Allow Redeem() to fail with a 403

Returning the typed error will return an Invalid Account error instead
of a 500.

oauthproxy.go

@@ -524,6 +524,11 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
 
 	session, err := p.redeemCode(req.Host, req.Form.Get("code"))
 	if err != nil {
+		if err == providers.ErrPermissionDenied {
+			log.Printf("%s Permission Denied: user is unauthorized when redeeming token", remoteAddr)
+			p.ErrorPage(rw, 403, "Permission Denied", "Invalid Account")
+			return
+		}
 		log.Printf("%s error redeeming code %s", remoteAddr, err)
 		p.ErrorPage(rw, 500, "Internal Error", "Internal Error")
 		return

providers/providers.go

@@ -1,6 +1,8 @@
 package providers
 
 import (
+	"errors"
+
 	"github.com/bitly/oauth2_proxy/cookie"
 )
 
@@ -16,6 +18,9 @@ type Provider interface {
 	CookieForSession(*SessionState, *cookie.Cipher) (string, error)
 }
 
+// ErrPermissionDenied may be returned from Redeem() to indicate the user is not allowed to login.
+var ErrPermissionDenied = errors.New("permission denied")
+
 func New(provider string, p *ProviderData) Provider {
 	switch provider {
 	case "myusa":