|
|
|
|
@ -20,13 +20,18 @@ type Config struct {
|
|
|
|
|
|
|
|
|
|
// Open returns an authentication strategy which requires no user interaction.
|
|
|
|
|
func (c *Config) Open(id string, logger log.Logger) (connector.Connector, error) { |
|
|
|
|
return &callback{UserHeader: c.UserHeader, logger: logger, pathSuffix: "/" + id}, nil |
|
|
|
|
userHeader := c.UserHeader |
|
|
|
|
if userHeader == "" { |
|
|
|
|
userHeader = "X-Remote-User" |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
return &callback{userHeader: userHeader, logger: logger, pathSuffix: "/" + id}, nil |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// Callback is a connector which returns an identity with the HTTP header
|
|
|
|
|
// X-Remote-User as verified email.
|
|
|
|
|
type callback struct { |
|
|
|
|
UserHeader string |
|
|
|
|
userHeader string |
|
|
|
|
logger log.Logger |
|
|
|
|
pathSuffix string |
|
|
|
|
} |
|
|
|
|
@ -46,13 +51,9 @@ func (m *callback) LoginURL(s connector.Scopes, callbackURL, state string) (stri
|
|
|
|
|
|
|
|
|
|
// HandleCallback parses the request and returns the user's identity
|
|
|
|
|
func (m *callback) HandleCallback(s connector.Scopes, r *http.Request) (connector.Identity, error) { |
|
|
|
|
userHeader := "X-Remote-User" // Default value
|
|
|
|
|
if m.UserHeader != "" { |
|
|
|
|
userHeader = m.UserHeader |
|
|
|
|
} |
|
|
|
|
remoteUser := r.Header.Get(userHeader) |
|
|
|
|
remoteUser := r.Header.Get(m.userHeader) |
|
|
|
|
if remoteUser == "" { |
|
|
|
|
return connector.Identity{}, fmt.Errorf("required HTTP header %s is not set", m.UserHeader) |
|
|
|
|
return connector.Identity{}, fmt.Errorf("required HTTP header %s is not set", m.userHeader) |
|
|
|
|
} |
|
|
|
|
// TODO: add support for X-Remote-Group, see
|
|
|
|
|
// https://kubernetes.io/docs/admin/authentication/#authenticating-proxy
|
|
|
|
|
|