3 Commits

Author SHA1 Message Date
2c148d3a23 Add releases info to README 2019-06-10 12:19:53 +01:00
d33ecc0654 Make rule parsing more robust
- check args length before popping
- ensure rule has name
2019-06-10 11:38:50 +01:00
41a3f2a5a9 Fix missing client id/secret log message 2019-06-10 11:24:14 +01:00
3 changed files with 47 additions and 12 deletions

View File

@ -4,7 +4,6 @@
A minimal forward authentication service that provides Google oauth based login and authentication for the [traefik](https://github.com/containous/traefik) reverse proxy/load balancer. A minimal forward authentication service that provides Google oauth based login and authentication for the [traefik](https://github.com/containous/traefik) reverse proxy/load balancer.
## Why? ## Why?
- Seamlessly overlays any http service with a single endpoint (see: `url-path` in [Configuration](#configuration)) - Seamlessly overlays any http service with a single endpoint (see: `url-path` in [Configuration](#configuration))
@ -16,6 +15,7 @@ A minimal forward authentication service that provides Google oauth based login
# Contents # Contents
- [Releases](#releases)
- [Usage](#usage) - [Usage](#usage)
- [Simple](#simple) - [Simple](#simple)
- [Advanced](#advanced) - [Advanced](#advanced)
@ -32,6 +32,16 @@ A minimal forward authentication service that provides Google oauth based login
- [Copyright](#copyright) - [Copyright](#copyright)
- [License](#license) - [License](#license)
## Releases
We recommend using the `2` tag on docker hub.
You can also use the latest incremental releases found on [docker hub](https://hub.docker.com/r/thomseddon/traefik-forward-auth/tags) and [github](https://github.com/thomseddon/traefik-forward-auth/releases).
#### Upgrade Guide
v2 was released in June 2019, whilst this is fully backwards compatible, a number of configuration options were modified, please see the [upgrade guide](https://github.com/thomseddon/traefik-forward-auth/wiki/v2-Upgrade-Guide) to prevent warnings on startup and ensure you are using the current configuration.
## Usage ## Usage
#### Simple: #### Simple:
@ -96,10 +106,6 @@ Create a new project then search for and select "Credentials" in the search bar.
Click "Create Credentials" > "OAuth client ID". Select "Web Application", fill in the name of your app, skip "Authorized JavaScript origins" and fill "Authorized redirect URIs" with all the domains you will allow authentication from, appended with the `url-path` (e.g. https://app.test.com/_oauth) Click "Create Credentials" > "OAuth client ID". Select "Web Application", fill in the name of your app, skip "Authorized JavaScript origins" and fill "Authorized redirect URIs" with all the domains you will allow authentication from, appended with the `url-path` (e.g. https://app.test.com/_oauth)
#### Upgrade Guide
v2 was released in April 2019, whilst this is fully backwards compatible, a number of configuration options were modified, please see the [upgrade guide](https://github.com/thomseddon/traefik-forward-auth/wiki/v2-Upgrade-Guide) to prevent warnings on startup and ensure you are using the current configuration.
## Configuration ## Configuration
### Overview ### Overview

View File

@ -176,16 +176,15 @@ func (c *Config) parseUnknownFlag(option string, arg flags.SplitArgument, args [
// Parse rules in the format "rule.<name>.<param>" // Parse rules in the format "rule.<name>.<param>"
parts := strings.Split(option, ".") parts := strings.Split(option, ".")
if len(parts) == 3 && parts[0] == "rule" { if len(parts) == 3 && parts[0] == "rule" {
// Get or create rule // Ensure there is a name
rule, ok := c.Rules[parts[1]] name := parts[1]
if !ok { if len(name) == 0 {
rule = NewRule() return args, errors.New("route name is required")
c.Rules[parts[1]] = rule
} }
// Get value, or pop the next arg // Get value, or pop the next arg
val, ok := arg.Value() val, ok := arg.Value()
if !ok { if !ok && len(args) > 1 {
val = args[0] val = args[0]
args = args[1:] args = args[1:]
} }
@ -204,6 +203,13 @@ func (c *Config) parseUnknownFlag(option string, arg flags.SplitArgument, args [
} }
} }
// Get or create rule
rule, ok := c.Rules[name]
if !ok {
rule = NewRule()
c.Rules[name] = rule
}
// Add param value to rule // Add param value to rule
switch parts[2] { switch parts[2] {
case "action": case "action":
@ -250,7 +256,7 @@ func (c *Config) Validate() {
} }
if c.Providers.Google.ClientId == "" || c.Providers.Google.ClientSecret == "" { if c.Providers.Google.ClientId == "" || c.Providers.Google.ClientSecret == "" {
log.Fatal("google.providers.client-id, google.providers.client-secret must be set") log.Fatal("providers.google.client-id, providers.google.client-secret must be set")
} }
// Check rules // Check rules

View File

@ -98,6 +98,29 @@ func TestConfigParseUnknownFlags(t *testing.T) {
} }
} }
func TestConfigParseRuleError(t *testing.T) {
assert := assert.New(t)
// Rule without name
_, err := NewConfig([]string{
"--rule..action=auth",
})
if assert.Error(err) {
assert.Equal("route name is required", err.Error())
}
// Rule without value
c, err := NewConfig([]string{
"--rule.one.action=",
})
if assert.Error(err) {
assert.Equal("route param value is required", err.Error())
}
// Check rules
assert.Equal(map[string]*Rule{}, c.Rules)
}
func TestConfigFlagBackwardsCompatability(t *testing.T) { func TestConfigFlagBackwardsCompatability(t *testing.T) {
assert := assert.New(t) assert := assert.New(t)
c, err := NewConfig([]string{ c, err := NewConfig([]string{