Feature: Add GitHub groups (orgs/teams) support by tuunit · Pull Request #2196 · oauth2-proxy/oauth2-proxy

tuunit · 2023-08-27T10:04:11Z

Motivation and Context

GitHub's hierarchy is structured by organization and teams. As of now, in version 7.4.0 this hierarchy can only be used for restricting access but the details about a users membership are not passed through to the underlying applications behind the oauth2-proxy. Therefore this PRs aim is to extend the GitHub provider with the functionality to expose the users membership. As the session storage already provides the functionality to store "groups" and forward them as headers, this is a valid feature / extension and in line with other providers.

Description of the implementation details

I refactored the GitHub provider quite extensively. To ensure backwards compatibility all the restrictions and checks are done as before. The only logical change is that instead of just fetching the org and team information when an organisation or team restriction is set, the membership information is always fetched from GitHub and added to the sessions group storage.

How Has This Been Tested?

All existing GitHub tests have been corrected to accommodate the new code structure. Manual testing has been done and I already use this version of the implementation in a production environment.

Checklist:

My change requires a change to the documentation or CHANGELOG.
I have updated the documentation/CHANGELOG accordingly.
I have created a feature (non-master) branch for my PR.

tuunit · 2023-08-27T10:07:03Z

@JoelSpeed new PR for #1928

@hoax I would highly appreciate a code review from your side and especially check that I didn't miss anything when rebasing our commits.

hoax · 2023-09-23T15:53:48Z

@tuunit, looks good, but did not test it yet

tuunit

Reminder to myself: Rebase and fix merge conflicts

tuunit · 2023-10-25T08:20:42Z

@kvanzuijlen can you give this a review? :)

kvanzuijlen

LGTM

…er instances with different domain

* add nightly build and push * add date based nightly build tags * only keep single multiarch image build and push * add changelog * add images to internal docs static files * add docu for nightly builds * remove unnecessary spaces * update nightly repository

…oxy#1949) * Issue 978: Fix Custom cookie name breaks redis for session (see oauth2-proxy#978) * Issue 978: Fix Custom cookie name breaks redis for session (see oauth2-proxy#978) * Update CHANGELOG.md * Issue 978: Fix Custom cookie name breaks redis for session * Issue 978: Fix Custom cookie name breaks redis for session * Issue 978: Fix Custom cookie name breaks redis for session * Issue 978: Fix Custom cookie name breaks redis for session * Issue 978: Fix Custom cookie name breaks redis for session * Issue 978: Fix Custom cookie name breaks redis for session * Update CHANGELOG.md --------- Co-authored-by: Nuno Borges <Nuno.Borges@ctw.bmwgroup.com> Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

* Support http.AllowQuerySemicolons * Docs * Make it clear we are overriding the handler * Update documentation for allow-query-semicolons * Fix changelog format * Fix formatting --------- Co-authored-by: MickMake <github@mickmake.com>

…er instances with different domain

JoelSpeed

Is this implemented in a backwards compatible way?

jacek-jablonski · 2024-02-21T15:46:30Z

Is this implemented in a backwards compatible way?

Nope, it blew away our production.

tuunit · 2024-02-21T15:53:14Z

Is this implemented in a backwards compatible way?

Nope, it blew away our production.

I've tested it with 3 different scenarios and another user tested the feature branch as well so I'm a bit lost what happened on your end.

Can you please share your config and which errors you encountered?

jacek-jablonski · 2024-02-21T16:04:03Z

Hi,
config by args:

--provider=github --scope="read:user" --email-domain=* --github-team="xxx/devs" --upstream=http://argo-server:2746 --http-address=0.0.0.0:4180 --reverse-proxy

OAUTH2_PROXY_CLIENT_ID and OAUTH2_PROXY_CLIENT_SECRET set by env vars.

Error was:

[2024/02/21 14:18:43] [oauthproxy.go:888] Error creating session during OAuth2 callback: unexpected status "403": {"message":"You need at least read:org scope or user scope to list your organizations.","documentation_url":"https://docs.github.com/rest/orgs/orgs#list-organizations-for-the-authenticated-user"}

etho201 · 2024-02-21T16:54:41Z

Hi, config by args:

--provider=github --scope="read:user" --email-domain=* --github-team="xxx/devs" --upstream=http://argo-server:2746 --http-address=0.0.0.0:4180 --reverse-proxy

OAUTH2_PROXY_CLIENT_ID and OAUTH2_PROXY_CLIENT_SECRET set by env vars.

Error was:

[2024/02/21 14:18:43] [oauthproxy.go:888] Error creating session during OAuth2 callback: unexpected status "403": {"message":"You need at least read:org scope or user scope to list your organizations.","documentation_url":"https://docs.github.com/rest/orgs/orgs#list-organizations-for-the-authenticated-user"}

I had the same problem. It's a breaking change if/when a user specified the scope. For example, I was using this flag --scope=user:email and this broke things after updating to 7.6.0. To fix this, I had to either remove my manual setting of the flag or add the new setting user:email read:org. If you don't specify, the default value is now user:email read:org. See here for more: https://github.com/oauth2-proxy/oauth2-proxy/pull/2196/files#r1492008964

tuunit · 2024-02-22T22:02:48Z

@etho201 thanks for sharing. Indeed that is the issue we will update it in the CHANGELOG and I'll talk to @JoelSpeed if we can get a bugfix released.

tuunit · 2024-02-22T22:04:06Z

@etho201 @jacek-jablonski
I'm sorry for the inconvenience :/

jacek-jablonski · 2024-02-22T22:16:10Z

@etho201 @jacek-jablonski

I'm sorry for the inconvenience :/

No problem at all. Thanks for the great work 🙂

See 'oauth2-proxy/oauth2-proxy#2196 (comment)'

tuunit requested a review from a team as a code owner August 27, 2023 10:04

tuunit force-pushed the feature/github-orgs-and-teams-as-groups branch from f87a1a7 to a9c31a5 Compare August 27, 2023 10:05

tuunit changed the title ~~Feature/GitHub orgs and teams as groups~~ Feature: Add GitHub groups (orgs/teams) support Aug 27, 2023

tuunit added this to the v8.0.0 milestone Sep 13, 2023

tuunit added the enhancement label Sep 13, 2023

tuunit modified the milestones: v8.0.0, v7.6.0 Sep 14, 2023

tuunit commented Sep 24, 2023

View reviewed changes

tuunit force-pushed the feature/github-orgs-and-teams-as-groups branch from 50fbfab to e09b152 Compare October 15, 2023 08:37

kvanzuijlen reviewed Oct 25, 2023

View reviewed changes

Comment thread providers/github.go

tuunit mentioned this pull request Oct 28, 2023

enhancement: Change base image from alpine to distroless #2295

Merged

3 tasks

tuunit force-pushed the feature/github-orgs-and-teams-as-groups branch from e09b152 to 6dbbf1b Compare November 2, 2023 16:25

github-actions Bot added docs go changelog tests provider labels Nov 2, 2023

kvanzuijlen approved these changes Nov 7, 2023

View reviewed changes

kvanzuijlen added the LGTM PR is ready to merge label Nov 7, 2023

tuunit force-pushed the feature/github-orgs-and-teams-as-groups branch 2 times, most recently from 7c5248a to 8d2c360 Compare November 20, 2023 22:12

tuunit force-pushed the feature/github-orgs-and-teams-as-groups branch from 0599724 to dbe7a0c Compare December 17, 2023 10:49

tuunit and others added 5 commits December 18, 2023 10:35

Add GitHub groups (orgs/teams) support

ddc0f96

align code of getTeams with getOrgs to support Github Enterprise Serv…

419c7fa

…er instances with different domain

add documentation

4110b07

add missing import after rebase

6521102

miguelborges99 and others added 7 commits December 18, 2023 10:35

Add GitHub groups (orgs/teams) support

75cfd71

align code of getTeams with getOrgs to support Github Enterprise Serv…

08d45f9

…er instances with different domain

add documentation

2f84cb3

fix changelog & documentation

3cd17d5

fix missing import

8a2d360

tuunit force-pushed the feature/github-orgs-and-teams-as-groups branch from dbe7a0c to 8a2d360 Compare December 18, 2023 09:35

JoelSpeed reviewed Dec 18, 2023

View reviewed changes

JoelSpeed approved these changes Dec 18, 2023

View reviewed changes

JoelSpeed merged commit 52ad317 into oauth2-proxy:master Dec 18, 2023

BrewTestBot mentioned this pull request Feb 13, 2024

oauth2_proxy 7.6.0 Homebrew/homebrew-core#162510

Merged

tuunit mentioned this pull request Feb 22, 2024

[Bug]: No longer working on Kubernetes after upgrading from 7.5.1 to 7.6.0 #2522

Closed

berbiche added a commit to berbiche/infrastructure that referenced this pull request Apr 14, 2024

k8s: fix oauth2 proxy scope

ff0af53

See 'oauth2-proxy/oauth2-proxy#2196 (comment)'

rockhouse mentioned this pull request Apr 26, 2024

[Bug]: Invalid authentication via OAuth2 via Github for the owner of the organisation #2621

Closed

autarchprinceps mentioned this pull request May 13, 2025

[Support]: GitHub Multiple Organisations #3067

Closed

Uh oh!

Conversation

tuunit commented Aug 27, 2023

Motivation and Context

Description of the implementation details

How Has This Been Tested?

Checklist:

Uh oh!

tuunit commented Aug 27, 2023

Uh oh!

hoax commented Sep 23, 2023

Uh oh!

tuunit left a comment

Choose a reason for hiding this comment

Uh oh!

tuunit commented Oct 25, 2023

Uh oh!

Uh oh!

kvanzuijlen left a comment

Choose a reason for hiding this comment

Uh oh!

JoelSpeed left a comment

Choose a reason for hiding this comment

Uh oh!

jacek-jablonski commented Feb 21, 2024

Uh oh!

tuunit commented Feb 21, 2024

Uh oh!

jacek-jablonski commented Feb 21, 2024

Uh oh!

etho201 commented Feb 21, 2024

Uh oh!

tuunit commented Feb 22, 2024

Uh oh!

tuunit commented Feb 22, 2024

Uh oh!

jacek-jablonski commented Feb 22, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants