[PR #145] [MERGED] feat: Add per-route OIDC client ID and secret support #171

New Issue

adam · 2025-12-29T09:23:46+01:00

adam commented

2025-12-29 09:23:46 +01:00

📋 Pull Request Information

Original PR: https://github.com/yusing/godoxy/pull/145
Author: @deandre
Created: 9/7/2025
Status: ✅ Merged
Merged: 9/8/2025
Merged by: @yusing

Base: main ← Head: per-route-oidc

📝 Commits (2)

de9f20f Implement per-route OIDC
26ee8e6 address sonarqube feedback

📊 Changes

5 files changed (+130 additions, -14 deletions)

View changed files

📝 internal/auth/oauth_refresh.go (+1 -1)
📝 internal/auth/oidc.go (+64 -12)
📝 internal/auth/oidc_test.go (+4 -1)
📝 internal/net/gphttp/middleware/oidc.go (+26 -0)
➕ internal/net/gphttp/middleware/oidc_test.go (+35 -0)

📄 Description

Summary

This PR implements the ability to specify custom OIDC client ID and secret per route, allowing different applications to use different OIDC clients while maintaining cookie isolation to prevent conflicts.

Changes

App-scoped cookie names: Cookie names are now scoped to the specific OIDC client ID to prevent conflicts between different applications
Custom OIDC provider creation: Added NewOIDCProviderWithCustomClient() function to create OIDC providers with custom credentials
Per-route middleware configuration: Extended OIDC middleware to support client_id, client_secret, and scopes per route

Usage Examples

Docker Labels

services:
  app1:
    image: nginx:alpine
    labels:
      proxy.aliases: app1.example.com
      proxy.#1.port: 80
      proxy.#1.middlewares.oidc: |
        client_id: "app1-client-id"
        client_secret: "app1-client-secret"
        scopes: "openid,profile,email,groups"
        allowed_users: ["app1-user1", "app1-user2"]
        allowed_groups: ["app1-group"]

  app2:
    image: nginx:alpine
    labels:
      proxy.aliases: app2.example.com
      proxy.#1.port: 80
      proxy.#1.middlewares.oidc: |
        client_id: "app2-client-id"
        client_secret: "app2-client-secret"
        allowed_groups: ["app2-group", "shared-group"]

  app3:
    image: nginx:alpine
    labels:
      proxy.aliases: app3.example.com
      proxy.#1.port: 80
      proxy.#1.middlewares.oidc: |
        # Uses global OIDC config (no client_id/client_secret)
        allowed_users: ["app3-user"]

YAML Configuration

# Global OIDC configuration (used as fallback)
oidc:
  issuer_url: "https://your-oidc-provider.com"
  client_id: "global-client-id"
  client_secret: "global-client-secret"
  allowed_users: ["admin", "user1"]
  allowed_groups: ["admins", "users"]

routes:
  # App with custom client credentials
  - name: "app1"
    url: "http://app1:8080"
    middleware:
      oidc:
        client_id: "app1-client-id"
        client_secret: "app1-client-secret"
        scopes: "openid,profile,email,groups"
        allowed_users: ["app1-user1", "app1-user2"]
        allowed_groups: ["app1-group"]

  # App with different client and group-based access
  - name: "app2"
    url: "http://app2:8080"
    middleware:
      oidc:
        client_id: "app2-client-id"
        client_secret: "app2-client-secret"
        allowed_groups: ["app2-group", "shared-group"]

  # App using global OIDC configuration
  - name: "app3"
    url: "http://app3:8080"
    middleware:
      oidc:
        # No client_id/client_secret specified, uses global config
        allowed_users: ["app3-user"]

  # App with custom scopes only
  - name: "app4"
    url: "http://app4:8080"
    middleware:
      oidc:
        scopes: "openid,profile,email,groups,custom-scope"
        allowed_groups: ["app4-group"]

Breaking Changes

None. This is fully backward compatible.

Testing

All existing tests pass
New tests added for middleware functionality
Tested with multiple OIDC clients using different credentials

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/yusing/godoxy/pull/145 **Author:** [@deandre](https://github.com/deandre) **Created:** 9/7/2025 **Status:** ✅ Merged **Merged:** 9/8/2025 **Merged by:** [@yusing](https://github.com/yusing) **Base:** `main` ← **Head:** `per-route-oidc` --- ### 📝 Commits (2) - [`de9f20f`](https://github.com/yusing/godoxy/commit/de9f20f5b183677b863900b9aa085476e21a65f5) Implement per-route OIDC - [`26ee8e6`](https://github.com/yusing/godoxy/commit/26ee8e67ea3277958ada610afac14569ed370900) address sonarqube feedback ### 📊 Changes **5 files changed** (+130 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `internal/auth/oauth_refresh.go` (+1 -1) 📝 `internal/auth/oidc.go` (+64 -12) 📝 `internal/auth/oidc_test.go` (+4 -1) 📝 `internal/net/gphttp/middleware/oidc.go` (+26 -0) ➕ `internal/net/gphttp/middleware/oidc_test.go` (+35 -0) </details> ### 📄 Description ## Summary This PR implements the ability to specify custom OIDC client ID and secret per route, allowing different applications to use different OIDC clients while maintaining cookie isolation to prevent conflicts. ## Changes - **App-scoped cookie names**: Cookie names are now scoped to the specific OIDC client ID to prevent conflicts between different applications - **Custom OIDC provider creation**: Added `NewOIDCProviderWithCustomClient()` function to create OIDC providers with custom credentials - **Per-route middleware configuration**: Extended OIDC middleware to support `client_id`, `client_secret`, and `scopes` per route ## Usage Examples ### Docker Labels ```yaml services: app1: image: nginx:alpine labels: proxy.aliases: app1.example.com proxy.#1.port: 80 proxy.#1.middlewares.oidc: | client_id: "app1-client-id" client_secret: "app1-client-secret" scopes: "openid,profile,email,groups" allowed_users: ["app1-user1", "app1-user2"] allowed_groups: ["app1-group"] app2: image: nginx:alpine labels: proxy.aliases: app2.example.com proxy.#1.port: 80 proxy.#1.middlewares.oidc: | client_id: "app2-client-id" client_secret: "app2-client-secret" allowed_groups: ["app2-group", "shared-group"] app3: image: nginx:alpine labels: proxy.aliases: app3.example.com proxy.#1.port: 80 proxy.#1.middlewares.oidc: | # Uses global OIDC config (no client_id/client_secret) allowed_users: ["app3-user"] ``` ### YAML Configuration ```yaml # Global OIDC configuration (used as fallback) oidc: issuer_url: "https://your-oidc-provider.com" client_id: "global-client-id" client_secret: "global-client-secret" allowed_users: ["admin", "user1"] allowed_groups: ["admins", "users"] routes: # App with custom client credentials - name: "app1" url: "http://app1:8080" middleware: oidc: client_id: "app1-client-id" client_secret: "app1-client-secret" scopes: "openid,profile,email,groups" allowed_users: ["app1-user1", "app1-user2"] allowed_groups: ["app1-group"] # App with different client and group-based access - name: "app2" url: "http://app2:8080" middleware: oidc: client_id: "app2-client-id" client_secret: "app2-client-secret" allowed_groups: ["app2-group", "shared-group"] # App using global OIDC configuration - name: "app3" url: "http://app3:8080" middleware: oidc: # No client_id/client_secret specified, uses global config allowed_users: ["app3-user"] # App with custom scopes only - name: "app4" url: "http://app4:8080" middleware: oidc: scopes: "openid,profile,email,groups,custom-scope" allowed_groups: ["app4-group"] ``` ## Breaking Changes None. This is fully backward compatible. ## Testing - All existing tests pass - New tests added for middleware functionality - Tested with multiple OIDC clients using different credentials --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

adam added the pull-request label 2025-12-29 09:23:46 +01:00

adam closed this issue

2025-12-29 09:23:46 +01:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/godoxy#171