Joshua Casey
bf1c02d328
jwtauthenticator controller redoes validations when external CA bundle changes
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:19 -07:00
Ryan Richard
0380a9ce33
upgrade github.com/go-jose/go-jose and github.com/coreos/go-oidc
...
Also standardize some related imports and fix some whitespace in a test
2024-06-21 11:16:40 -07:00
Joshua Casey
678be9902a
Lint new files from the GitHub branch
2024-06-11 10:16:18 -05:00
Joshua Casey
bafd578866
Merge branch 'main' into jtc/add-importas-linter
2024-06-11 09:39:48 -05:00
Joshua Casey
58b4ecc0aa
user sees error msg when GitHub login is denied due to allowed orgs
...
Also renamed an interface function from GetName to GetResourceName.
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-06-03 10:56:28 -07:00
Joshua Casey
d3fb567fdb
Add callback_handler tests for GitHub+IdentityTransformations
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-05-28 15:59:52 -05:00
Ryan Richard
f323690049
refactor upstream refresh test helpers to be more specific to IDP type
2024-05-23 13:35:31 -07:00
Joshua Casey
65682aa60d
Add sample unit test for GitHub in token_handler_test.go
2024-05-22 23:04:15 -05:00
Ryan Richard
8f8db3f542
Make github org comparison case-insensitive, but return original case
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-05-22 21:21:45 -05:00
Ryan Richard
8923704f3c
Finish initial github login flow
...
Also:
- fix github teams query: fix bug and sort/unique the results
- add IDP display name to github downstream subject
- fix error types returned by LoginFromCallback
- add trace logs to github API results
- update e2e test
- implement placeholder version of refresh for github
2024-05-22 21:21:45 -05:00
Ryan Richard
49c468f00a
Add GetUser() interface and implement LoginFromCallback() for GitHub
...
ALso fixed some of the GitHub test helpers
2024-05-22 21:21:45 -05:00
Joshua Casey
b7f79f0adc
Add github-specific tests in callback_handler_github_test.go
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-05-22 21:21:45 -05:00
Joshua Casey
fe911a7b7a
Prefer slices package and slices.Concat where possible
2024-05-21 09:31:16 -05:00
Joshua Casey
513f43f465
Enforce more imports
...
- go.pinniped.dev/generated/latest/apis/concierge/config/v1alpha1
- go.pinniped.dev/generated/latest/client/concierge/clientset/versioned
- go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/scheme
- go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned
- go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/scheme
2024-05-21 09:31:15 -05:00
Joshua Casey
f5116cddb4
Enable 'makezero' and 'prealloc' linters, and require 'any' instead of 'interface{}'
...
Enforce importas:
- go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
- go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
2024-05-21 09:31:15 -05:00
Joshua Casey
e9252a9ee3
Enforce more imports
...
- k8s.io/apimachinery/pkg/apis/meta/v1
- k8s.io/api/core/v1
- github.com/coreos/go-oidc/v3/oidc
- github.com/ory/fosite/handler/oauth2
- go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1
2024-05-21 09:31:15 -05:00
Joshua Casey
875b0739aa
Enforce aliases for 'k8s.io/apimachinery/pkg/util/errors' and 'k8s.io/apimachinery/pkg/api/errors'
2024-05-21 09:31:15 -05:00
Joshua Casey
f43b6f04dc
Fix lint issues from golangci-lint 1.58.1
2024-05-10 15:15:59 -05:00
Joshua Casey
791b785dea
Merge branch 'main' into jtc/merge-main-at-d7849c79-to-github
2024-05-10 14:22:09 -05:00
Joshua Casey
81f3acfa38
Update some build tags since go1.22+ is now required
2024-05-10 12:51:03 -05:00
Ryan Richard
0cdbb710d2
add test for github redirect in auth_handler_test.go
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-05-09 15:35:37 -07:00
Joshua Casey
75f024cb19
Fix lint
2024-05-09 15:35:37 -07:00
Joshua Casey
32e4e0d835
Add TestGenerateOTPCode
2024-05-09 15:35:37 -07:00
Ryan Richard
7c85a511a2
first draft of an e2e integration test for GitHub login (skip while WIP)
2024-05-09 15:35:37 -07:00
Ryan Richard
7277d00e1a
refactor upstreamgithub.ProviderConfig to hold more config
2024-05-09 15:35:37 -07:00
Ryan Richard
afb032f8f9
Merge branch 'main' into github_identity_provider
2024-05-07 13:08:50 -07:00
Ryan Richard
0a63dd104d
fix test failures caused by dep bump and update replace statements
2024-05-01 11:01:13 -07:00
Benjamin A. Petersen
c43193a0c8
Merge branch 'main' into github_identity_provider
2024-05-01 12:15:08 -04:00
Benjamin A. Petersen
cd86d57763
review cleanup, remove TODOs
2024-04-25 17:02:07 -04:00
Benjamin A. Petersen
42ef46b74e
expand TestUpstreamGitHubIdentityProvider
2024-04-25 17:02:07 -04:00
Benjamin A. Petersen
0e3641bba2
Fix test idp lister
2024-04-25 17:02:06 -04:00
Benjamin A. Petersen
44edba6f75
Add tests for Github in FederationDomain ListerFinder
2024-04-25 17:01:57 -04:00
Ryan Richard
a1efcefdce
Unit tests for token endpoint for custom ID token lifetimes
2024-04-24 14:13:41 -07:00
Joshua Casey
fe5d037600
Merge branch 'main' into jtc/merge-main-5fe94c4e-into-github
2024-04-23 12:42:07 -05:00
Ryan Richard
0ef98f0558
Use new helpers to assert that all webhook dials use ptls settings
2024-04-19 11:15:59 -07:00
Joshua Casey
94bee9e882
Remove testutil.TLSTestServerWithCert in favor of the testutil/tlsserver package
2024-04-19 10:30:23 -05:00
Joshua Casey
da135d9958
Webhookcachefiller now uses a real tls.Dial, which means we can test IPv6
2024-04-19 09:24:17 -05:00
Joshua Casey
c9b61ef010
Populate internal GitHub IDP Config from CRD
2024-04-16 14:33:01 -05:00
Benjamin A. Petersen
e2db152c6c
Stub in TestUpstreamGithubIdentityProvider for unit tests
2024-04-02 13:59:11 -04:00
Benjamin A. Petersen
c6b0820438
Fix some utils, spacing, func naming, test inputs, etc.
2024-03-26 16:22:51 -04:00
Benjamin A. Petersen
0467e5c1d5
Refactor logLines to SplitByNewline, deduplicate
2024-03-19 16:48:06 -04:00
Benjamin A. Petersen
337459feb0
Update webhook status integration tests
...
- total api fields test 260->261
2024-03-19 16:48:05 -04:00
Benjamin A. Petersen
590e2d18f7
Add WebhookAuthenticator integration tests, expand unit tests
...
- Add WebhookAuthenticator unit tests, update generated code
- Add validateTLSNegotiation(), update tests
- Update validateTLSNegotiation, add unit tests, factor out helpers
- Update generated code
2024-03-19 16:48:05 -04:00
Joshua Casey
ffc49d96b3
Integration tests should use a valid value for CredentialIssuer spec.impersonationProxy.service.type
2024-03-08 11:19:15 -06:00
Joshua Casey
ab0682917a
whoami integration test now allows for additional extra fields in K8s 1.30+
2024-03-07 08:09:16 -06:00
Benjamin A. Petersen
42acf8dcce
Add Status & tests for jwks key fetching
2024-02-27 15:45:32 -08:00
Benjamin A. Petersen
47639340ec
extract status comparison test helpers
2024-02-27 15:45:32 -08:00
Ryan Richard
0d31e955ae
Don't skip upstream group memberships when groups scope is not granted
...
Background: For dynamic clients, the groups scope is not always allowed
and/or requested by the client, so it will not always be granted by the
Supervisor for an authorization request.
Previously, when the groups scope was not granted, we would skip
searching for upstream groups in some scenarios.
This commit changes the behavior of authorization flows so that even
when the groups scope is not granted we still search for the upstream
group memberships as configured, and we pass the upstream group
memberships into any configured identity transformations. The identity
transformations could potentially reject the user's authentication based
on their upstream group membership.
When the groups scope is not granted, we don't include the groups in
the final Supervisor-issued ID token. This behavior is not changed.
2024-02-21 13:12:18 -08:00
Ryan Richard
1bc13e94f7
Refactor to extract interface for upstream IDP interactions
...
Create an interface to abstract the upstream IDP from the
authorize, IDP discovery, callback, choose IDP, and login
endpoints. This commit does not refactor the token endpoint,
which will be refactored in a similar way in the next commit.
2024-02-20 09:26:34 -08:00
Ryan Richard
9db87132b1
More refactoring of auth handler and related refactor of upstreamldap
...
- continued refactoring the auth handler to share more code between
the two supported browserless flows: OIDC and LDAP/AD
- the upstreamldap package should not know about the concept of
OIDC granted scopes, so refactored it to be a skipGroups bool
2024-02-20 09:26:34 -08:00
