Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

draft - Introspect with org ctx #26

Draft
wants to merge 1 commit into
base: edi-foundation-integration
Choose a base branch
from
Draft

draft - Introspect with org ctx #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions oauthproxy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -794,7 +794,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
return
}

err = p.enrichSessionState(req.Context(), session)
err = p.enrichSessionState(req.Context(), session, req.Header)
if err != nil {
logger.Errorf("Error creating session during OAuth2 callback: %v", err)
p.ErrorPage(rw, req, http.StatusInternalServerError, err.Error())
Expand Down Expand Up @@ -860,7 +860,7 @@ func (p *OAuthProxy) redeemCode(req *http.Request) (*sessionsapi.SessionState, e
return s, nil
}

func (p *OAuthProxy) enrichSessionState(ctx context.Context, s *sessionsapi.SessionState) error {
func (p *OAuthProxy) enrichSessionState(ctx context.Context, s *sessionsapi.SessionState, headers map[string][]string) error {
var err error
if s.Email == "" {
// TODO(@NickMeves): Remove once all provider are updated to implement EnrichSession
Expand All @@ -871,7 +871,8 @@ func (p *OAuthProxy) enrichSessionState(ctx context.Context, s *sessionsapi.Sess
}
}

return p.provider.EnrichSession(ctx, s)
ctxWithHeaders := context.WithValue(ctx, "headers", headers)
return p.provider.EnrichSession(ctxWithHeaders, s)
}

// AuthOnly checks whether the user is currently logged in (both authentication
Expand Down
5 changes: 3 additions & 2 deletions oauthproxy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -470,7 +470,7 @@ func Test_enrichSession(t *testing.T) {
t.Fatal(err)
}

err = proxy.enrichSessionState(context.Background(), tc.session)
err = proxy.enrichSessionState(context.Background(), tc.session, nil)
assert.NoError(t, err)
assert.Equal(t, tc.expectedUser, tc.session.User)
assert.Equal(t, tc.expectedEmail, tc.session.Email)
Expand Down Expand Up @@ -1654,7 +1654,8 @@ func (st *SignatureTest) Close() {

// fakeNetConn simulates an http.Request.Body buffer that will be consumed
// when it is read by the hmacauth.HmacAuth if not handled properly. See:
// https://github.com/18F/hmacauth/pull/4
//
// https://github.com/18F/hmacauth/pull/4
type fakeNetConn struct {
reqBody string
}
Expand Down
16 changes: 12 additions & 4 deletions providers/oidc.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,13 +128,21 @@ func (p *OIDCProvider) enrichFromIntrospectURL(ctx context.Context, s *sessions.
params := url.Values{}
params.Add("token", s.AccessToken)
basicAuth := b64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", p.ClientID, clientSecret)))
result := requests.New(p.IntrospectURL.String()).
request := requests.New(p.IntrospectURL.String()).
WithContext(ctx).
WithMethod("POST").
WithBody(bytes.NewBufferString(params.Encode())).
SetHeader("Authorization", fmt.Sprintf("Basic %s", basicAuth)).
SetHeader("Content-Type", "application/x-www-form-urlencoded").
Do()
SetHeader("Content-Type", "application/x-www-form-urlencoded")

var v, ok = ctx.Value("headers").(map[string][]string)
if ok {
orgctx, ok := v["Edisp-Org-Id"]
if ok {
params.Add("org_ctx", orgctx[0])
}
}
request = request.WithBody(bytes.NewBufferString(params.Encode()))
result := request.Do()

if result.StatusCode() != http.StatusOK {
return fmt.Errorf("error while requesting introspect claims, status code - %d", result.StatusCode())
Expand Down