github/kubelogin
1
0
Fork 0
mirror of https://github.com/int128/kubelogin.git synced 2026-08-28 22:57:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into int128/Add----oidc-access-type-

Browse Source
This commit is contained in:
Hidetake Iwata
2025-11-24 21:24:10 +09:00
committed by GitHub
parent c0c507b787 19d4f627ae
commit 1ecd149388
7 changed files with 28 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration_test/credetial_plugin_test.go
-26
View File
@@ -332,32 +332,6 @@ func TestCredentialPlugin(t *testing.T) {
assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
})
t.Run("RedirectURLHostname", func(t *testing.T) {
ctx, cancel := context.WithTimeout(context.TODO(), timeout)
defer cancel()
svc := oidcserver.New(t, keypair.None, testconfig.Config{
Want: testconfig.Want{
Scope: "openid",
RedirectURIPrefix: "http://127.0.0.1:",
CodeChallengeMethod: "S256",
},
Response: testconfig.Response{
IDTokenExpiry: now.Add(time.Hour),
CodeChallengeMethodsSupported: []string{"plain", "S256"},
},
})
var stdout bytes.Buffer
runGetToken(t, ctx, getTokenConfig{
tokenCacheDir: tokenCacheDir,
issuerURL: svc.IssuerURL(),
httpDriver: httpdriver.New(ctx, t, httpdriver.Config{BodyContains: "Authenticated"}),
now: now,
stdout: &stdout,
args: []string{"--oidc-redirect-url-hostname", "127.0.0.1"},
})
assertCredentialPluginStdout(t, &stdout, svc.LastTokenResponse().IDToken, now.Add(time.Hour))
})
t.Run("RedirectURLHTTPS", func(t *testing.T) {
ctx, cancel := context.WithTimeout(context.TODO(), timeout)
defer cancel()
pkg/cmd/authentication.go
+12 -23
View File
@@ -15,20 +15,18 @@ import (
)
type authenticationOptions struct {
GrantType string
ListenAddress []string
AuthenticationTimeoutSec int
SkipOpenBrowser bool
BrowserCommand string
LocalServerCertFile string
LocalServerKeyFile string
OpenURLAfterAuthentication string
RedirectURLHostname string // DEPRECATED
RedirectURLAuthCodeKeyboard string // DEPRECATED
AuthRequestAccessType string
AuthRequestExtraParams map[string]string
Username string
Password string
GrantType string
ListenAddress []string
AuthenticationTimeoutSec int
SkipOpenBrowser bool
BrowserCommand string
LocalServerCertFile string
LocalServerKeyFile string
OpenURLAfterAuthentication string
AuthRequestAccessType string
AuthRequestExtraParams map[string]string
Username string
Password string
}
var allGrantType = strings.Join([]string{
@@ -49,14 +47,6 @@ func (o *authenticationOptions) addFlags(f *pflag.FlagSet) {
f.StringVar(&o.LocalServerCertFile, "local-server-cert", "", "[authcode] Certificate path for the local server")
f.StringVar(&o.LocalServerKeyFile, "local-server-key", "", "[authcode] Certificate key path for the local server")
f.StringVar(&o.OpenURLAfterAuthentication, "open-url-after-authentication", "", "[authcode] If set, open the URL in the browser after authentication")
f.StringVar(&o.RedirectURLHostname, "oidc-redirect-url-hostname", "", "[authcode] Hostname of the redirect URL")
if err := f.MarkDeprecated("oidc-redirect-url-hostname", "use --oidc-redirect-url instead."); err != nil {
panic(err)
}
f.StringVar(&o.RedirectURLAuthCodeKeyboard, "oidc-redirect-url-authcode-keyboard", "", "Equivalent to --oidc-redirect-url")
if err := f.MarkDeprecated("oidc-redirect-url-authcode-keyboard", "use --oidc-redirect-url instead."); err != nil {
panic(err)
}
f.StringVar(&o.AuthRequestAccessType, "oidc-access-type", "offline", "[authcode, authcode-keyboard] Access type of the authentication request")
f.StringToStringVar(&o.AuthRequestExtraParams, "oidc-auth-request-extra-params", nil, "[authcode, authcode-keyboard, client-credentials] Extra query parameters to send with an authentication request")
f.StringVar(&o.Username, "username", "", "[password] Username for resource owner password credentials grant")
@@ -79,7 +69,6 @@ func (o *authenticationOptions) grantOptionSet() (s authentication.GrantOptionSe
LocalServerCertFile: o.LocalServerCertFile,
LocalServerKeyFile: o.LocalServerKeyFile,
OpenURLAfterAuthentication: o.OpenURLAfterAuthentication,
RedirectURLHostname: o.RedirectURLHostname,
AuthRequestAccessType: o.AuthRequestAccessType,
AuthRequestExtraParams: o.AuthRequestExtraParams,
}
pkg/cmd/authentication_test.go
-3
View File
@@ -36,7 +36,6 @@ func Test_authenticationOptions_grantOptionSet(t *testing.T) {
"--local-server-cert", "/path/to/local-server-cert",
"--local-server-key", "/path/to/local-server-key",
"--open-url-after-authentication", "https://example.com/success.html",
"--oidc-redirect-url-hostname", "example",
"--oidc-auth-request-extra-params", "ttl=86400",
"--oidc-auth-request-extra-params", "reauth=true",
"--username", "USER",
@@ -51,7 +50,6 @@ func Test_authenticationOptions_grantOptionSet(t *testing.T) {
LocalServerCertFile: "/path/to/local-server-cert",
LocalServerKeyFile: "/path/to/local-server-key",
OpenURLAfterAuthentication: "https://example.com/success.html",
RedirectURLHostname: "example",
AuthRequestExtraParams: map[string]string{"ttl": "86400", "reauth": "true"},
},
},
@@ -67,7 +65,6 @@ func Test_authenticationOptions_grantOptionSet(t *testing.T) {
"GrantType=authcode-keyboard with full options": {
args: []string{
"--grant-type", "authcode-keyboard",
"--oidc-redirect-url-authcode-keyboard", "http://localhost",
"--oidc-auth-request-extra-params", "ttl=86400",
"--oidc-auth-request-extra-params", "reauth=true",
},
pkg/cmd/get_token.go
+1 -5
View File
@@ -84,16 +84,12 @@ func (cmd *GetToken) New() *cobra.Command {
if err != nil {
return fmt.Errorf("get-token: %w", err)
}
redirectURL := o.RedirectURL
if o.authenticationOptions.RedirectURLAuthCodeKeyboard != "" {
redirectURL = o.authenticationOptions.RedirectURLAuthCodeKeyboard
}
in := credentialplugin.Input{
Provider: oidc.Provider{
IssuerURL: o.IssuerURL,
ClientID: o.ClientID,
ClientSecret: o.ClientSecret,
RedirectURL: redirectURL,
RedirectURL: o.RedirectURL,
PKCEMethod: pkceMethod,
UseAccessToken: o.UseAccessToken,
ExtraScopes: o.ExtraScopes,
pkg/oidc/client/authcode.go
+4 -2
View File
@@ -28,7 +28,10 @@ type ExchangeAuthCodeInput struct {
type GetTokenByAuthCodeInput struct {
AuthCodeURLInput
BindAddress []string
RedirectURLHostname string // DEPRECATED
State string
Nonce string
PKCEParams pkce.Params
AuthRequestExtraParams map[string]string
LocalServerSuccessHTML string
LocalServerCertFile string
LocalServerKeyFile string
@@ -48,7 +51,6 @@ func (c *client) GetTokenByAuthCode(ctx context.Context, in GetTokenByAuthCodeIn
TokenRequestOptions: tokenRequestOptions(in.PKCEParams),
LocalServerBindAddress: in.BindAddress,
LocalServerReadyChan: localServerReadyChan,
RedirectURLHostname: in.RedirectURLHostname,
LocalServerSuccessHTML: in.LocalServerSuccessHTML,
LocalServerCertFile: in.LocalServerCertFile,
LocalServerKeyFile: in.LocalServerKeyFile,
pkg/oidc/client/factory.go
+7 -1
View File
@@ -62,11 +62,17 @@ func (f *Factory) New(ctx context.Context, prov oidc.Provider, tlsClientConfig t
if err != nil {
return nil, fmt.Errorf("could not determine supported PKCE methods: %w", err)
}
endpoint := provider.Endpoint()
if prov.ClientSecret == "" {
endpoint.AuthStyle = oauth2.AuthStyleInParams
}
return &client{
httpClient: httpClient,
provider: provider,
oauth2Config: oauth2.Config{
Endpoint: provider.Endpoint(),
Endpoint: endpoint,
ClientID: prov.ClientID,
ClientSecret: prov.ClientSecret,
RedirectURL: prov.RedirectURL,
pkg/usecases/authentication/authcode/browser.go
+4 -2
View File
@@ -19,7 +19,6 @@ type BrowserOption struct {
BindAddress []string
AuthenticationTimeout time.Duration
OpenURLAfterAuthentication string
RedirectURLHostname string // DEPRECATED
AuthRequestAccessType string
AuthRequestExtraParams map[string]string
LocalServerCertFile string
@@ -59,7 +58,10 @@ func (u *Browser) Do(ctx context.Context, o *BrowserOption, oidcClient client.In
AuthRequestExtraParams: o.AuthRequestExtraParams,
},
BindAddress: o.BindAddress,
RedirectURLHostname: o.RedirectURLHostname,
State: state,
Nonce: nonce,
PKCEParams: pkceParams,
AuthRequestExtraParams: o.AuthRequestExtraParams,
LocalServerSuccessHTML: successHTML,
LocalServerCertFile: o.LocalServerCertFile,
LocalServerKeyFile: o.LocalServerKeyFile,