Skip to content

Commit 1d6142a

Browse files
jkroepkejkroepke
authored
handle 403 errors from google, if user is not part of the group (#554)
* handle 403 errors from google, if user is not part of the group Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de> * handle 403 errors from google, if user is not part of the group Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de> * handle 403 errors from google, if user is not part of the group Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de> * handle 403 errors from google, if user is not part of the group Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de> * handle 403 errors from google, if user is not part of the group Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de> * handle 403 errors from google, if user is not part of the group Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de> * handle 403 errors from google, if user is not part of the group Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de> --------- Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
1 parent c1b0fcc commit 1d6142a

File tree

3 files changed

+29
-12
lines changed

3 files changed

+29
-12
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,6 @@ jobs:
2727
- uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
2828
env:
2929
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
30-
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
31-
with:
32-
name: dists
33-
path: dist/
3430
goreleaser:
3531
runs-on: ubuntu-24.04
3632
name: Test goreleaser
@@ -59,6 +55,10 @@ jobs:
5955
GITHUB_TOKEN: ""
6056
GPG_KEY_PATH: ""
6157

58+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
59+
with:
60+
name: dists
61+
path: dist/
6262
lint:
6363
name: lint
6464
runs-on: ubuntu-24.04

‎internal/oauth2/providers/google/api.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"io"
99
"net/http"
1010
"net/url"
11+
"strings"
1112

1213
"github.com/jkroepke/openvpn-auth-oauth2/internal/oauth2/idtoken"
1314
"github.com/jkroepke/openvpn-auth-oauth2/internal/oauth2/types"
@@ -93,6 +94,16 @@ func get[T any](ctx context.Context, httpClient *http.Client, accessToken string
9394
_ = json.Unmarshal(respBody, &apiErr)
9495
}
9596

97+
if strings.HasPrefix(apiErr.Error.Message, "Error(4001):") {
98+
// This error indicates that the current user does not have the required permissions to access the group.
99+
// Clear the data by setting it to zero value
100+
var zero T
101+
102+
*data = zero
103+
104+
return nil
105+
}
106+
96107
return fmt.Errorf("error from Google API %s: http status code: %d; message: %s", apiURL, resp.StatusCode, apiErr.Error.Message)
97108
}
98109

‎internal/oauth2/providers/google/check_test.go‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ import (
66
"strings"
77
"testing"
88

9-
types2 "github.com/jkroepke/openvpn-auth-oauth2/internal/config"
10-
oauth3 "github.com/jkroepke/openvpn-auth-oauth2/internal/oauth2"
9+
"github.com/jkroepke/openvpn-auth-oauth2/internal/config"
10+
"github.com/jkroepke/openvpn-auth-oauth2/internal/oauth2"
1111
"github.com/jkroepke/openvpn-auth-oauth2/internal/oauth2/idtoken"
1212
"github.com/jkroepke/openvpn-auth-oauth2/internal/oauth2/providers/google"
1313
"github.com/jkroepke/openvpn-auth-oauth2/internal/oauth2/types"
@@ -16,7 +16,7 @@ import (
1616
"github.com/stretchr/testify/assert"
1717
"github.com/stretchr/testify/require"
1818
"github.com/zitadel/oidc/v3/pkg/oidc"
19-
"golang.org/x/oauth2"
19+
gooauth2 "golang.org/x/oauth2"
2020
)
2121

2222
func TestValidateGroups(t *testing.T) {
@@ -76,11 +76,17 @@ func TestValidateGroups(t *testing.T) {
7676
[]string{"000000000000000"},
7777
"error from Google API https://cloudidentity.googleapis.com/v1/groups/000000000000000/memberships: http status code: 500; message: error",
7878
},
79+
{
80+
"permission denied",
81+
`{"error": {"message": "Error(4001): Permission denied for membership resource 'groups/000000000000000' (or it may not exist)."}}`,
82+
[]string{"000000000000000"},
83+
oauth2.ErrMissingRequiredGroup.Error(),
84+
},
7985
{
8086
"configure two group, none match",
8187
`{"memberships": [{"name": "groups/000000000000002/memberships/123456789101112131416", "memberKey": {"id": "user@example.com"}, "roles": [{"name": "MEMBER"}], "preferredMemberKey": {"id": "user@example.com"}}], "nextPageToken": ""}`,
8288
[]string{"000000000000000", "000000000000001"},
83-
oauth3.ErrMissingRequiredGroup.Error(),
89+
oauth2.ErrMissingRequiredGroup.Error(),
8490
},
8591
{
8692
"configure two group, missing one",
@@ -99,7 +105,7 @@ func TestValidateGroups(t *testing.T) {
99105
t.Parallel()
100106

101107
token := &oidc.Tokens[*idtoken.Claims]{
102-
Token: &oauth2.Token{
108+
Token: &gooauth2.Token{
103109
AccessToken: "TOKEN",
104110
},
105111
IDTokenClaims: &idtoken.Claims{},
@@ -109,9 +115,9 @@ func TestValidateGroups(t *testing.T) {
109115
token.AccessToken = ""
110116
}
111117

112-
conf := types2.Config{
113-
OAuth2: types2.OAuth2{
114-
Validate: types2.OAuth2Validate{
118+
conf := config.Config{
119+
OAuth2: config.OAuth2{
120+
Validate: config.OAuth2Validate{
115121
Groups: tc.requiredGroups,
116122
},
117123
},

0 commit comments

Comments
 (0)