3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-05-06 05:46:05 +02:00
Code Issues Projects Releases Packages Wiki Activity

authorize: pass idp id for webauthn url, allow unauthenticated access to static files (#3282)

Browse source
This commit is contained in:
Caleb Doxsey 2022-04-20 17:07:09 +00:00 • committed by GitHub
parent c19048649a
commit 74310b3de3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
authorize/check_response.go
View file

@ -54,7 +54,7 @@ func (a *Authorize) handleResultDenied(
case reasons.Has(criteria.ReasonDeviceUnauthenticated): case reasons.Has(criteria.ReasonDeviceUnauthenticated):
// when the user's device is unauthenticated it means they haven't // when the user's device is unauthenticated it means they haven't
// registered a webauthn device yet, so redirect to the webauthn flow // registered a webauthn device yet, so redirect to the webauthn flow
return a.requireWebAuthnResponse(ctx, in, result, isForwardAuthVerify) return a.requireWebAuthnResponse(ctx, in, request, result, isForwardAuthVerify)
case reasons.Has(criteria.ReasonDeviceUnauthorized): case reasons.Has(criteria.ReasonDeviceUnauthorized):
denyStatusCode = httputil.StatusDeviceUnauthorized denyStatusCode = httputil.StatusDeviceUnauthorized
denyStatusText = httputil.DetailsText(httputil.StatusDeviceUnauthorized) denyStatusText = httputil.DetailsText(httputil.StatusDeviceUnauthorized)
@ -178,6 +178,7 @@ func (a *Authorize) requireLoginResponse(
func (a *Authorize) requireWebAuthnResponse( func (a *Authorize) requireWebAuthnResponse(
ctx context.Context, ctx context.Context,
in *envoy_service_auth_v3.CheckRequest, in *envoy_service_auth_v3.CheckRequest,
request *evaluator.Request,
result *evaluator.Result, result *evaluator.Result,
isForwardAuthVerify bool, isForwardAuthVerify bool,
) (*envoy_service_auth_v3.CheckResponse, error) { ) (*envoy_service_auth_v3.CheckResponse, error) {
@ -209,6 +210,7 @@ func (a *Authorize) requireWebAuthnResponse(
q.Set(urlutil.QueryDeviceType, webauthnutil.DefaultDeviceType) q.Set(urlutil.QueryDeviceType, webauthnutil.DefaultDeviceType)
} }
q.Set(urlutil.QueryRedirectURI, checkRequestURL.String()) q.Set(urlutil.QueryRedirectURI, checkRequestURL.String())
q.Set(urlutil.QueryIdentityProviderID, opts.GetIdentityProviderForPolicy(request.Policy).GetId())
signinURL.RawQuery = q.Encode() signinURL.RawQuery = q.Encode()
redirectTo := urlutil.NewSignedURL(state.sharedKey, signinURL).String() redirectTo := urlutil.NewSignedURL(state.sharedKey, signinURL).String()

3
internal/httputil/router.go
View file

@ -39,5 +39,6 @@ func DashboardSubrouter(parent *mux.Router) *mux.Router {
return ui.ServeFile(w, r, fileName) return ui.ServeFile(w, r, fileName)
})) }))
} }
return r // return a new subrouter so any middleware doesn't get added to the static files
return r.NewRoute().Subrouter()
} }