3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-06-30 08:28:20 +02:00
Code Issues Projects Releases Packages Wiki Activity

Merge branch 'main' into cdoxsey/per-route-idp-credentials

Browse source
This commit is contained in:
Denis Mishin 2023-02-23 10:06:55 -05:00 • committed by GitHub
commit 96bdff5fbb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 32 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

7
authenticate/handlers.go
View file

@ -96,11 +96,16 @@ func (a *Authenticate) mountDashboard(r *mux.Router) {
AllowedHeaders: []string{"*"},
})
sr.Use(c.Handler)
// routes that don't need a session:
sr.Path("/sign_out").Handler(httputil.HandlerFunc(a.SignOut))
// routes that need a session:
sr = sr.NewRoute().Subrouter()
sr.Use(a.RetrieveSession)
sr.Use(a.VerifySession)
sr.Path("/").Handler(a.requireValidSignatureOnRedirect(a.userInfo))
sr.Path("/sign_in").Handler(httputil.HandlerFunc(a.SignIn))
sr.Path("/sign_out").Handler(httputil.HandlerFunc(a.SignOut))
sr.Path("/device-enrolled").Handler(httputil.HandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
userInfoData, err := a.getUserInfoData(r)
if err != nil {

35
config/envoyconfig/routes.go
View file

@ -74,21 +74,38 @@ func (b *Builder) buildPomeriumHTTPRoutes(options *config.Options, host string)
routes = append(routes, b.buildControlPlanePathRoute("/robots.txt", false))
}
}
// if we're handling authentication, add the oauth2 callback url
// as the callback url is from the IdP, it is expected only on the public authenticate URL endpoint
authenticateURL, err := options.GetAuthenticateURL()
authRoutes, err := b.buildPomeriumAuthenticateHTTPRoutes(options, host)
if err != nil {
return nil, err
}
if config.IsAuthenticate(options.Services) && urlMatchesHost(authenticateURL, host) {
routes = append(routes,
b.buildControlPlanePathRoute(options.AuthenticateCallbackPath, false),
b.buildControlPlanePathRoute("/", false),
)
}
routes = append(routes, authRoutes...)
return routes, nil
}
func (b *Builder) buildPomeriumAuthenticateHTTPRoutes(options *config.Options, host string) ([]*envoy_config_route_v3.Route, error) {
if !config.IsAuthenticate(options.Services) {
return nil, nil
}
for _, fn := range []func() (*url.URL, error){
options.GetAuthenticateURL,
options.GetInternalAuthenticateURL,
} {
u, err := fn()
if err != nil {
return nil, err
}
if urlMatchesHost(u, host) {
return []*envoy_config_route_v3.Route{
b.buildControlPlanePathRoute(options.AuthenticateCallbackPath, false),
b.buildControlPlanePathRoute("/", false),
}, nil
}
}
return nil, nil
}
func (b *Builder) buildControlPlanePathRoute(path string, protected bool) *envoy_config_route_v3.Route {
r := &envoy_config_route_v3.Route{
Name: "pomerium-path-" + path,