Support for group restriction for Gitlab provider

README.md

@@ -113,6 +113,10 @@ If you are using GitHub enterprise, make sure you set the following to the appro
 
 Whether you are using GitLab.com or self-hosting GitLab, follow [these steps to add an application](http://doc.gitlab.com/ce/integration/oauth_provider.html)
 
+The GitLab auth provider supports one additional parameter to restrict authentication to a specific group. Restricting by group is normally accompanied with `--email-domain=*`
+
+    -gitlab-group="": restrict logins to members of this group
+
 If you are using self-hosted GitLab, make sure you set the following to the appropriate URL:
 
     -login-url="<your gitlab url>/oauth/authorize"

main.go

@@ -42,6 +42,7 @@ func main() {
 	flagSet.String("azure-tenant", "common", "go to a tenant-specific or common (tenant-independent) endpoint.")
 	flagSet.String("github-org", "", "restrict logins to members of this organisation")
 	flagSet.String("github-team", "", "restrict logins to members of this team")
+	flagSet.String("gitlab-group", "", "restrict logins to members of this group")
 	flagSet.Var(&googleGroups, "google-group", "restrict logins to members of this google group (may be given multiple times).")
 	flagSet.String("google-admin-email", "", "the google admin to impersonate for api calls")
 	flagSet.String("google-service-account-json", "", "the path to the service account json credentials")

options.go

@@ -31,6 +31,7 @@ type Options struct {
 	EmailDomains             []string `flag:"email-domain" cfg:"email_domains"`
 	GitHubOrg                string   `flag:"github-org" cfg:"github_org"`
 	GitHubTeam               string   `flag:"github-team" cfg:"github_team"`
+	GitLabGroup              string   `flag:"gitlab-group" cfg:"gitlab_group"`
 	GoogleGroups             []string `flag:"google-group" cfg:"google_group"`
 	GoogleAdminEmail         string   `flag:"google-admin-email" cfg:"google_admin_email"`
 	GoogleServiceAccountJSON string   `flag:"google-service-account-json" cfg:"google_service_account_json"`
@@ -229,6 +230,8 @@ func parseProviderInfo(o *Options, msgs []string) []string {
 		p.Configure(o.AzureTenant)
 	case *providers.GitHubProvider:
 		p.SetOrgTeam(o.GitHubOrg, o.GitHubTeam)
+	case *providers.GitLabProvider:
+		p.SetGroup(o.GitLabGroup)
 	case *providers.GoogleProvider:
 		if o.GoogleServiceAccountJSON != "" {
 			file, err := os.Open(o.GoogleServiceAccountJSON)

providers/gitlab.go

@@ -5,11 +5,15 @@ import (
 	"net/http"
 	"net/url"
 
+	"encoding/json"
+	"fmt"
 	"github.com/bitly/oauth2_proxy/api"
+	"io/ioutil"
 )
 
 type GitLabProvider struct {
 	*ProviderData
+	Group string
 }
 
 func NewGitLabProvider(p *ProviderData) *GitLabProvider {
@@ -41,8 +45,56 @@ func NewGitLabProvider(p *ProviderData) *GitLabProvider {
 	return &GitLabProvider{ProviderData: p}
 }
 
+func (p *GitLabProvider) SetGroup(group string) {
+	p.Group = group
+}
+
+func (p *GitLabProvider) hasGroup(accessToken string) (bool, error) {
+
+	var groups []struct {
+		Group string `json:"name"`
+	}
+
+	endpoint := p.ValidateURL.Scheme + "://" + p.ValidateURL.Host + "/api/v3/groups?access_token=" + accessToken
+	req, _ := http.NewRequest("GET", endpoint, nil)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return false, err
+	}
+
+	body, err := ioutil.ReadAll(resp.Body)
+	resp.Body.Close()
+	if err != nil {
+		return false, err
+	}
+	if resp.StatusCode != 200 {
+		return false, fmt.Errorf("got %d from %q %s", resp.StatusCode, endpoint, body)
+	}
+
+	if err := json.Unmarshal(body, &groups); err != nil {
+		return false, err
+	}
+
+	for _, group := range groups {
+		if p.Group == group.Group {
+			// Found the group
+			return true, nil
+		}
+	}
+
+	log.Printf("Group %s not found in %s", p.Group, groups)
+	return false, nil
+}
+
 func (p *GitLabProvider) GetEmailAddress(s *SessionState) (string, error) {
 
+	// if we require a group, check that first
+	if p.Group != "" {
+		if ok, err := p.hasGroup(s.AccessToken); err != nil || !ok {
+			return "", err
+		}
+	}
+
 	req, err := http.NewRequest("GET",
 		p.ValidateURL.String()+"?access_token="+s.AccessToken, nil)
 	if err != nil {