373bfbfe3f
To enable this feature you need `CONSOLE_IDP_CALLBACK_DYNAMIC=on` ``` export CONSOLE_IDP_URL=https://gitlab.com/.well-known/openid-configuration export CONSOLE_IDP_CLIENT_ID="b0088c3836bb029393942f71ed7c8ac0add7f0856e6c86e67b0ff98f85c48658" export CONSOLE_IDP_SECRET="ed72087b37624e89816ac27c1355420902045274edd7baad2ae29b1b0e8436fe" export CONSOLE_IDP_SCOPES="openid,profile,email" export CONSOLE_IDP_USERINFO="on" export CONSOLE_IDP_CALLBACK_DYNAMIC=on console srv ``` if this becomes a common practice, we should enable this as default in future.
71 lines
2.7 KiB
Go
71 lines
2.7 KiB
Go
// This file is part of MinIO Console Server
|
|
// Copyright (c) 2021 MinIO, Inc.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
package oauth2
|
|
|
|
import (
|
|
"net/http"
|
|
"regexp"
|
|
"strings"
|
|
)
|
|
|
|
var (
|
|
// De-facto standard header keys.
|
|
xForwardedProto = http.CanonicalHeaderKey("X-Forwarded-Proto")
|
|
xForwardedScheme = http.CanonicalHeaderKey("X-Forwarded-Scheme")
|
|
)
|
|
|
|
var (
|
|
// RFC7239 defines a new "Forwarded: " header designed to replace the
|
|
// existing use of X-Forwarded-* headers.
|
|
// e.g. Forwarded: for=192.0.2.60;proto=https;by=203.0.113.43
|
|
forwarded = http.CanonicalHeaderKey("Forwarded")
|
|
// Allows for a sub-match of the first value after 'for=' to the next
|
|
// comma, semi-colon or space. The match is case-insensitive.
|
|
forRegex = regexp.MustCompile(`(?i)(?:for=)([^(;|,| )]+)(.*)`)
|
|
// Allows for a sub-match for the first instance of scheme (http|https)
|
|
// prefixed by 'proto='. The match is case-insensitive.
|
|
protoRegex = regexp.MustCompile(`(?i)^(;|,| )+(?:proto=)(https|http)`)
|
|
)
|
|
|
|
// getSourceScheme retrieves the scheme from the X-Forwarded-Proto and RFC7239
|
|
// Forwarded headers (in that order).
|
|
func getSourceScheme(r *http.Request) string {
|
|
var scheme string
|
|
|
|
// Retrieve the scheme from X-Forwarded-Proto.
|
|
if proto := r.Header.Get(xForwardedProto); proto != "" {
|
|
scheme = strings.ToLower(proto)
|
|
} else if proto = r.Header.Get(xForwardedScheme); proto != "" {
|
|
scheme = strings.ToLower(proto)
|
|
} else if proto := r.Header.Get(forwarded); proto != "" {
|
|
// match should contain at least two elements if the protocol was
|
|
// specified in the Forwarded header. The first element will always be
|
|
// the 'for=', which we ignore, subsequently we proceed to look for
|
|
// 'proto=' which should precede right after `for=` if not
|
|
// we simply ignore the values and return empty. This is in line
|
|
// with the approach we took for returning first ip from multiple
|
|
// params.
|
|
if match := forRegex.FindStringSubmatch(proto); len(match) > 1 {
|
|
if match = protoRegex.FindStringSubmatch(match[2]); len(match) > 1 {
|
|
scheme = strings.ToLower(match[2])
|
|
}
|
|
}
|
|
}
|
|
|
|
return scheme
|
|
}
|