proxy: Allow injection of request headers

internal/proxy/oauthproxy.go

@@ -802,6 +802,9 @@ func (p *OAuthProxy) Authenticate(rw http.ResponseWriter, req *http.Request) (er
 	req.Header.Set("X-Forwarded-Email", session.Email)
 	req.Header.Set("X-Forwarded-Groups", strings.Join(session.Groups, ","))
 
+	for key, val := range p.upstreamConfig.InjectRequestHeaders {
+		req.Header.Set(key, val)
+	}
 	// stash authenticated user so that it can be logged later (see func logRequest)
 	rw.Header().Set(loggingUserHeader, session.Email)
 

internal/proxy/proxy_config.go

@@ -59,6 +59,7 @@ type UpstreamConfig struct {
 	ResetDeadline         time.Duration
 	FlushInterval         time.Duration
 	HeaderOverrides       map[string]string
+	InjectRequestHeaders  map[string]string
 	SkipRequestSigning    bool
 	CookieName            string
 	ProviderSlug          string
@@ -87,16 +88,17 @@ type RouteConfig struct {
 // * skip_request_signing - skip request signing if this behavior is problematic or undesired. For requests with large http bodies
 //   this maybe useful to unset as http bodies are read into memory in order to sign.
 type OptionsConfig struct {
-	HeaderOverrides    map[string]string `yaml:"header_overrides"`
-	SkipAuthRegex      []string          `yaml:"skip_auth_regex"`
-	AllowedGroups      []string          `yaml:"allowed_groups"`
-	TLSSkipVerify      bool              `yaml:"tls_skip_verify"`
-	PreserveHost       bool              `yaml:"preserve_host"`
-	Timeout            time.Duration     `yaml:"timeout"`
-	ResetDeadline      time.Duration     `yaml:"reset_deadline"`
-	FlushInterval      time.Duration     `yaml:"flush_interval"`
-	SkipRequestSigning bool              `yaml:"skip_request_signing"`
-	ProviderSlug       string            `yaml:"provider_slug"`
+	HeaderOverrides      map[string]string `yaml:"header_overrides"`
+	InjectRequestHeaders map[string]string `yaml:"inject_request_headers"`
+	SkipAuthRegex        []string          `yaml:"skip_auth_regex"`
+	AllowedGroups        []string          `yaml:"allowed_groups"`
+	TLSSkipVerify        bool              `yaml:"tls_skip_verify"`
+	PreserveHost         bool              `yaml:"preserve_host"`
+	Timeout              time.Duration     `yaml:"timeout"`
+	ResetDeadline        time.Duration     `yaml:"reset_deadline"`
+	FlushInterval        time.Duration     `yaml:"flush_interval"`
+	SkipRequestSigning   bool              `yaml:"skip_request_signing"`
+	ProviderSlug         string            `yaml:"provider_slug"`
 
 	// CookieName is still set globally, so we do not provide override behavior
 	CookieName string
@@ -398,6 +400,7 @@ func parseOptionsConfig(proxy *UpstreamConfig, defaultOpts *OptionsConfig) error
 	proxy.ResetDeadline = dst.ResetDeadline
 	proxy.FlushInterval = dst.FlushInterval
 	proxy.HeaderOverrides = dst.HeaderOverrides
+	proxy.InjectRequestHeaders = dst.InjectRequestHeaders
 	proxy.TLSSkipVerify = dst.TLSSkipVerify
 	proxy.PreserveHost = dst.PreserveHost
 	proxy.SkipRequestSigning = dst.SkipRequestSigning

internal/proxy/proxy_config_test.go

@@ -355,6 +355,39 @@ func TestUpstreamConfigHeaderOverrides(t *testing.T) {
 	}
 }
 
+func TestUpstreamConfigInjectRequestHeaders(t *testing.T) {
+	wantHeaders := map[string]string{
+		"Authorization": "Basic",
+	}
+	templateVars := map[string]string{
+		"cluster":     "sso",
+		"root_domain": "dev",
+	}
+	upstreamConfigs, err := loadServiceConfigs([]byte(`
+- service: foo
+  default:
+    from: foo.{{cluster}}.{{root_domain}}
+    to: foo-internal.{{cluster}}.{{root_domain}}
+    options:
+      inject_request_headers:
+        Authorization: Basic
+`), "sso", "http", templateVars, nil)
+	if err != nil {
+		t.Fatalf("expected to parse upstream configs: %s", err)
+	}
+
+	if len(upstreamConfigs) == 0 {
+		t.Fatalf("expected service config")
+	}
+
+	upstreamConfig := upstreamConfigs[0]
+	if !reflect.DeepEqual(upstreamConfig.InjectRequestHeaders, wantHeaders) {
+		t.Logf("want: %v", wantHeaders)
+		t.Logf(" got: %v", upstreamConfig.InjectRequestHeaders)
+		t.Errorf("got unexpected header overrides")
+	}
+}
+
 func TestUpstreamConfigErrorParsing(t *testing.T) {
 	testCases := []struct {
 		Name    string