Skip to content

Allow configuration of returned auth proxy header #1839

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sagikazarmark merged 4 commits into from
Jan 7, 2021
Merged

Allow configuration of returned auth proxy header #1839

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a12a919
Allow configuration of returned auth proxy header
seuf Oct 20, 2020
f19bccf
Allow configuration of groups for authproxy
seuf Oct 20, 2020
a1c7198
Rename config header to userHeader
seuf Nov 24, 2020
e164bb3
Apply suggestions from code review
seuf Dec 17, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions connector/authproxy/authproxy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,16 +14,24 @@ import (

// Config holds the configuration parameters for a connector which returns an
// identity with the HTTP header X-Remote-User as verified email.
type Config struct{}
type Config struct {
UserHeader string `json:"userHeader"`
}

// Open returns an authentication strategy which requires no user interaction.
func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) {
return &callback{logger: logger, pathSuffix: "/" + id}, nil
userHeader := c.UserHeader
if userHeader == "" {
userHeader = "X-Remote-User"
}

return &callback{userHeader: userHeader, logger: logger, pathSuffix: "/" + id}, nil
}

// Callback is a connector which returns an identity with the HTTP header
// X-Remote-User as verified email.
type callback struct {
userHeader string
logger log.Logger
pathSuffix string
}
Expand All @@ -43,9 +51,9 @@ func (m *callback) LoginURL(s connector.Scopes, callbackURL, state string) (stri

// HandleCallback parses the request and returns the user's identity
func (m *callback) HandleCallback(s connector.Scopes, r *http.Request) (connector.Identity, error) {
remoteUser := r.Header.Get("X-Remote-User")
remoteUser := r.Header.Get(m.userHeader)
if remoteUser == "" {
return connector.Identity{}, fmt.Errorf("required HTTP header X-Remote-User is not set")
return connector.Identity{}, fmt.Errorf("required HTTP header %s is not set", m.userHeader)
}
// TODO: add support for X-Remote-Group, see
// https://kubernetes.io/docs/admin/authentication/#authenticating-proxy
Expand Down