Skip to content

Commit 865710a

Browse files
author
Daniel Carrion
committed
feat: update to plural and lowercase domain
1 parent 77bda0c commit 865710a

File tree

7 files changed

+24
-20
lines changed

7 files changed

+24
-20
lines changed

‎cli/deployment/config.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -215,9 +215,9 @@ func newConfig() *codersdk.DeploymentConfig {
215215
Flag: "oidc-client-secret",
216216
Secret: true,
217217
},
218-
EmailDomain: &codersdk.DeploymentConfigField[string]{
219-
Name: "OIDC Email Domain",
220-
Usage: "Email domain that clients logging in with OIDC must match.",
218+
EmailDomains: &codersdk.DeploymentConfigField[[]string]{
219+
Name: "OIDC Email Domains",
220+
Usage: "Email domains that clients logging in with OIDC must match.",
221221
Flag: "oidc-email-domain",
222222
},
223223
IssuerURL: &codersdk.DeploymentConfigField[string]{

‎cli/deployment/config_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ func TestConfig(t *testing.T) {
127127
Env: map[string]string{},
128128
Valid: func(config *codersdk.DeploymentConfig) {
129129
require.Empty(t, config.OIDC.IssuerURL.Value)
130-
require.Empty(t, config.OIDC.EmailDomain.Value)
130+
require.Empty(t, config.OIDC.EmailDomains.Value)
131131
require.Empty(t, config.OIDC.ClientID.Value)
132132
require.Empty(t, config.OIDC.ClientSecret.Value)
133133
require.True(t, config.OIDC.AllowSignups.Value)
@@ -147,7 +147,7 @@ func TestConfig(t *testing.T) {
147147
},
148148
Valid: func(config *codersdk.DeploymentConfig) {
149149
require.Equal(t, config.OIDC.IssuerURL.Value, "https://accounts.google.com")
150-
require.Equal(t, config.OIDC.EmailDomain.Value, "coder.com")
150+
require.Equal(t, config.OIDC.EmailDomains.Value, "coder.com")
151151
require.Equal(t, config.OIDC.ClientID.Value, "client")
152152
require.Equal(t, config.OIDC.ClientSecret.Value, "secret")
153153
require.False(t, config.OIDC.AllowSignups.Value)

‎cli/server.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -424,7 +424,7 @@ func Server(vip *viper.Viper, newAPI func(context.Context, *coderd.Options) (*co
424424
Verifier: oidcProvider.Verifier(&oidc.Config{
425425
ClientID: cfg.OIDC.ClientID.Value,
426426
}),
427-
EmailDomain: cfg.OIDC.EmailDomain.Value,
427+
EmailDomains: cfg.OIDC.EmailDomains.Value,
428428
AllowSignups: cfg.OIDC.AllowSignups.Value,
429429
}
430430
}

‎cli/testdata/coder_server_--help.golden

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ Flags:
9595
Consumes $CODER_OIDC_CLIENT_ID
9696
--oidc-client-secret string Client secret to use for Login with OIDC.
9797
Consumes $CODER_OIDC_CLIENT_SECRET
98-
--oidc-email-domain string Email domain that clients logging in with
98+
--oidc-email-domain string Email domains that clients logging in with
9999
OIDC must match.
100100
Consumes $CODER_OIDC_EMAIL_DOMAIN
101101
--oidc-ignore-email-verified Ignore the email_verified claim from the

‎coderd/userauth.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -192,8 +192,8 @@ type OIDCConfig struct {
192192
httpmw.OAuth2Config
193193

194194
Verifier *oidc.IDTokenVerifier
195-
// EmailDomain is the domain to enforce when a user authenticates.
196-
EmailDomain string
195+
// EmailDomains is the domain to enforce when a user authenticates.
196+
EmailDomains []string
197197
AllowSignups bool
198198
// IgnoreEmailVerified allows ignoring the email_verified claim
199199
// from an upstream OIDC provider. See #5065 for context.
@@ -291,17 +291,17 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
291291
}
292292
// Check if one or comma delimited list of allowed domains is provided.
293293
// If a suffix matches, break and continue, otherwise error.
294-
if api.OIDCConfig.EmailDomain != "" {
294+
if len(api.OIDCConfig.EmailDomains) != 0 {
295295
ok = false
296-
for _, domain := range strings.Split(api.OIDCConfig.EmailDomain, ",") {
297-
if strings.HasSuffix(strings.ToLower(email), domain) {
296+
for _, domain := range api.OIDCConfig.EmailDomains {
297+
if strings.HasSuffix(strings.ToLower(email), strings.ToLower(domain)) {
298298
ok = true
299299
break
300300
}
301301
}
302302
if !ok {
303303
httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
304-
Message: fmt.Sprintf("Your email %q is not a part of the %q domain!", email, api.OIDCConfig.EmailDomain),
304+
Message: fmt.Sprintf("Your email %q is not in domains %q !", email, api.OIDCConfig.EmailDomains),
305305
})
306306
return
307307
}

‎coderd/userauth_test.go

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -482,7 +482,7 @@ func TestUserOIDC(t *testing.T) {
482482
Name string
483483
Claims jwt.MapClaims
484484
AllowSignups bool
485-
EmailDomain string
485+
EmailDomains []string
486486
Username string
487487
AvatarURL string
488488
StatusCode int
@@ -528,17 +528,21 @@ func TestUserOIDC(t *testing.T) {
528528
"email_verified": true,
529529
},
530530
AllowSignups: true,
531-
EmailDomain: "coder.com",
532-
StatusCode: http.StatusForbidden,
531+
EmailDomains: []string{
532+
"coder.com",
533+
},
534+
StatusCode: http.StatusForbidden,
533535
}, {
534536
Name: "EmailDomainCaseInsensitive",
535537
Claims: jwt.MapClaims{
536538
"email": "kyle@KWC.io",
537539
"email_verified": true,
538540
},
539541
AllowSignups: true,
540-
EmailDomain: "kwc.io",
541-
StatusCode: http.StatusTemporaryRedirect,
542+
EmailDomains: []string{
543+
"kwc.io",
544+
},
545+
StatusCode: http.StatusTemporaryRedirect,
542546
}, {
543547
Name: "EmptyClaims",
544548
Claims: jwt.MapClaims{},
@@ -611,7 +615,7 @@ func TestUserOIDC(t *testing.T) {
611615

612616
config := conf.OIDCConfig()
613617
config.AllowSignups = tc.AllowSignups
614-
config.EmailDomain = tc.EmailDomain
618+
config.EmailDomains = tc.EmailDomains
615619
config.IgnoreEmailVerified = tc.IgnoreEmailVerified
616620

617621
client := coderdtest.New(t, &coderdtest.Options{

‎codersdk/deploymentconfig.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ type OIDCConfig struct {
9090
AllowSignups *DeploymentConfigField[bool] `json:"allow_signups" typescript:",notnull"`
9191
ClientID *DeploymentConfigField[string] `json:"client_id" typescript:",notnull"`
9292
ClientSecret *DeploymentConfigField[string] `json:"client_secret" typescript:",notnull"`
93-
EmailDomain *DeploymentConfigField[string] `json:"email_domain" typescript:",notnull"`
93+
EmailDomains *DeploymentConfigField[[]string] `json:"email_domain" typescript:",notnull"`
9494
IssuerURL *DeploymentConfigField[string] `json:"issuer_url" typescript:",notnull"`
9595
Scopes *DeploymentConfigField[[]string] `json:"scopes" typescript:",notnull"`
9696
IgnoreEmailVerified *DeploymentConfigField[bool] `json:"ignore_email_verified" typescript:",notnull"`

0 commit comments

Comments
 (0)