forked from oauth2-proxy/oauth2-proxy
-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Isolating some PICS custom changes (#57)
## Description Isolating PICS custom changes ## Motivation and Context It's hard to understand what are our custom changes and what is from OAuth2-Proxy main repo ## How Has This Been Tested? Created a local container image of the oauth-proxy from this PR and integrated it with Reporting locally. - run in the root of this repo - docker buildx build -t oauth-local . - Updated FROM statement in pics/src/services/Oauth2Proxy/Dockerfile to - FROM oauth-local The following flows were checked: - Login - Audit logs - Logout ## Checklist: - [x] Isolating some dunction in separated files - [x] Creating a folder for Pics packages
- Loading branch information
Showing
11 changed files
with
120 additions
and
91 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| package options | ||
|
|
||
| func PicsGetAuthorizationHeader() []Header { | ||
| headers := []Header{ | ||
| { | ||
| Name: "Authorization", | ||
| Values: []HeaderValue{ | ||
| { | ||
| ClaimSource: &ClaimSource{ | ||
| Claim: "id_token", | ||
| Prefix: "Bearer ", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| Name: "x-auth-request-id-token", | ||
| Values: []HeaderValue{ | ||
| { | ||
| ClaimSource: &ClaimSource{ | ||
| Claim: "id_token", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
| return headers | ||
| } | ||
|
|
||
| func PicsGetXAuthIntrospectionValueHeaders() Header { | ||
| return Header{ | ||
| Name: "X-Auth-Introspect-Value", | ||
| Values: []HeaderValue{ | ||
| { | ||
| ClaimSource: &ClaimSource{ | ||
| Claim: "introspect-claims", | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| package providers | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "context" | ||
| b64 "encoding/base64" | ||
| "fmt" | ||
| "net/http" | ||
| "net/url" | ||
|
|
||
| "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions" | ||
| "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger" | ||
| "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests" | ||
| ) | ||
|
|
||
| // enrichFromIntrospectURL enriches a session's claims and permissions via the JSON response of | ||
| // an OIDC Introspection URL | ||
| func (p *OIDCProvider) PicsEnrichFromIntrospectURL(ctx context.Context, s *sessions.SessionState) error { | ||
| clientSecret, err := p.GetClientSecret() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| params := url.Values{} | ||
| params.Add("token", s.AccessToken) | ||
| basicAuth := b64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", p.ClientID, clientSecret))) | ||
| if p.IntrospectURL == nil { | ||
| p.IntrospectURL = &url.URL{ | ||
| Scheme: p.RedeemURL.Scheme, | ||
| Host: p.RedeemURL.Host, | ||
| Path: "/authorize/oauth2/v4/introspect", | ||
| } | ||
| } | ||
| logger.Printf("Requesting introspect from '%s'", p.IntrospectURL) | ||
|
|
||
| result := requests.New(p.IntrospectURL.String()). | ||
| WithContext(ctx). | ||
| WithMethod("POST"). | ||
| WithBody(bytes.NewBufferString(params.Encode())). | ||
| SetHeader("Authorization", fmt.Sprintf("Basic %s", basicAuth)). | ||
| SetHeader("Content-Type", "application/x-www-form-urlencoded"). | ||
| Do() | ||
|
|
||
| if result.StatusCode() != http.StatusOK { | ||
| return fmt.Errorf("error while requesting introspect claims, status code - %d", result.StatusCode()) | ||
| } | ||
| s.IntrospectClaims = b64.StdEncoding.EncodeToString(result.Body()) | ||
| return nil | ||
| } |