Skip to content

Commit 98e291f

Browse files
jjlakisjjlakis
authored
Merge branch 'master' into azure-oidc-proposal
2 parents 2a17b2d + 84e1cc2 commit 98e291f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+10009
-17322
lines changed

‎.devcontainer/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM mcr.microsoft.com/vscode/devcontainers/go:0-1.19
1+
FROM mcr.microsoft.com/vscode/devcontainers/go:1-1.21
22

33
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
44

‎.github/workflows/ci.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,11 +58,11 @@ jobs:
5858
uses: actions/checkout@v4
5959

6060
- name: Set up QEMU
61-
uses: docker/setup-qemu-action@v2
61+
uses: docker/setup-qemu-action@v3
6262

6363
- name: Set up Docker Buildx
6464
id: buildx
65-
uses: docker/setup-buildx-action@v2
65+
uses: docker/setup-buildx-action@v3
6666

6767
- name: Docker Build
6868
run: |

‎.github/workflows/codeql.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,14 @@ jobs:
3333

3434
# Initializes the CodeQL tools for scanning.
3535
- name: Initialize CodeQL
36-
uses: github/codeql-action/init@v2
36+
uses: github/codeql-action/init@v3
3737
with:
3838
languages: go
3939

4040
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
4141
# If this step fails, then you should remove it and run the build manually (see below)
4242
- name: Autobuild
43-
uses: github/codeql-action/autobuild@v2
43+
uses: github/codeql-action/autobuild@v3
4444

4545
# ℹ️ Command-line programs to run using the OS shell.
4646
# 📚 https://git.io/JvXDl
@@ -54,4 +54,4 @@ jobs:
5454
# make release
5555

5656
- name: Perform CodeQL Analysis
57-
uses: github/codeql-action/analyze@v2
57+
uses: github/codeql-action/analyze@v3

‎.github/workflows/docs.yaml‎

Lines changed: 30 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -7,66 +7,62 @@ on:
77
push:
88
branches: [master]
99
paths: ['docs/**']
10+
workflow_dispatch:
1011

1112
jobs:
1213
pull-request-check:
1314
if: github.event_name == 'pull_request'
1415
runs-on: ubuntu-latest
1516
steps:
1617
- uses: actions/checkout@v4
18+
19+
- name: Setup Pages
20+
id: pages
21+
uses: actions/configure-pages@v4
1722

1823
- uses: actions/setup-node@v4
1924
with:
20-
node-version: 18
25+
node-version: 20
26+
cache: npm
27+
cache-dependency-path: "./docs/package-lock.json"
2128

2229
- name: Test Build
2330
working-directory: ./docs
2431
run: |
2532
npm ci
2633
npm run build
2734
28-
gh-pages-release:
29-
if: github.event_name == 'push'
35+
build-docs:
36+
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
3037
runs-on: ubuntu-latest
31-
permissions:
32-
contents: write
3338
steps:
3439
- uses: actions/checkout@v4
35-
with:
36-
path: master
37-
38-
- uses: actions/checkout@v4
39-
with:
40-
ref: gh-pages
41-
path: gh-pages
4240

4341
- uses: actions/setup-node@v4
4442
with:
45-
node-version: 18
43+
node-version: 20
4644

4745
- name: Build docusaurus
48-
working-directory: master/docs
49-
id: build
46+
working-directory: ./docs
5047
run: |
51-
echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
5248
npm ci
5349
npm run build
50+
51+
- name: Upload artifact
52+
uses: actions/upload-pages-artifact@v3
53+
with:
54+
path: ./docs/build
5455

55-
- name: Release to github pages
56-
env:
57-
GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58-
working-directory: gh-pages
59-
run: |
60-
git config --local user.name "github-actions[bot]"
61-
git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
62-
63-
# Remove all files except .git
64-
git rm -r *
65-
66-
# Copy the build files from master/docs/build to gh-pages
67-
cp -r ../master/docs/build/* .
68-
69-
# Commit and push
70-
git add .
71-
git commit -m "Update documentation based on ${{ steps.build.outputs.sha }}"
72-
git push origin gh-pages
56+
deploy-docs:
57+
needs: build-docs
58+
runs-on: ubuntu-latest
59+
permissions:
60+
pages: write # to deploy to Pages
61+
id-token: write # to verify the deployment originates from an appropriate source
62+
environment:
63+
name: github-pages
64+
url: ${{ steps.deployment.outputs.page_url }}
65+
steps:
66+
- name: Deploy to GitHub Pages
67+
id: deployment
68+
uses: actions/deploy-pages@v4

‎.github/workflows/nightly.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,11 @@ jobs:
1919
fetch-tags: true
2020

2121
- name: Set up QEMU
22-
uses: docker/setup-qemu-action@v2
22+
uses: docker/setup-qemu-action@v3
2323

2424
- name: Set up Docker Buildx
2525
id: buildx
26-
uses: docker/setup-buildx-action@v2
26+
uses: docker/setup-buildx-action@v3
2727

2828
- name: Login to quay.io
2929
uses: docker/login-action@v3

‎.github/workflows/publish-release.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ jobs:
6161

6262
# Upload artifacts in case of workflow failure
6363
- name: Upload Artifacts
64-
uses: actions/upload-artifact@v3
64+
uses: actions/upload-artifact@v4
6565
with:
6666
name: oauth2-proxy-artifacts
6767
path: |
@@ -104,11 +104,11 @@ jobs:
104104
fetch-tags: true
105105

106106
- name: Set up QEMU
107-
uses: docker/setup-qemu-action@v2
107+
uses: docker/setup-qemu-action@v3
108108

109109
- name: Set up Docker Buildx
110110
id: buildx
111-
uses: docker/setup-buildx-action@v2
111+
uses: docker/setup-buildx-action@v3
112112

113113
- name: Login to quay.io
114114
uses: docker/login-action@v3

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
- [#2282](https://github.com/oauth2-proxy/oauth2-proxy/pull/2282) Fixed checking Google Groups membership using Google Application Credentials (@kvanzuijlen)
2121
- [#2183](https://github.com/oauth2-proxy/oauth2-proxy/pull/2183) Allowing relative redirect url though an option (@axel7083)
2222
- [#1866](https://github.com/oauth2-proxy/oauth2-proxy/pull/1866) Add support for unix socker as upstream (@babs)
23+
- [#1876](https://github.com/oauth2-proxy/oauth2-proxy/pull/1876) Add `--backend-logout-url` with `{id_token}` placeholder (@babs)
2324
- [#1949](https://github.com/oauth2-proxy/oauth2-proxy/pull/1949) Allow cookie names with dots in redis sessions (@miguelborges99)
2425
- [#2297](https://github.com/oauth2-proxy/oauth2-proxy/pull/2297) Add nightly build and push (@tuunit)
2526
- [#2329](https://github.com/oauth2-proxy/oauth2-proxy/pull/2329) Add an option to skip request to profile URL for resolving missing claims in id_token (@nilsgstrabo)

‎docs/docs/configuration/alpha_config.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -440,6 +440,7 @@ Provider holds all configuration for a single provider
440440
| `scope` | _string_ | Scope is the OAuth scope specification |
441441
| `allowedGroups` | _[]string_ | AllowedGroups is a list of restrict logins to members of this group |
442442
| `code_challenge_method` | _string_ | The code challenge method |
443+
| `backendLogoutURL` | _string_ | URL to call to perform backend logout, `{id_token}` would be replaced by the actual `id_token` if available in the session |
443444
444445
### ProviderType
445446
#### (`string` alias)

‎docs/docs/configuration/overview.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
7474
| `--auth-logging-format` | string | Template for authentication log lines | see [Logging Configuration](#logging-configuration) |
7575
| `--authenticated-emails-file` | string | authenticate against emails via file (one per line) | |
7676
| `--azure-tenant` | string | go to a tenant-specific or common (tenant-independent) endpoint. | `"common"` |
77+
| `--backend-logout-url` | string | URL to perform backend logout, if you use `{id_token}` in the url it will be replaced by the actual `id_token` of the user session | |
7778
| `--basic-auth-password` | string | the password to set when passing the HTTP Basic Auth header | |
7879
| `--client-id` | string | the OAuth Client ID, e.g. `"123456.apps.googleusercontent.com"` | |
7980
| `--client-secret` | string | the OAuth Client Secret | |
@@ -85,7 +86,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
8586
| `--cookie-httponly` | bool | set HttpOnly cookie flag | true |
8687
| `--cookie-name` | string | the name of the cookie that the oauth_proxy creates. Should be changed to use a [cookie prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes) (`__Host-` or `__Secure-`) if `--cookie-secure` is set. | `"_oauth2_proxy"` |
8788
| `--cookie-path` | string | an optional cookie path to force cookies to (e.g. `/poc/`) | `"/"` |
88-
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers \[[1](#footnote1)\] | |
89+
| `--cookie-refresh` | duration | refresh the cookie after this duration; `0` to disable; not supported by all providers [^1] | |
8990
| `--cookie-secret` | string | the seed string for secure cookies (optionally base64 encoded) | |
9091
| `--cookie-secure` | bool | set [secure (HTTPS only) cookie flag](https://owasp.org/www-community/controls/SecureFlag) | true |
9192
| `--cookie-samesite` | string | set SameSite cookie attribute (`"lax"`, `"strict"`, `"none"`, or `""`). | `""` |
@@ -175,7 +176,7 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
175176
| `--request-logging` | bool | Log requests | true |
176177
| `--request-logging-format` | string | Template for request log lines | see [Logging Configuration](#logging-configuration) |
177178
| `--resource` | string | The resource that is protected (Azure AD only) | |
178-
| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection | false |
179+
| `--reverse-proxy` | bool | are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-\{Proto,Host,Uri\} headers to be used on redirect selection | false |
179180
| `--scope` | string | OAuth scope specification | |
180181
| `--session-cookie-minimal` | bool | strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only) | false |
181182
| `--session-store-type` | string | [Session data storage backend](sessions.md); redis or cookie | cookie |
@@ -206,12 +207,12 @@ An example [oauth2-proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/
206207
| `--allowed-role` | string \| list | restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider. | |
207208
| `--validate-url` | string | Access token validation endpoint | |
208209
| `--version` | n/a | print version string | |
209-
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`) \[[2](#footnote2)\] | |
210+
| `--whitelist-domain` | string \| list | allowed domains for redirection after authentication. Prefix domain with a `.` or a `*.` to allow subdomains (e.g. `.example.com`, `*.example.com`) [^2] | |
210211
| `--trusted-ip` | string \| list | list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with `--reverse-proxy` and optionally `--real-client-ip-header` this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them. | |
211212
| `--encode-state` | bool | encode the state parameter as UrlEncodedBase64 | false |
212213

213-
> ###### 1. Only these providers support `--cookie-refresh`: GitLab, Google and OIDC {#footnote1}
214-
> ###### 2. When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URLs protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`. {#footnote2}
214+
[^1]: Only these providers support `--cookie-refresh`: GitLab, Google and OIDC
215+
[^2]: When using the `whitelist-domain` option, any domain prefixed with a `.` or a `*.` will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URLs protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: `example.com:8080`. To allow any port, use `*`: `example.com:*`.
215216

216217
See below for provider specific options
217218

‎docs/docs/configuration/providers/facebook.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@ id: facebook
33
title: Facebook
44
---
55

6-
1. Create a new FB App from <https://developers.facebook.com/>
6+
1. Create a new FB App from https://developers.facebook.com/
77
2. Under FB Login, set your Valid OAuth redirect URIs to `https://internal.yourcompany.com/oauth2/callback`

0 commit comments

Comments
 (0)