Skip to content

Commit 16955e2

Browse files
adriananeciadriananeci
committed
Add azure groups support and oauth2 v2.0
1 parent 7a784a4 commit 16955e2

File tree

10 files changed

+337
-149
lines changed

10 files changed

+337
-149
lines changed

‎docs/docs/configuration/alpha_config.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ They may change between releases without notice.
164164
| Field | Type | Description |
165165
| ----- | ---- | ----------- |
166166
| `tenant` | _string_ | Tenant directs to a tenant-specific or common (tenant-independent) endpoint<br/>Default value is 'common' |
167+
| `groupField` | _string_ | GroupField configures the group field to be used when building the group list<br/>Default value is 'id' |
167168

168169
### BitbucketOptions
169170

‎docs/docs/configuration/auth.md‎

Lines changed: 30 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -72,22 +72,42 @@ Note: The user is checked against the group members list on initial authenticati
7272

7373
### Azure Auth Provider
7474

75-
1. Add an application: go to [https://portal.azure.com](https://portal.azure.com), choose **"Azure Active Directory"** in the left menu, select **"App registrations"** and then click on **"New app registration"**.
76-
2. Pick a name and choose **"Webapp / API"** as application type. Use `https://internal.yourcompany.com` as Sign-on URL. Click **"Create"**.
77-
3. On the **"Settings"** / **"Properties"** page of the app, pick a logo and select **"Multi-tenanted"** if you want to allow users from multiple organizations to access your app. Note down the application ID. Click **"Save"**.
78-
4. On the **"Settings"** / **"Required Permissions"** page of the app, click on **"Windows Azure Active Directory"** and then on **"Access the directory as the signed in user"**. Hit **"Save"** and then then on **"Grant permissions"** (you might need another admin to do this).
79-
5. On the **"Settings"** / **"Reply URLs"** page of the app, add `https://internal.yourcompanycom/oauth2/callback` for each host that you want to protect by the oauth2 proxy. Click **"Save"**.
80-
6. On the **"Settings"** / **"Keys"** page of the app, add a new key and note down the value after hitting **"Save"**.
81-
7. Configure the proxy with
75+
1. Add an application: go to [https://portal.azure.com](https://portal.azure.com), choose **Azure Active Directory**, select
76+
**App registrations** and then click on **New registration**.
77+
2. Pick a name, check the supported account type(singletenant, multitenant, etc). In the **Redirect URI** section create a new
78+
**Web** platform entry for each app that you want to protect by the oauth2 proxy(e.g.
79+
https://internal.yourcompanycom/oauth2/callback). Click **Register**.
80+
3. Next we need to add group read permissions for the app registration, on the **API Permissions** page of the app, click on
81+
**Add a permission**, select **Microsoft Graph**, then select **Application permissions**, then click on **Group** and select
82+
**Group.Read.All**. Hit **Add permissions** and then on **Grant admin consent** (you might need an admin to do this).
83+
4. On the **Certificates & secrets** page of the app, add a new client secret and note down the value after hitting **Add**.
84+
5. Configure the proxy with:
85+
- for V1 Azure Auth endpoint (Azure Active Directory Endpoints - https://login.microsoftonline.com/common/oauth2/authorize)
8286

8387
```
8488
--provider=azure
8589
--client-id=<application ID from step 3>
86-
--client-secret=<value from step 6>
87-
--oidc-issuer-url=https://sts.windows.net/{tenant-id}/
90+
--client-secret=<value from step 5>
91+
--azure_tenant={tenant-id}
92+
--oidc_issuer_url=https://sts.windows.net/{tenant-id}/
8893
```
8994

90-
Note: When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the [redis session storage](sessions.md#redis-storage) should resolve this.
95+
- for V2 Azure Auth endpoint (Microsoft Identity Platform Endpoints - https://login.microsoftonline.com/common/oauth2/v2.0/authorize)
96+
```
97+
--provider=azure
98+
--client-id=<application ID from step 3>
99+
--client-secret=<value from step 5>
100+
--azure_tenant={tenant-id}
101+
--oidc_issuer_url=https://login.microsoftonline.com/{tenant-id}/v2.0
102+
```
103+
104+
***Notes***:
105+
- When using v2.0 Azure Auth endpoint (`https://login.microsoftonline.com/{tenant-id}/v2.0`) as `--oidc_issuer_url`, in conjunction
106+
with `--resource` flag, be sure to append `/.default` at the end of the resource name. See
107+
https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#the-default-scope for more details.
108+
- When using the Azure Auth provider with nginx and the cookie session store you may find the cookie is too large and doesn't
109+
get passed through correctly. Increasing the proxy_buffer_size in nginx or implementing the [redis session storage](sessions.md#redis-storage)
110+
should resolve this.
91111

92112
### ADFS Auth Provider
93113

‎go.mod‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ require (
3030
github.com/stretchr/testify v1.7.0
3131
github.com/vmihailenco/msgpack/v4 v4.3.11
3232
golang.org/x/crypto v0.0.0-20220214200702-86341886e292
33+
golang.org/x/exp v0.0.0-20220613132600-b0d781184e0d
3334
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2
3435
golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
3536
golang.org/x/sync v0.0.0-20201207232520-09787c993a3a
@@ -68,9 +69,9 @@ require (
6869
github.com/yuin/gopher-lua v0.0.0-20191220021717-ab39c6098bdb // indirect
6970
go.opencensus.io v0.22.2 // indirect
7071
go.opentelemetry.io/otel v0.11.0 // indirect
71-
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 // indirect
72+
golang.org/x/sys v0.0.0-20211019181941-9d821ace8654 // indirect
7273
golang.org/x/text v0.3.7 // indirect
73-
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 // indirect
74+
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
7475
google.golang.org/appengine v1.6.5 // indirect
7576
google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013 // indirect
7677
google.golang.org/grpc v1.27.0 // indirect

‎go.sum‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -132,8 +132,8 @@ github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
132132
github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
133133
github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
134134
github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
135-
github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
136135
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
136+
github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
137137
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
138138
github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
139139
github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
@@ -317,6 +317,8 @@ golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0
317317
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
318318
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
319319
golang.org/x/exp v0.0.0-20200908183739-ae8ad444f925/go.mod h1:1phAWC201xIgDyaFpmDeZkgf70Q4Pd/CNqfRtVPtxNw=
320+
golang.org/x/exp v0.0.0-20220613132600-b0d781184e0d h1:vtUKgx8dahOomfFzLREU8nSv25YHnTgLBn4rDnWZdU0=
321+
golang.org/x/exp v0.0.0-20220613132600-b0d781184e0d/go.mod h1:Kr81I6Kryrl9sr8s2FK3vxD90NdsKWRuOIl2O4CvYbA=
320322
golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
321323
golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
322324
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -327,8 +329,8 @@ golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHl
327329
golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
328330
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
329331
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
330-
golang.org/x/mod v0.3.1-0.20200828183125-ce943fd02449 h1:xUIPaMhvROX9dhPvRCenIJtU78+lbEenGbgqB5hfHCQ=
331332
golang.org/x/mod v0.3.1-0.20200828183125-ce943fd02449/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
333+
golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 h1:kQgndtyPBW/JIYERgdxfwMYh3AVStj88WQTlNDi2a+o=
332334
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
333335
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
334336
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -391,8 +393,9 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
391393
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
392394
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
393395
golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
394-
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
395396
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
397+
golang.org/x/sys v0.0.0-20211019181941-9d821ace8654 h1:id054HUawV2/6IGm2IV8KZQjqtwAOo2CYlOToYqa0d0=
398+
golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
396399
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
397400
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
398401
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -415,12 +418,13 @@ golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3
415418
golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
416419
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
417420
golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
418-
golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8 h1:BMFHd4OFnFtWX46Xj4DN6vvT1btiBxyq+s0orYBqcQY=
419421
golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
422+
golang.org/x/tools v0.1.10 h1:QjFRCZxdOhBJ/UNgnBZLbNV13DlbnK0quyivTnXJM20=
420423
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
421424
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
422-
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
423425
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
426+
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
427+
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
424428
google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
425429
google.golang.org/api v0.20.0 h1:jz2KixHX7EcCPiQrySzPdnYT7DbINAypCqKZ1Z7GM40=
426430
google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=

‎pkg/apis/options/legacy_options.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -481,6 +481,7 @@ type LegacyProvider struct {
481481

482482
KeycloakGroups []string `flag:"keycloak-group" cfg:"keycloak_groups"`
483483
AzureTenant string `flag:"azure-tenant" cfg:"azure_tenant"`
484+
AzureGroupField string `flag:"azure-group-field" cfg:"azure_group_field"`
484485
BitbucketTeam string `flag:"bitbucket-team" cfg:"bitbucket_team"`
485486
BitbucketRepository string `flag:"bitbucket-repository" cfg:"bitbucket_repository"`
486487
GitHubOrg string `flag:"github-org" cfg:"github_org"`
@@ -534,6 +535,7 @@ func legacyProviderFlagSet() *pflag.FlagSet {
534535

535536
flagSet.StringSlice("keycloak-group", []string{}, "restrict logins to members of these groups (may be given multiple times)")
536537
flagSet.String("azure-tenant", "common", "go to a tenant-specific or common (tenant-independent) endpoint.")
538+
flagSet.String("azure-group-field", "", "configures the group field to be used when building the groups list(`id` or `displayName`. Default is `id`) from Microsoft Graph(available only for v2.0 oidc url). Based on this value, the `allowed-group` config values should be adjusted accordingly. If using `id` as group field, `allowed-group` should contains groups IDs, if using `displayName` as group field, `allowed-group` should contains groups name")
537539
flagSet.String("bitbucket-team", "", "restrict logins to members of this team")
538540
flagSet.String("bitbucket-repository", "", "restrict logins to user with access to this repository")
539541
flagSet.String("github-org", "", "restrict logins to members of this organisation")
@@ -663,7 +665,8 @@ func (l *LegacyProvider) convert() (Providers, error) {
663665
// This part is out of the switch section because azure has a default tenant
664666
// that needs to be added from legacy options
665667
provider.AzureConfig = AzureOptions{
666-
Tenant: l.AzureTenant,
668+
Tenant: l.AzureTenant,
669+
GroupField: l.AzureGroupField,
667670
}
668671

669672
switch provider.Type {

‎pkg/apis/options/providers.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,9 @@ type AzureOptions struct {
142142
// Tenant directs to a tenant-specific or common (tenant-independent) endpoint
143143
// Default value is 'common'
144144
Tenant string `json:"tenant,omitempty"`
145+
// GroupField configures the group field to be used when building the group list
146+
// Default value is 'id'
147+
GroupField string `json:"groupField,omitempty"`
145148
}
146149

147150
type ADFSOptions struct {

‎pkg/util/util.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,3 +149,16 @@ func isHostnameAllowed(hostname, allowedHost string) bool {
149149

150150
return false
151151
}
152+
153+
// RemoveDuplicateStr removes duplicates from a slice of strings.
154+
func RemoveDuplicateStr(strSlice []string) []string {
155+
allKeys := make(map[string]bool)
156+
var list []string
157+
for _, item := range strSlice {
158+
if _, value := allKeys[item]; !value {
159+
allKeys[item] = true
160+
list = append(list, item)
161+
}
162+
}
163+
return list
164+
}

0 commit comments

Comments
 (0)