mirror
/
dex
mirror of https://github.com/dexidp/dex.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

fix(connector): update authproxy and oauth to match CallbackConnector interface (#4589) 

The PKCE support added in v2.45.0 changed the CallbackConnector interface
signatures but missed updating the authproxy and oauth connectors. This
caused a type assertion failure in handleConnectorLogin(), resulting in
"Requested resource does not exist" errors when using these connectors.

Update LoginURL to return (string, []byte, error) and HandleCallback to
accept a []byte connData parameter for both connectors and their tests.

Signed-off-by: Mathias Gebbe <mathias.gebbe@gmail.com>
pull/4591/head
Mathias Gebbe 3 weeks ago committed by GitHub
parent
4311931881
commit
44e27490be
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 19 additions and 19 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 8
      connector/authproxy/authproxy.go
  2. 12
      connector/authproxy/authproxy_test.go
  3. 8
      connector/oauth/oauth.go
  4. 10
      connector/oauth/oauth_test.go

8
connector/authproxy/authproxy.go
Unescape View File

@ -83,20 +83,20 @@ type callback struct {
} }
// LoginURL returns the URL to redirect the user to login with. // LoginURL returns the URL to redirect the user to login with.
func (m *callback) LoginURL(s connector.Scopes, callbackURL, state string) (string, error) { func (m *callback) LoginURL(s connector.Scopes, callbackURL, state string) (string, []byte, error) {
u, err := url.Parse(callbackURL) u, err := url.Parse(callbackURL)
if err != nil { if err != nil {
return "", fmt.Errorf("failed to parse callbackURL %q: %v", callbackURL, err) return "", nil, fmt.Errorf("failed to parse callbackURL %q: %v", callbackURL, err)
} }
u.Path += m.pathSuffix u.Path += m.pathSuffix
v := u.Query() v := u.Query()
v.Set("state", state) v.Set("state", state)
u.RawQuery = v.Encode() u.RawQuery = v.Encode()
return u.String(), nil return u.String(), nil, nil
} }
// HandleCallback parses the request and returns the user's identity // HandleCallback parses the request and returns the user's identity
func (m *callback) HandleCallback(s connector.Scopes, r *http.Request) (connector.Identity, error) { func (m *callback) HandleCallback(s connector.Scopes, _ []byte, r *http.Request) (connector.Identity, error) {
remoteUser := r.Header.Get(m.userHeader) remoteUser := r.Header.Get(m.userHeader)
if remoteUser == "" { if remoteUser == "" {
return connector.Identity{}, fmt.Errorf("required HTTP header %s is not set", m.userHeader) return connector.Identity{}, fmt.Errorf("required HTTP header %s is not set", m.userHeader)

12
connector/authproxy/authproxy_test.go
Unescape View File

@ -36,7 +36,7 @@ func TestUser(t *testing.T) {
"X-Remote-User": {testUsername}, "X-Remote-User": {testUsername},
} }
ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req) ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
expectNil(t, err) expectNil(t, err)
// If not specified, the userID and email should fall back to the remote user // If not specified, the userID and email should fall back to the remote user
@ -62,7 +62,7 @@ func TestExtraHeaders(t *testing.T) {
"X-Remote-User-Email": {testEmail}, "X-Remote-User-Email": {testEmail},
} }
ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req) ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
expectNil(t, err) expectNil(t, err)
expectEquals(t, ident.UserID, testUserID) expectEquals(t, ident.UserID, testUserID)
@ -85,7 +85,7 @@ func TestSingleGroup(t *testing.T) {
"X-Remote-Group": {testGroup1}, "X-Remote-Group": {testGroup1},
} }
ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req) ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
expectNil(t, err) expectNil(t, err)
expectEquals(t, ident.UserID, testEmail) expectEquals(t, ident.UserID, testEmail)
@ -106,7 +106,7 @@ func TestMultipleGroup(t *testing.T) {
"X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4}, "X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4},
} }
ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req) ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
expectNil(t, err) expectNil(t, err)
expectEquals(t, ident.UserID, testEmail) expectEquals(t, ident.UserID, testEmail)
@ -132,7 +132,7 @@ func TestMultipleGroupWithCustomSeparator(t *testing.T) {
"X-Remote-Group": {testGroup1 + ";" + testGroup2 + ";" + testGroup3 + ";" + testGroup4}, "X-Remote-Group": {testGroup1 + ";" + testGroup2 + ";" + testGroup3 + ";" + testGroup4},
} }
ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req) ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
expectNil(t, err) expectNil(t, err)
expectEquals(t, ident.UserID, testEmail) expectEquals(t, ident.UserID, testEmail)
@ -158,7 +158,7 @@ func TestStaticGroup(t *testing.T) {
"X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4}, "X-Remote-Group": {testGroup1 + ", " + testGroup2 + ", " + testGroup3 + ", " + testGroup4},
} }
ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, req) ident, err := callback.HandleCallback(connector.Scopes{OfflineAccess: true, Groups: true}, nil, req)
expectNil(t, err) expectNil(t, err)
expectEquals(t, ident.UserID, testEmail) expectEquals(t, ident.UserID, testEmail)

8
connector/oauth/oauth.go
Unescape View File

@ -116,9 +116,9 @@ func (c *Config) Open(id string, logger *slog.Logger) (connector.Connector, erro
return oauthConn, err return oauthConn, err
} }
func (c *oauthConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, error) { func (c *oauthConnector) LoginURL(scopes connector.Scopes, callbackURL, state string) (string, []byte, error) {
if c.redirectURI != callbackURL { if c.redirectURI != callbackURL {
return "", fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI) return "", nil, fmt.Errorf("expected callback URL %q did not match the URL in the config %q", callbackURL, c.redirectURI)
} }
oauth2Config := &oauth2.Config{ oauth2Config := &oauth2.Config{
@ -129,10 +129,10 @@ func (c *oauthConnector) LoginURL(scopes connector.Scopes, callbackURL, state st
Scopes: c.scopes, Scopes: c.scopes,
} }
return oauth2Config.AuthCodeURL(state), nil return oauth2Config.AuthCodeURL(state), nil, nil
} }
func (c *oauthConnector) HandleCallback(s connector.Scopes, r *http.Request) (identity connector.Identity, err error) { func (c *oauthConnector) HandleCallback(s connector.Scopes, _ []byte, r *http.Request) (identity connector.Identity, err error) {
q := r.URL.Query() q := r.URL.Query()
if errType := q.Get("error"); errType != "" { if errType := q.Get("error"); errType != "" {
return identity, errors.New(q.Get("error_description")) return identity, errors.New(q.Get("error_description"))

10
connector/oauth/oauth_test.go
Unescape View File

@ -50,7 +50,7 @@ func TestLoginURL(t *testing.T) {
conn := newConnector(t, testServer.URL) conn := newConnector(t, testServer.URL)
loginURL, err := conn.LoginURL(connector.Scopes{}, conn.redirectURI, "some-state") loginURL, _, err := conn.LoginURL(connector.Scopes{}, conn.redirectURI, "some-state")
assert.Equal(t, err, nil) assert.Equal(t, err, nil)
expectedURL, err := url.Parse(testServer.URL + "/authorize") expectedURL, err := url.Parse(testServer.URL + "/authorize")
@ -86,7 +86,7 @@ func TestHandleCallBackForGroupsInUserInfo(t *testing.T) {
conn := newConnector(t, testServer.URL) conn := newConnector(t, testServer.URL)
req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupsInUserInfo") req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupsInUserInfo")
identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req) identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
assert.Equal(t, err, nil) assert.Equal(t, err, nil)
sort.Strings(identity.Groups) sort.Strings(identity.Groups)
@ -122,7 +122,7 @@ func TestHandleCallBackForGroupMapsInUserInfo(t *testing.T) {
conn := newConnector(t, testServer.URL) conn := newConnector(t, testServer.URL)
req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupMapsInUserInfo") req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupMapsInUserInfo")
identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req) identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
assert.Equal(t, err, nil) assert.Equal(t, err, nil)
sort.Strings(identity.Groups) sort.Strings(identity.Groups)
@ -156,7 +156,7 @@ func TestHandleCallBackForGroupsInToken(t *testing.T) {
conn := newConnector(t, testServer.URL) conn := newConnector(t, testServer.URL)
req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupsInToken") req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallBackForGroupsInToken")
identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req) identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
assert.Equal(t, err, nil) assert.Equal(t, err, nil)
assert.Equal(t, len(identity.Groups), 1) assert.Equal(t, len(identity.Groups), 1)
@ -186,7 +186,7 @@ func TestHandleCallbackForNumericUserID(t *testing.T) {
conn := newConnector(t, testServer.URL) conn := newConnector(t, testServer.URL)
req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallbackForNumericUserID") req := newRequestWithAuthCode(t, testServer.URL, "TestHandleCallbackForNumericUserID")
identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, req) identity, err := conn.HandleCallback(connector.Scopes{Groups: true}, nil, req)
assert.Equal(t, err, nil) assert.Equal(t, err, nil)
assert.Equal(t, identity.UserID, "1000") assert.Equal(t, identity.UserID, "1000")

Write Preview
Loading…
Cancel
Save