3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-04 01:09:36 +02:00
Code Issues Projects Releases Packages Wiki Activity

identity: only assign access_type uri params to google. (#2782)

Browse source 
* identity: only assign `access_type` uri params to google.

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>

* bump upgrading

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
This commit is contained in:
bobby 2021-11-28 19:01:34 -08:00 • committed by GitHub
parent cce70afe98
commit 1a7c5415e7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
internal/identity/oidc/google/google.go
View file

@ -23,8 +23,15 @@ const (
var defaultScopes = []string{oidc.ScopeOpenID, "profile", "email"}
// https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters
var defaultAuthCodeOptions = map[string]string{"prompt": "select_account consent"}
// unlike other identity providers, google does not support the `offline_access` scope and instead
// requires we set this on a custom uri param. Also, ` prompt` must be set to `consent`to ensure
// that our application always receives a refresh token (ask google). And finally, we default to
// having the user select which Google account they'd like to use.
//
// For more details, please see google's documentation:
// https://developers.google.com/identity/protocols/oauth2/web-server#offline
// https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters
var defaultAuthCodeOptions = map[string]string{"prompt": "select_account consent", "access_type": "offline"}
// Provider is a Google implementation of the Authenticator interface.
type Provider struct {

2
internal/identity/oidc/oidc.go
View file

@ -27,7 +27,7 @@ const Name = "oidc"
var defaultScopes = []string{go_oidc.ScopeOpenID, "profile", "email", "offline_access"}
var defaultAuthCodeOptions = []oauth2.AuthCodeOption{oauth2.AccessTypeOffline}
var defaultAuthCodeOptions = []oauth2.AuthCodeOption{}
// Provider provides a standard, OpenID Connect implementation
// of an authorization identity provider.