731fa9f8e0
- Save both user and email in session state:
Encoding/decoding methods save both email and user
field in session state, for use cases when User is not derived from
email's local-parth, like for GitHub provider.
For retrocompatibility, if no user is obtained by the provider,
(e.g. User is an empty string) the encoding/decoding methods fall back
to the previous behavior and use the email's local-part
Updated also related tests and added two more tests to show behavior
when session contains a non-empty user value.
- Added first basic GitHub provider tests
- Added GetUserName method to Provider interface
The new GetUserName method is intended to return the User
value when this is not the email's local-part.
Added also the default implementation to provider_default.go
- Added call to GetUserName in redeemCode
the new GetUserName method is used in redeemCode
to get SessionState User value.
For backward compatibility, if GetUserName error is
"not implemented", the error is ignored.
- Added GetUserName method and tests to github provider.
128 lines
3.2 KiB
Go
128 lines
3.2 KiB
Go
package providers
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io/ioutil"
|
|
"net/http"
|
|
"net/url"
|
|
|
|
"github.com/bitly/oauth2_proxy/cookie"
|
|
)
|
|
|
|
func (p *ProviderData) Redeem(redirectURL, code string) (s *SessionState, err error) {
|
|
if code == "" {
|
|
err = errors.New("missing code")
|
|
return
|
|
}
|
|
|
|
params := url.Values{}
|
|
params.Add("redirect_uri", redirectURL)
|
|
params.Add("client_id", p.ClientID)
|
|
params.Add("client_secret", p.ClientSecret)
|
|
params.Add("code", code)
|
|
params.Add("grant_type", "authorization_code")
|
|
if p.ProtectedResource != nil && p.ProtectedResource.String() != "" {
|
|
params.Add("resource", p.ProtectedResource.String())
|
|
}
|
|
|
|
var req *http.Request
|
|
req, err = http.NewRequest("POST", p.RedeemURL.String(), bytes.NewBufferString(params.Encode()))
|
|
if err != nil {
|
|
return
|
|
}
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
|
|
var resp *http.Response
|
|
resp, err = http.DefaultClient.Do(req)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var body []byte
|
|
body, err = ioutil.ReadAll(resp.Body)
|
|
resp.Body.Close()
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
if resp.StatusCode != 200 {
|
|
err = fmt.Errorf("got %d from %q %s", resp.StatusCode, p.RedeemURL.String(), body)
|
|
return
|
|
}
|
|
|
|
// blindly try json and x-www-form-urlencoded
|
|
var jsonResponse struct {
|
|
AccessToken string `json:"access_token"`
|
|
}
|
|
err = json.Unmarshal(body, &jsonResponse)
|
|
if err == nil {
|
|
s = &SessionState{
|
|
AccessToken: jsonResponse.AccessToken,
|
|
}
|
|
return
|
|
}
|
|
|
|
var v url.Values
|
|
v, err = url.ParseQuery(string(body))
|
|
if err != nil {
|
|
return
|
|
}
|
|
if a := v.Get("access_token"); a != "" {
|
|
s = &SessionState{AccessToken: a}
|
|
} else {
|
|
err = fmt.Errorf("no access token found %s", body)
|
|
}
|
|
return
|
|
}
|
|
|
|
// GetLoginURL with typical oauth parameters
|
|
func (p *ProviderData) GetLoginURL(redirectURI, state string) string {
|
|
var a url.URL
|
|
a = *p.LoginURL
|
|
params, _ := url.ParseQuery(a.RawQuery)
|
|
params.Set("redirect_uri", redirectURI)
|
|
params.Set("approval_prompt", p.ApprovalPrompt)
|
|
params.Add("scope", p.Scope)
|
|
params.Set("client_id", p.ClientID)
|
|
params.Set("response_type", "code")
|
|
params.Add("state", state)
|
|
a.RawQuery = params.Encode()
|
|
return a.String()
|
|
}
|
|
|
|
// CookieForSession serializes a session state for storage in a cookie
|
|
func (p *ProviderData) CookieForSession(s *SessionState, c *cookie.Cipher) (string, error) {
|
|
return s.EncodeSessionState(c)
|
|
}
|
|
|
|
// SessionFromCookie deserializes a session from a cookie value
|
|
func (p *ProviderData) SessionFromCookie(v string, c *cookie.Cipher) (s *SessionState, err error) {
|
|
return DecodeSessionState(v, c)
|
|
}
|
|
|
|
func (p *ProviderData) GetEmailAddress(s *SessionState) (string, error) {
|
|
return "", errors.New("not implemented")
|
|
}
|
|
|
|
// GetUserName returns the Account username
|
|
func (p *ProviderData) GetUserName(s *SessionState) (string, error) {
|
|
return "", errors.New("not implemented")
|
|
}
|
|
|
|
// ValidateGroup validates that the provided email exists in the configured provider
|
|
// email group(s).
|
|
func (p *ProviderData) ValidateGroup(email string) bool {
|
|
return true
|
|
}
|
|
|
|
func (p *ProviderData) ValidateSessionState(s *SessionState) bool {
|
|
return validateToken(p, s.AccessToken, nil)
|
|
}
|
|
|
|
// RefreshSessionIfNeeded
|
|
func (p *ProviderData) RefreshSessionIfNeeded(s *SessionState) (bool, error) {
|
|
return false, nil
|
|
}
|