Repository: oauth2-proxy/oauth2-proxy
Pull request #1444 (2021-11-11 04:27:08)

Update LinkedIn provider validate URL
Signed-off-by: Jeeva Kandasamy <jkandasa@gmail.com>

Resolves: #1443

## How Has This Been Tested?
Yes, tested it in my local system

```bash
./oauth2-proxy \
    --provider="linkedin" \
    --cookie-secure=false \
    --upstream="http://192.168.0.21:8080" \
    --http-address="0.0.0.0:4180" \
    --redirect-url="https://private-domain/oauth2/callback" \
    --cookie-secret="12345678" \
    --client-id="abcd" \
    --client-secret="abcd" \
    --email-domain="gmail.com"
```

## Checklist:

<!--- Go over all the following points, and put an `x` in all the boxes that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're here to help! -->

- [x] My change requires a change to the documentation or CHANGELOG.
- [x] I have updated the documentation/CHANGELOG accordingly.
- [x] I have created a feature (non-master) branch for my PR.


JoelSpeed: I've been reviewing the linkedin documentation and it appears that this is a valid bug. The emailaddress endpoint, as far as I can tell, needs to have additional parameters to respond. The `/me` endpoint does not and is more in keeping with our expectations of a validate URL.

Please add a changelog entry for this PR and I will merge it. Thanks @jkandasa 

Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ba00ca1b..98d64d5b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@
 
 - [#1433](https://github.com/oauth2-proxy/oauth2-proxy/pull/1433) Let authentication fail when session validation fails (@stippi2)
 - [#1445](https://github.com/oauth2-proxy/oauth2-proxy/pull/1445) Fix docker container multi arch build issue by passing GOARCH details to make build (@jkandasa)
+- [#1444](https://github.com/oauth2-proxy/oauth2-proxy/pull/1444) Update LinkedIn provider validate URL (@jkandasa)
 
 # V7.2.0
 
diff --git a/providers/linkedin.go b/providers/linkedin.go
index 9e5135ab..cac80222 100644
--- a/providers/linkedin.go
+++ b/providers/linkedin.go
@@ -46,6 +46,13 @@ var (
 		Host:   "api.linkedin.com",
 		Path:   "/v2/emailAddress",
 	}
+
+	// Default Validate URL for LinkedIn.
+	linkedinDefaultValidateURL = &url.URL{
+		Scheme: "https",
+		Host:   "api.linkedin.com",
+		Path:   "/v2/me",
+	}
 )
 
 // NewLinkedInProvider initiates a new LinkedInProvider
@@ -55,7 +62,7 @@ func NewLinkedInProvider(p *ProviderData) *LinkedInProvider {
 		loginURL:    linkedinDefaultLoginURL,
 		redeemURL:   linkedinDefaultRedeemURL,
 		profileURL:  linkedinDefaultProfileURL,
-		validateURL: linkedinDefaultProfileURL,
+		validateURL: linkedinDefaultValidateURL,
 		scope:       linkedinDefaultScope,
 	})
 	return &LinkedInProvider{ProviderData: p}


Test patch:
diff --git a/providers/linkedin_test.go b/providers/linkedin_test.go
index 1d5bd90a..8f6f0d5f 100644
--- a/providers/linkedin_test.go
+++ b/providers/linkedin_test.go
@@ -54,7 +54,7 @@ func TestNewLinkedInProvider(t *testing.T) {
 	g.Expect(providerData.LoginURL.String()).To(Equal("https://www.linkedin.com/oauth/v2/authorization"))
 	g.Expect(providerData.RedeemURL.String()).To(Equal("https://www.linkedin.com/uas/oauth2/accessToken"))
 	g.Expect(providerData.ProfileURL.String()).To(Equal("https://api.linkedin.com/v2/emailAddress"))
-	g.Expect(providerData.ValidateURL.String()).To(Equal("https://api.linkedin.com/v2/emailAddress"))
+	g.Expect(providerData.ValidateURL.String()).To(Equal("https://api.linkedin.com/v2/me"))
 	g.Expect(providerData.Scope).To(Equal("r_emailaddress r_liteprofile"))
 }