forked from oauth2-proxy/oauth2-proxy
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix gitea token validation by allowing custom validation url and extr…
…acting the proper base api url for github cloud, github enterprise and gitea
- Loading branch information
Showing
8 changed files
with
306 additions
and
72 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| # This docker-compose file can be used to bring up an example instance of oauth2-proxy | ||
| # for manual testing and exploration of features. | ||
| # Alongside OAuth2-Proxy, this file also starts Gitea to act as the identity provider, | ||
| # HTTPBin as an example upstream. | ||
| # | ||
| # This can either be created using docker-compose | ||
| # docker-compose -f docker-compose-gitea.yaml <command> | ||
| # Or: | ||
| # make gitea-<command> (eg. make gitea-up, make gitea-down) | ||
| # | ||
| # Access http://oauth2-proxy.localtest.me:4180 to initiate a login cycle using user=admin@example.com, password=password | ||
| # Access http://gitea.localtest.me:3000 with the same credentials to check out the settings | ||
| version: '3.0' | ||
| services: | ||
| oauth2-proxy: | ||
| container_name: oauth2-proxy | ||
| image: gitea-oauth #quay.io/oauth2-proxy/oauth2-proxy:v7.4.0 | ||
| command: --config /oauth2-proxy.cfg | ||
| hostname: oauth2-proxy | ||
| volumes: | ||
| - "./oauth2-proxy-gitea.cfg:/oauth2-proxy.cfg" | ||
| restart: unless-stopped | ||
| networks: | ||
| gitea: {} | ||
| httpbin: {} | ||
| oauth2-proxy: {} | ||
| depends_on: | ||
| - httpbin | ||
| - gitea | ||
| ports: | ||
| - 4180:4180/tcp | ||
|
|
||
| httpbin: | ||
| container_name: httpbin | ||
| image: kennethreitz/httpbin:latest | ||
| hostname: httpbin | ||
| ports: | ||
| - 8080:80 | ||
| networks: | ||
| httpbin: | ||
| aliases: | ||
| - httpbin.localtest.me | ||
|
|
||
| gitea: | ||
| image: gitea/gitea:latest | ||
| container_name: gitea | ||
| environment: | ||
| - USER_UID=1000 | ||
| - USER_GID=1000 | ||
| restart: always | ||
| networks: | ||
| gitea: | ||
| aliases: | ||
| - gitea.localtest.me | ||
| volumes: | ||
| - /etc/timezone:/etc/timezone:ro | ||
| - /etc/localtime:/etc/localtime:ro | ||
| ports: | ||
| - "3000:3000" | ||
| - "222:22" | ||
|
|
||
| networks: | ||
| httpbin: {} | ||
| gitea: {} | ||
| oauth2-proxy: {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| http_address="0.0.0.0:4180" | ||
| cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w=" | ||
| email_domains=["localhost"] | ||
| cookie_secure="false" | ||
| upstreams="http://httpbin" | ||
| cookie_domains=[".localtest.me"] # Required so cookie can be read on all subdomains. | ||
| whitelist_domains=[".localtest.me"] # Required to allow redirection back to original requested target. | ||
|
|
||
| client_id="ef0c2b91-2e38-4fa8-908d-067a35dbb71c" | ||
| client_secret="gto_qdppomn2p26su5x46tyixj7bcny5m5er2s67xhrponq2qtp66f3a" | ||
| redirect_url="http://oauth2-proxy.localtest.me:4180/oauth2/callback" | ||
|
|
||
| # gitea provider | ||
| provider="github" | ||
| provider_display_name="Gitea" | ||
| login_url="http://gitea.localtest.me:3000/login/oauth/authorize" | ||
| redeem_url="http://gitea.localtest.me:3000/login/oauth/access_token" | ||
| validate_url="http://gitea.localtest.me:3000/api/v1/user/emails" | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| package providers | ||
|
|
||
| import ( | ||
| "context" | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "net/url" | ||
| "testing" | ||
|
|
||
| "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options" | ||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func testGiteaProvider(hostname string, opts options.GitHubOptions) *GitHubProvider { | ||
| p := NewGitHubProvider( | ||
| &ProviderData{ | ||
| ProviderName: "Gitea", | ||
| LoginURL: &url.URL{}, | ||
| RedeemURL: &url.URL{}, | ||
| ProfileURL: &url.URL{}, | ||
| ValidateURL: &url.URL{Path: "/api/v1/user/emails"}, | ||
| Scope: ""}, | ||
| opts) | ||
| p.ProviderName = "Gitea" | ||
|
|
||
| if hostname != "" { | ||
| updateURL(p.Data().LoginURL, hostname) | ||
| updateURL(p.Data().RedeemURL, hostname) | ||
| updateURL(p.Data().ProfileURL, hostname) | ||
| updateURL(p.Data().ValidateURL, hostname) | ||
| } | ||
| return p | ||
| } | ||
|
|
||
| func testGiteaBackend(payloads map[string][]string) *httptest.Server { | ||
| pathToQueryMap := map[string][]string{ | ||
| "/api/v1/repos/oauth2-proxy/oauth2-proxy": {""}, | ||
| "/api/v1/repos/oauth2-proxy/oauth2-proxy/collaborators/mbland": {""}, | ||
| "/api/v1/user": {""}, | ||
| "/api/v1/user/emails": {""}, | ||
| "/api/v1/user/orgs": {"page=1&per_page=100", "page=2&per_page=100", "page=3&per_page=100"}, | ||
| } | ||
|
|
||
| return httptest.NewServer(http.HandlerFunc( | ||
| func(w http.ResponseWriter, r *http.Request) { | ||
| query, ok := pathToQueryMap[r.URL.Path] | ||
| validQuery := false | ||
| index := 0 | ||
| for i, q := range query { | ||
| if q == r.URL.RawQuery { | ||
| validQuery = true | ||
| index = i | ||
| } | ||
| } | ||
| payload := []string{} | ||
| if ok && validQuery { | ||
| payload, ok = payloads[r.URL.Path] | ||
| } | ||
| if !ok { | ||
| w.WriteHeader(404) | ||
| } else if !validQuery { | ||
| w.WriteHeader(404) | ||
| } else if payload[index] == "" { | ||
| w.WriteHeader(204) | ||
| } else { | ||
| w.WriteHeader(200) | ||
| w.Write([]byte(payload[index])) | ||
| } | ||
| })) | ||
| } | ||
|
|
||
| func TestGiteaProvider_ValidateSessionWithBaseUrl(t *testing.T) { | ||
| b := testGiteaBackend(map[string][]string{}) | ||
| defer b.Close() | ||
|
|
||
| bURL, _ := url.Parse(b.URL) | ||
| p := testGiteaProvider(bURL.Host, options.GitHubOptions{}) | ||
|
|
||
| session := CreateAuthorizedSession() | ||
|
|
||
| valid := p.ValidateSession(context.Background(), session) | ||
| assert.False(t, valid) | ||
| } | ||
|
|
||
| func TestGiteaProvider_ValidateSessionWithUserEmails(t *testing.T) { | ||
| b := testGiteaBackend(map[string][]string{ | ||
| "/api/v1/user/emails": {`[ {"email": "michael.bland@gsa.gov", "verified": true, "primary": true} ]`}, | ||
| }) | ||
| defer b.Close() | ||
|
|
||
| bURL, _ := url.Parse(b.URL) | ||
| p := testGiteaProvider(bURL.Host, options.GitHubOptions{}) | ||
|
|
||
| session := CreateAuthorizedSession() | ||
|
|
||
| valid := p.ValidateSession(context.Background(), session) | ||
| assert.True(t, valid) | ||
| } |
Oops, something went wrong.