starred/godoxy-yusing
1
0
Fork 0
mirror of https://github.com/yusing/godoxy.git synced 2026-01-11 14:20:32 +01:00
Code Issues 18 Packages Projects Releases 10 Wiki Activity

[PR #145] [MERGED] feat: Add per-route OIDC client ID and secret support #172

New Issue
Closed
opened 2025-12-29 15:18:51 +01:00 by adam · 0 comments
adam commented 2025-12-29 15:18:51 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/yusing/godoxy/pull/145
Author: @deandre
Created: 9/7/2025
Status: ✅ Merged
Merged: 9/8/2025
Merged by: @yusing

Base: main ← Head: per-route-oidc

📝 Commits (2)

📊 Changes

5 files changed (+130 additions, -14 deletions)

View changed files

📝 internal/auth/oauth_refresh.go (+1 -1)
📝 internal/auth/oidc.go (+64 -12)
📝 internal/auth/oidc_test.go (+4 -1)
📝 internal/net/gphttp/middleware/oidc.go (+26 -0)
➕ internal/net/gphttp/middleware/oidc_test.go (+35 -0)

📄 Description

Summary

This PR implements the ability to specify custom OIDC client ID and secret per route, allowing different applications to use different OIDC clients while maintaining cookie isolation to prevent conflicts.

Changes

  • App-scoped cookie names: Cookie names are now scoped to the specific OIDC client ID to prevent conflicts between different applications
  • Custom OIDC provider creation: Added NewOIDCProviderWithCustomClient() function to create OIDC providers with custom credentials
  • Per-route middleware configuration: Extended OIDC middleware to support client_id, client_secret, and scopes per route

Usage Examples

Docker Labels

services:
  app1:
    image: nginx:alpine
    labels:
      proxy.aliases: app1.example.com
      proxy.#1.port: 80
      proxy.#1.middlewares.oidc: |
        client_id: "app1-client-id"
        client_secret: "app1-client-secret"
        scopes: "openid,profile,email,groups"
        allowed_users: ["app1-user1", "app1-user2"]
        allowed_groups: ["app1-group"]

  app2:
    image: nginx:alpine
    labels:
      proxy.aliases: app2.example.com
      proxy.#1.port: 80
      proxy.#1.middlewares.oidc: |
        client_id: "app2-client-id"
        client_secret: "app2-client-secret"
        allowed_groups: ["app2-group", "shared-group"]

  app3:
    image: nginx:alpine
    labels:
      proxy.aliases: app3.example.com
      proxy.#1.port: 80
      proxy.#1.middlewares.oidc: |
        # Uses global OIDC config (no client_id/client_secret)
        allowed_users: ["app3-user"]

YAML Configuration

# Global OIDC configuration (used as fallback)
oidc:
  issuer_url: "https://your-oidc-provider.com"
  client_id: "global-client-id"
  client_secret: "global-client-secret"
  allowed_users: ["admin", "user1"]
  allowed_groups: ["admins", "users"]

routes:
  # App with custom client credentials
  - name: "app1"
    url: "http://app1:8080"
    middleware:
      oidc:
        client_id: "app1-client-id"
        client_secret: "app1-client-secret"
        scopes: "openid,profile,email,groups"
        allowed_users: ["app1-user1", "app1-user2"]
        allowed_groups: ["app1-group"]

  # App with different client and group-based access
  - name: "app2"
    url: "http://app2:8080"
    middleware:
      oidc:
        client_id: "app2-client-id"
        client_secret: "app2-client-secret"
        allowed_groups: ["app2-group", "shared-group"]

  # App using global OIDC configuration
  - name: "app3"
    url: "http://app3:8080"
    middleware:
      oidc:
        # No client_id/client_secret specified, uses global config
        allowed_users: ["app3-user"]

  # App with custom scopes only
  - name: "app4"
    url: "http://app4:8080"
    middleware:
      oidc:
        scopes: "openid,profile,email,groups,custom-scope"
        allowed_groups: ["app4-group"]

Breaking Changes

None. This is fully backward compatible.

Testing

  • All existing tests pass
  • New tests added for middleware functionality
  • Tested with multiple OIDC clients using different credentials

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/yusing/godoxy/pull/145 **Author:** [@deandre](https://github.com/deandre) **Created:** 9/7/2025 **Status:** ✅ Merged **Merged:** 9/8/2025 **Merged by:** [@yusing](https://github.com/yusing) **Base:** `main` ← **Head:** `per-route-oidc` --- ### 📝 Commits (2) - [`de9f20f`](https://github.com/yusing/godoxy/commit/de9f20f5b183677b863900b9aa085476e21a65f5) Implement per-route OIDC - [`26ee8e6`](https://github.com/yusing/godoxy/commit/26ee8e67ea3277958ada610afac14569ed370900) address sonarqube feedback ### 📊 Changes **5 files changed** (+130 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `internal/auth/oauth_refresh.go` (+1 -1) 📝 `internal/auth/oidc.go` (+64 -12) 📝 `internal/auth/oidc_test.go` (+4 -1) 📝 `internal/net/gphttp/middleware/oidc.go` (+26 -0) ➕ `internal/net/gphttp/middleware/oidc_test.go` (+35 -0) </details> ### 📄 Description ## Summary This PR implements the ability to specify custom OIDC client ID and secret per route, allowing different applications to use different OIDC clients while maintaining cookie isolation to prevent conflicts. ## Changes - **App-scoped cookie names**: Cookie names are now scoped to the specific OIDC client ID to prevent conflicts between different applications - **Custom OIDC provider creation**: Added `NewOIDCProviderWithCustomClient()` function to create OIDC providers with custom credentials - **Per-route middleware configuration**: Extended OIDC middleware to support `client_id`, `client_secret`, and `scopes` per route ## Usage Examples ### Docker Labels ```yaml services: app1: image: nginx:alpine labels: proxy.aliases: app1.example.com proxy.#1.port: 80 proxy.#1.middlewares.oidc: | client_id: "app1-client-id" client_secret: "app1-client-secret" scopes: "openid,profile,email,groups" allowed_users: ["app1-user1", "app1-user2"] allowed_groups: ["app1-group"] app2: image: nginx:alpine labels: proxy.aliases: app2.example.com proxy.#1.port: 80 proxy.#1.middlewares.oidc: | client_id: "app2-client-id" client_secret: "app2-client-secret" allowed_groups: ["app2-group", "shared-group"] app3: image: nginx:alpine labels: proxy.aliases: app3.example.com proxy.#1.port: 80 proxy.#1.middlewares.oidc: | # Uses global OIDC config (no client_id/client_secret) allowed_users: ["app3-user"] ``` ### YAML Configuration ```yaml # Global OIDC configuration (used as fallback) oidc: issuer_url: "https://your-oidc-provider.com" client_id: "global-client-id" client_secret: "global-client-secret" allowed_users: ["admin", "user1"] allowed_groups: ["admins", "users"] routes: # App with custom client credentials - name: "app1" url: "http://app1:8080" middleware: oidc: client_id: "app1-client-id" client_secret: "app1-client-secret" scopes: "openid,profile,email,groups" allowed_users: ["app1-user1", "app1-user2"] allowed_groups: ["app1-group"] # App with different client and group-based access - name: "app2" url: "http://app2:8080" middleware: oidc: client_id: "app2-client-id" client_secret: "app2-client-secret" allowed_groups: ["app2-group", "shared-group"] # App using global OIDC configuration - name: "app3" url: "http://app3:8080" middleware: oidc: # No client_id/client_secret specified, uses global config allowed_users: ["app3-user"] # App with custom scopes only - name: "app4" url: "http://app4:8080" middleware: oidc: scopes: "openid,profile,email,groups,custom-scope" allowed_groups: ["app4-group"] ``` ## Breaking Changes None. This is fully backward compatible. ## Testing - All existing tests pass - New tests added for middleware functionality - Tested with multiple OIDC clients using different credentials --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 15:18:51 +01:00
adam closed this issue 2025-12-29 15:18:51 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
pull-request
Mirrored from GitHub Pull Request
 wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/godoxy-yusing#172
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?