With the validator abstraction work that was recently done we inadvertently started to run group validations for each authenticated request. See 'Notes' section for specific details.
This increased volume of requests increases the potential to cause extra strain on upstream providers
Solution
We don't need to validate the groups again here. This pull request brings us closer to previous functionality where we re-validate group membership after refreshing or validating the session, and re-validate email domains and addresses upon each request.
Notes
Now that the group membership check is an official 'validator' within sso-proxy it's ran each time we call RunValidators().
Problem
With the validator abstraction work that was recently done we inadvertently started to run group validations for each authenticated request. See 'Notes' section for specific details.
This increased volume of requests increases the potential to cause extra strain on upstream providers
Solution
We don't need to validate the groups again here. This pull request brings us closer to previous functionality where we re-validate group membership after refreshing or validating the session, and re-validate email domains and addresses upon each request.
Notes
Now that the group membership check is an official 'validator' within sso-proxy it's ran each time we call
RunValidators().The problematic call in question: https://github.com/buzzfeed/sso/blob/9019d4f79b453b50882213baa8549d40852daaf7/internal/proxy/oauthproxy.go#L784
Previously, we were only checking email address/domains here, with the group check being ran just above that when refreshing or validating the session: https://github.com/buzzfeed/sso/blob/9019d4f79b453b50882213baa8549d40852daaf7/internal/proxy/oauthproxy.go#L731 & https://github.com/buzzfeed/sso/blob/9019d4f79b453b50882213baa8549d40852daaf7/internal/proxy/oauthproxy.go#L762
An alternative solution to https://github.com/buzzfeed/sso/pull/266
Also included in this is a change to the group validator (it's no longer used as a pointer). Largely to bring it in line with the other validators.