trustchain-oc1-orchestral/authentik
Archived
10
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

outposts/proxy: add X-Auth-Groups header to pass groups

Browse source 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
This commit is contained in:
Jens Langhammer 2021-07-22 10:47:58 +02:00
parent c05240afbf
commit 66bfa6879d
3 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
authentik/providers/proxy/controllers/k8s/traefik.py
View file

@ -113,6 +113,7 @@ class TraefikMiddlewareReconciler(KubernetesObjectReconciler[TraefikMiddleware])
authResponseHeaders=[ authResponseHeaders=[
"Set-Cookie", "Set-Cookie",
"X-Auth-Username", "X-Auth-Username",
"X-Auth-Groups",
"X-Forwarded-Email", "X-Forwarded-Email",
"X-Forwarded-Preferred-Username", "X-Forwarded-Preferred-Username",
"X-Forwarded-User", "X-Forwarded-User",

1
internal/outpost/proxy/claims.go
View file

@ -10,6 +10,7 @@ type Claims struct {
Proxy struct { Proxy struct {
UserAttributes map[string]interface{} `json:"user_attributes"` UserAttributes map[string]interface{} `json:"user_attributes"`
} `json:"ak_proxy"` } `json:"ak_proxy"`
Groups []string `json:"groups"`
} }
func (c *Claims) FromIDToken(idToken string) error { func (c *Claims) FromIDToken(idToken string) error {

5
internal/outpost/proxy/proxy.go
View file

@ -428,6 +428,10 @@ func (p *OAuthProxy) addHeadersForProxying(rw http.ResponseWriter, req *http.Req
if err != nil { if err != nil {
log.WithError(err).Warning("Failed to parse IDToken") log.WithError(err).Warning("Failed to parse IDToken")
} }
// Set groups in header
groups := strings.Join(claims.Groups, "|")
req.Header["X-Auth-Groups"] = []string{groups}
userAttributes := claims.Proxy.UserAttributes userAttributes := claims.Proxy.UserAttributes
// Attempt to set basic auth based on user's attributes // Attempt to set basic auth based on user's attributes
if p.SetBasicAuth { if p.SetBasicAuth {
@ -461,6 +465,7 @@ func (p *OAuthProxy) addHeadersForProxying(rw http.ResponseWriter, req *http.Req
func (p *OAuthProxy) stripAuthHeaders(req *http.Request) { func (p *OAuthProxy) stripAuthHeaders(req *http.Request) {
if p.PassUserHeaders { if p.PassUserHeaders {
req.Header.Del("X-Forwarded-User") req.Header.Del("X-Forwarded-User")
req.Header.Del("X-Auth-Groups")
req.Header.Del("X-Forwarded-Email") req.Header.Del("X-Forwarded-Email")
req.Header.Del("X-Forwarded-Preferred-Username") req.Header.Del("X-Forwarded-Preferred-Username")
} }