Joshua Casey
28e22d7dd2
Update error text assertion due to change in ory/fosite
...
- db74aa7abd
2024-12-02 11:08:30 -06:00
Joshua Casey
9cfbbb541a
Standardize casing in Dockerfiles
2024-12-02 10:00:39 -06:00
Pinny
21bce1cb92
Bump dependencies
2024-12-02 14:10:28 +00:00
Joshua Casey
fe045343ee
Merge pull request #2009 from vmware-tanzu/audit_logging
...
CodeQL / Analyze (go) (push) Failing after 18m37s
CodeQL / Analyze (javascript) (push) Failing after 2m36s
Add audit logging for Supervisor and Concierge
2024-11-27 15:46:34 -06:00
Ryan Richard
df017f9267
attempt to fix a test flake seen sometimes in CI
2024-11-27 13:53:03 -06:00
Ryan Richard
ae5aad178d
TokenCredentialRequest uses actual cert expiry time instead of estimate
...
and also audit logs both the NotBefore and NotAfter of the issued cert.
Implemented by changing the return type of the cert issuer helpers
to make them also return the NotBefore and NotAfter values of the new
cert, along with the key PEM and cert PEM.
2024-11-27 13:53:03 -06:00
Ryan Richard
032160a85e
simplify single-node.yaml
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:03 -06:00
Ryan Richard
ecd23e86ce
callback endpoint renders more useful user-facing error messages
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:03 -06:00
Ryan Richard
51ae782135
fix typo in audit-logging.md
2024-11-27 13:53:03 -06:00
Ryan Richard
54b35c30da
rename tokenIdentifier to tokenID in the audit logs
...
Because `tokenID` is more consistent with the names of
the other correlation keys.
2024-11-27 13:53:03 -06:00
Ryan Richard
dfe04c5a58
update audit-logging.md to reflect changes in recent commits
2024-11-27 13:53:03 -06:00
Ryan Richard
4423d472da
allow audit correlation between token being issued and being used
2024-11-27 13:53:03 -06:00
Joshua Casey
c803a182be
Allow override of audit.log_usernames_and_groups for local debugging
2024-11-27 13:53:02 -06:00
Joshua Casey
bc73505e35
Easily enable kind audit logs with ENABLE_AUDIT_LOGGING=true ./hack/kind-up.sh
2024-11-27 13:53:02 -06:00
Joshua Casey
0a28c818ad
Small fixes for integration tests
2024-11-27 13:53:02 -06:00
Joshua Casey
ce2dcbdbb3
simplify godoc
2024-11-27 13:53:02 -06:00
Ryan Richard
1ebe2fcd1a
add integration test for personal info showing in login audit logs
2024-11-27 13:53:02 -06:00
Joshua Casey
c7e9ee1c61
Backfill unit tests for paramsSafeToLog
2024-11-27 13:53:02 -06:00
Joshua Casey
51c86795af
Backfill unit tests for cmd/pinniped/cmd/audit_id.go
2024-11-27 13:53:02 -06:00
Joshua Casey
8dffd60f0b
Backfill unit tests for audit logging from the CLI
2024-11-27 13:53:02 -06:00
Ryan Richard
6bf9b64778
log response audit-id for tokencredentialrequests made from CLI
...
Only logged when PINNIPED_DEBUG=true is used.
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:02 -06:00
Ryan Richard
26ec7fa346
prepare-supervisor-on-kind.sh takes new --api-group-suffix flag
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:02 -06:00
Joshua Casey
60bd118a9c
pinniped CLI should print the audit-ID in certain error cases
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-11-27 13:53:02 -06:00
Joshua Casey
b69507f7f3
Add generic audit integration test
2024-11-27 13:53:02 -06:00
Ryan Richard
7d59df0f86
update original audit logging proposal
2024-11-27 13:53:02 -06:00
Ryan Richard
9c0272382f
clean up audit logging documentation
2024-11-27 13:53:02 -06:00
Ryan Richard
2de8d9f0f3
cleanup example audit logs to make them prettier
2024-11-27 13:53:02 -06:00
Ryan Richard
d0905c02dd
use test helper in rest_test.go to reduce some duplication
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:02 -06:00
Ryan Richard
51fc86f950
don't audit log missing username or password, change query param value
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:02 -06:00
Ryan Richard
76bda12760
update audit-logging.md to resolve todos
2024-11-27 13:53:02 -06:00
Ryan Richard
a84b76e56a
audit log session ID in token handler for every grant type
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:02 -06:00
Ryan Richard
c2018717b6
audit log OIDCClientSecretRequests
2024-11-27 13:53:02 -06:00
Joshua Casey
f388513145
resolve TODO by adding docs
2024-11-27 13:53:02 -06:00
Ryan Richard
c16ebe1707
add unit test for audit logging when token refresh updates groups
2024-11-27 13:53:02 -06:00
Ryan Richard
b54365c199
audit log request params on GET and POST login handlers
2024-11-27 13:53:02 -06:00
Ryan Richard
51d1cc7a96
refactor and add unit test for AuditRequestParams()
2024-11-27 13:53:02 -06:00
Ryan Richard
c06141c871
token handler uses common method to audit HTTP request parameters
2024-11-27 13:53:02 -06:00
Ryan Richard
eab3fde3af
introduce common method to audit HTTP request parameters
2024-11-27 13:53:02 -06:00
Joshua Casey
de7781b7f9
Use correct caller when generating audit events
2024-11-27 13:53:02 -06:00
Joshua Casey
611de03e01
Add audit event 'Incorrect Username Or Password' to auth_handler and audit event 'Using Upstream IDP' to callback_handler
2024-11-27 13:53:01 -06:00
Joshua Casey
de722332b1
Add audit logging to post_login_handler
2024-11-27 13:53:01 -06:00
Ryan Richard
438ca437ec
tokencredentialrequest audit logs failed requests
2024-11-27 13:53:01 -06:00
Ryan Richard
e21e1326b7
tokencredentialrequest audit logs successful responses
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:01 -06:00
Joshua Casey
37e12b4024
Start backfilling some audit unit tests in post_login_handler
2024-11-27 13:53:01 -06:00
Ryan Richard
e126ee5495
all callers of Audit() identify which keys may contain PII
2024-11-27 13:53:01 -06:00
Ryan Richard
a308f3f22a
audit log: keep key ordering in personalInfo, render nil slices and maps
2024-11-27 13:53:01 -06:00
Ryan Richard
c5f4cce3ae
make Audit() take struct as param for all optional params and redact PII
2024-11-27 13:53:01 -06:00
Ryan Richard
ced8686d11
add config for audit logging, remove Audit() from Logger interface
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:01 -06:00
Joshua Casey
76f6b725b8
Fix some rebase conflicts
2024-11-27 13:53:01 -06:00
Joshua Casey
f9e1dd4bec
Backfill unit tests for garbage_collector audit logging
2024-11-27 13:53:01 -06:00
