{"action":"created","issue":{"url":"https://api.github.com/repos/gambol99/keycloak-proxy/issues/270","repository_url":"https://api.github.com/repos/gambol99/keycloak-proxy","labels_url":"https://api.github.com/repos/gambol99/keycloak-proxy/issues/270/labels{/name}","comments_url":"https://api.github.com/repos/gambol99/keycloak-proxy/issues/270/comments","events_url":"https://api.github.com/repos/gambol99/keycloak-proxy/issues/270/events","html_url":"https://github.com/gambol99/keycloak-proxy/issues/270","id":254120250,"number":270,"title":"The case of login being optional","user":{"login":"dalu","id":2694548,"avatar_url":"https://avatars0.githubusercontent.com/u/2694548?v=4","gravatar_id":"","url":"https://api.github.com/users/dalu","html_url":"https://github.com/dalu","followers_url":"https://api.github.com/users/dalu/followers","following_url":"https://api.github.com/users/dalu/following{/other_user}","gists_url":"https://api.github.com/users/dalu/gists{/gist_id}","starred_url":"https://api.github.com/users/dalu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dalu/subscriptions","organizations_url":"https://api.github.com/users/dalu/orgs","repos_url":"https://api.github.com/users/dalu/repos","events_url":"https://api.github.com/users/dalu/events{/privacy}","received_events_url":"https://api.github.com/users/dalu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2017-08-30T20:09:33Z","updated_at":"2018-03-28T00:37:13Z","closed_at":null,"author_association":"NONE","body":"On a classic website you have a front page.\r\nOn this front page you have something like a \"Welcome Firstname Lastname\" or \"Login or Register\" if not logged in.\r\n\r\nWhen defining resources that need to be guarded, to my knowledge, there is no possibility to say \"login is optional\".\r\n```yaml\r\ndiscovery-url: https://domain/auth/realms/testrealm\r\nclient-id: someid\r\nclient-secret: somesecret\r\nlisten: 127.0.0.1:8080\r\nencryption_key: 1234567890123456\r\nupstream-url: http://127.0.0.1:3000\r\nsecure-cookie: false\r\nresources:\r\n- uri: /doc*\r\n  methods:\r\n  - GET\r\n  - POST\r\n  - DELETE\r\n```\r\n\r\nThis is a test program\r\n```go\r\npackage main\r\n\r\nimport (\r\n\t\"fmt\"\r\n\t\"net/http\"\r\n\t\"strings\"\r\n\r\n\t\"github.com/SermoDigital/jose/jws\"\r\n)\r\n\r\nfunc main() {\r\n\th := &Handler{}\r\n\thttp.ListenAndServe(\":3000\", h)\r\n}\r\n\r\ntype Handler struct{}\r\n\r\nfunc (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {\r\n\tswitch r.Method {\r\n\tcase http.MethodGet:\r\n\t\tfmt.Fprintln(w, \"GET\")\r\n\t\th.printXHeaders(w, r)\r\n\t\tj, err := jws.ParseFromHeader(r, jws.Unknown)\r\n\t\tif err != nil {\r\n\t\t\tfmt.Fprintln(w, err.Error())\r\n\t\t\treturn\r\n\t\t}\r\n\t\tfmt.Fprintln(w, j.Payload())\r\n\t\ti, _ := j.Payload().(map[string]interface{})\r\n\t\tfmt.Fprintln(w, i[\"name\"])\r\n\tcase http.MethodPost:\r\n\t\tfmt.Fprintln(w, \"POST\")\r\n\t\th.printXHeaders(w, r)\r\n\tcase http.MethodDelete:\r\n\t\tfmt.Fprintln(w, \"DELETE\")\r\n\t\th.printXHeaders(w, r)\r\n\tdefault:\r\n\t\tfmt.Fprintln(w, \"NOT ALLOWED\")\r\n\r\n\t}\r\n}\r\n\r\nfunc (h *Handler) printXHeaders(w http.ResponseWriter, r *http.Request) {\r\n\tfor k, v := range r.Header {\r\n\t\tif strings.HasPrefix(k, \"X-\") {\r\n\t\t\tfmt.Fprintln(w, k, v)\r\n\t\t}\r\n\t}\r\n}\r\n```\r\n\r\nwith the above program if you *are* logged in and hit `/` uri the result is\r\n\r\n```\r\nGET\r\nX-Forwarded-For [127.0.0.1]\r\nX-Forwarded-Host [127.0.0.1:3000]\r\nX-Forwarded-Proto []\r\nno token present in request\r\n```\r\n\r\nSo I'm suggesting to have a configurable means to pass the token regardless of an endpoint or endpoint prefix being protected or not.\r\n\r\nIf you already can do that then sorry for bothering."},"comment":{"url":"https://api.github.com/repos/gambol99/keycloak-proxy/issues/comments/376720642","html_url":"https://github.com/gambol99/keycloak-proxy/issues/270#issuecomment-376720642","issue_url":"https://api.github.com/repos/gambol99/keycloak-proxy/issues/270","id":376720642,"user":{"login":"pjeby","id":3527052,"avatar_url":"https://avatars2.githubusercontent.com/u/3527052?v=4","gravatar_id":"","url":"https://api.github.com/users/pjeby","html_url":"https://github.com/pjeby","followers_url":"https://api.github.com/users/pjeby/followers","following_url":"https://api.github.com/users/pjeby/following{/other_user}","gists_url":"https://api.github.com/users/pjeby/gists{/gist_id}","starred_url":"https://api.github.com/users/pjeby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pjeby/subscriptions","organizations_url":"https://api.github.com/users/pjeby/orgs","repos_url":"https://api.github.com/users/pjeby/repos","events_url":"https://api.github.com/users/pjeby/events{/privacy}","received_events_url":"https://api.github.com/users/pjeby/received_events","type":"User","site_admin":false},"created_at":"2018-03-28T00:37:13Z","updated_at":"2018-03-28T00:37:13Z","author_association":"CONTRIBUTOR","body":"It works for my use case, which is making it easier to integrate with an older app that can handle authentication via headers but can't do OIDC.  So the entire app is completely whitelisted, it just links to /oauth/authorize and oauth/logout for login and logout respectively, with everything else handled via the headers.  I haven't tried whitelisting some methods but not others."}}
{"actor":{"display_login":"pjeby"}}