Skip to content

[SQSERVICES-1780] OAuth token handling (5/n) #2931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
battermann wants to merge 18 commits into from
Closed

[SQSERVICES-1780] OAuth token handling (5/n) #2931

Show file tree
Hide file tree
Changes from 15 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
0dbed7e
moved oauth types to wire-api
battermann Dec 15, 2022
21c2728
de-/encode jwt inside toschema instance
battermann Dec 15, 2022
8282ef9
servant combinator
battermann Dec 16, 2022
246d1f3
better
battermann Dec 16, 2022
d45105f
check scope in hasserver
battermann Dec 16, 2022
1b3ea4b
clean up
battermann Dec 16, 2022
94631c4
test vs nginz
battermann Dec 19, 2022
91adbbf
crude change in nginz
battermann Dec 20, 2022
a76d5fa
use Z-OAuth header for oauth
battermann Dec 21, 2022
a4d8e84
refactoring
battermann Dec 21, 2022
043008f
renaming
battermann Dec 21, 2022
6d8cf57
small refactoring of nginx module
battermann Dec 22, 2022
3765b8d
more failure tests
battermann Dec 22, 2022
84d6bbe
changelog
battermann Dec 23, 2022
50afa1b
enable oauth in nginz config
battermann Dec 23, 2022
243423e
set zauth_user in nginz only if authorized and allowed
battermann Dec 23, 2022
ba0833b
trailing whitespaces
battermann Jan 3, 2023
31ee8f6
additional checks in nginz to reduce load on brig
battermann Jan 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/2-features/pr-2931
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Endpoints can now be configured to enable OAuth access.
8 changes: 4 additions & 4 deletions charts/nginz/templates/conf/_nginx.conf.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,10 @@ http {
{{- end }}
{{- end }}

{{- if ($location.enable_oauth) }}
oauth on;
{{- end }}

{{- if hasKey $location "specific_user_rate_limit" }}
limit_req zone={{ $location.specific_user_rate_limit }}{{ if hasKey $location "specific_user_rate_limit_burst" }} burst={{ $location.specific_user_rate_limit_burst }}{{ end }} nodelay;
{{- end }}
Expand Down Expand Up @@ -295,10 +299,6 @@ http {
proxy_set_header Connection "";
{{ end -}}

{{- if not ($location.disable_zauth) }}
proxy_set_header Authorization "";
{{- end }}

proxy_set_header Z-Type $zauth_type;
proxy_set_header Z-User $zauth_user;
proxy_set_header Z-Client $zauth_client;
Expand Down
1 change: 1 addition & 0 deletions charts/nginz/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,7 @@ nginx_conf:
envs:
- staging
- path: /self$ # Matches exactly /self
enable_oauth: true
envs:
- all
- path: /self/name
Expand Down
2 changes: 2 additions & 0 deletions libs/wire-api/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@
, iproute
, iso3166-country-codes
, iso639
, jose
, lens
, lib
, memory
Expand Down Expand Up @@ -152,6 +153,7 @@ mkDerivation {
iproute
iso3166-country-codes
iso639
jose
lens
memory
metrics-wai
Expand Down
Loading