audience": func(s *dttSSOTestServer) { s.claims["aud"] = "frappe-gate" },

153− "other issuer": func(s *dttSSOTestServer) { s.claims["iss"] = "https://evil.example.com" },

154− "expired": func(s *dttSSOTestServer) { s.claims["exp"] = time.Now().Add(-time.Minute).Unix() },

155− "no email": func(s *dttSSOTestServer) { delete(s.claims, "email") },

156− "no id_token": func(s *dttSSOTestServer) { s.claims = nil },

157− }

158− for name, tamper := range testCases {

159− t.Run(name, func(t *testing.T) {

160− g := NewWithT(t)

161− server := newDTTSSOTestServer()

162− defer server.Close()

163− tamper(server)

164−

165− _, err := testDTTSSOProvider(server).Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

166− g.Expect(err).To(HaveOccurred())

167− })

168− }

169−}

170−

171−func TestDTTSSOProviderRedeemRejectsUnsignedIDToken(t *testing.T) {

172− g := NewWithT(t)

173− server := newDTTSSOTestServer()

174− defer server.Close()

175− p := testDTTSSOProvider(server)

176−

177− header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none"}`))

178− payload, _ := json.Marshal(server.claims)

179− unsigned := header + "." + base64.RawURLEncoding.EncodeToString(payload) + "."

180−

181− _, err := p.verifyIDToken(unsigned, dttSSOTestSecret)

182− g.Expect(err).To(HaveOccurred())

183−}

184−

185−func TestDTTSSOProviderRefreshSession(t *testing.T) {

186− g := NewWithT(t)

187− server := newDTTSSOTestServer()

188− defer server.Close()

189− p := testDTTSSOProvider(server)

190−

191− s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

192− g.Expect(err).ToNot(HaveOccurred())

193− nonce := []byte("keep-me")

194− s.Nonce = nonce

195−

196− server.claims["role"] = "agent"

197− server.claims["email"] = "renamed@example.com"

198− refreshed, err := p.RefreshSession(context.Background(), s)

199− g.Expect(err).ToNot(HaveOccurred())

200− g.Expect(refreshed).To(BeTrue())

201− g.Expect(s.AccessToken).To(Equal("access-2"))

202− g.Expect(s.RefreshToken).To(Equal("refresh-2"))

203− g.Expect(s.Groups).To(Equal([]string{"agent"}))

204− g.Expect(s.Email).To(Equal("renamed@example.com"))

205− g.Expect(s.Nonce).To(Equal(nonce))

206− g.Expect(server.lastForm.Get("grant_type")).To(Equal("refresh_token"))

207− g.Expect(server.lastForm.Get("refresh_token")).To(Equal("refresh-1"))

208−}

209−

210−func TestDTTSSOProviderRefreshSessionFailures(t *testing.T) {

211− g := NewWithT(t)

212− server := newDTTSSOTestServer()

213− defer server.Close()

214− p := testDTTSSOProvider(server)

215−

216− refreshed, err := p.RefreshSession(context.Background(), &sessions.SessionState{})

217− g.Expect(err).ToNot(HaveOccurred())

218− g.Expect(refreshed).To(BeFalse())

219−

220− refreshed, err = p.RefreshSession(context.Background(), &sessions.SessionState{RefreshToken: "revoked"})

221− g.Expect(err).To(HaveOccurred())

222− g.Expect(refreshed).To(BeFalse())

223−}

224−

225−func TestDTTSSOProviderValidateSession(t *testing.T) {

226− g := NewWithT(t)

227− server := newDTTSSOTestServer()

228− defer server.Close()

229− p := testDTTSSOProvider(server)

230−

231− s, err := p.Redeem(context.Background(), "https://redash.example.com/oauth2/callback", "the-code", "")

232− g.Expect(err).ToNot(HaveOccurred())

233− g.Expect(p.ValidateSession(context.Background(), s)).To(BeTrue())

234−

235− delete(server.validTokens, s.AccessToken)

236− g.Expect(p.ValidateSession(context.Background(), s)).To(BeFalse())

237−}

providers/providers.go+3−7

@@ -40,8 +40,6 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

4040 switch providerConfig.Type {

4141 case options.ADFSProvider:

4242 return NewADFSProvider(providerData, providerConfig), nil

43− case options.AtlassianProvider:

44− return NewAtlassianProvider(providerData), nil

4543 case options.AzureProvider:

4644 return NewAzureProvider(providerData, providerConfig.AzureConfig), nil

4745 case options.MicrosoftEntraIDProvider:

@@ -52,8 +50,6 @@ func NewProvider(providerConfig options.Provider) (Provider, error) {

5250 return NewCIDAASProvider(providerData, providerConfig), nil

5351 case options.DigitalOceanProvider:

5452 return NewDigitalOceanProvider(providerData), nil

55− case options.DTTSSOProvider:

56− return NewDTTSSOProvider(providerData), nil

5753 case options.FacebookProvider:

5854 return NewFacebookProvider(providerData), nil

5955 case options.GitHubProvider:

@@ -193,9 +189,9 @@ func parseCodeChallengeMethod(providerConfig options.Provider) string {

193189

194190func providerRequiresOIDCProviderVerifier(providerType options.ProviderType) (bool, error) {

195191 switch providerType {

196− case options.AtlassianProvider, options.BitbucketProvider, options.DigitalOceanProvider, options.DTTSSOProvider,

197− options.FacebookProvider, options.GitHubProvider, options.GoogleProvider, options.KeycloakProvider,

198− options.LinkedInProvider, options.LoginGovProvider, options.NextCloudProvider, options.SourceHutProvider:

192+ case options.BitbucketProvider, options.DigitalOceanProvider, options.FacebookProvider, options.GitHubProvider,

193+ options.GoogleProvider, options.KeycloakProvider, options.LinkedInProvider, options.LoginGovProvider,

194+ options.NextCloudProvider, options.SourceHutProvider:

199195 return false, nil

200196 case options.OIDCProvider, options.ADFSProvider, options.AzureProvider, options.CidaasProvider,

201197 options.GitLabProvider, options.KeycloakOIDCProvider, options.MicrosoftEntraIDProvider: