mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-24 17:12:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
2,582 Commits 31 Branches 54 Tags
548977f5797df4d006159670fe9871f9bc051069
Commit Graph
2582 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ryan Richard 548977f579 Update group memberships during refresh for upstream OIDC providers 
Update the user's group memberships when possible. Note that we won't
always have enough information to be able to update it (see code
comments).
 2022-01-14 16:38:21 -08:00
Margo CrawfordandGitHub 50e4871d65 Merge pull request #944 from vmware-tanzu/refresh-with-no-refresh-token 
Access Token based OIDC refresh by checking the UserInfo endpoint
 2022-01-14 10:23:41 -08:00
Margo Crawford 5b161be334 Refactored oidcUpstreamRefresh 
Various style changes, updated some comments and variable names and
extracted a helper function for validation.
 2022-01-12 18:05:22 -08:00
Margo Crawford 62be761ef1 Perform access token based refresh by fetching the userinfo 2022-01-12 18:05:10 -08:00
Ryan RichardandMargo Crawford 651d392b00 Refuse logins when no upstream refresh token and no userinfo endpoint 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-01-12 18:03:25 -08:00
Margo Crawford 6f3977de9d Store access token when refresh not available for authcode flow. 
Also refactor oidc downstreamsessiondata code to be shared between
callback handler and auth handler.

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2022-01-12 18:03:25 -08:00
Ryan RichardandMargo Crawford 91924ec685 Revert adding allowAccessTokenBasedRefresh flag to OIDCIdentityProvider 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-01-12 18:03:25 -08:00
Margo Crawford 683a2c5b23 WIP adding access token to storage upon login 2022-01-12 18:03:25 -08:00
Ryan RichardandMargo Crawford 1f146f905a Add struct field for storing upstream access token in downstream session 2022-01-12 18:03:25 -08:00
Mo KhanandGitHub 82f54b5556 Merge pull request #917 from vmware-tanzu/oidc-refresh-user-info-checks 
OIDC refresh user info checks
 2022-01-12 20:27:00 -05:00
Margo Crawford 2b744b2eef Add back comment about deferring validation when id token subject is missing 2022-01-12 11:19:43 -08:00
Margo Crawford 2958461970 Addressing PR feedback 
store issuer and subject in storage for refresh
Clean up some constants

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-01-10 11:03:37 -08:00
Margo Crawford f2d2144932 rename ValidateToken to ValidateTokenAndMergeWithUserInfo to better reflect what it's doing 
Also changed a few comments and small things
 2022-01-10 11:03:37 -08:00
Margo Crawford c9cf13a01f Check for issuer if available 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-01-10 11:03:37 -08:00
Margo Crawford 0cd086cf9c Check username claim is unchanged for oidc. 
Also add integration tests for claims changing.
 2022-01-10 11:03:37 -08:00
Margo Crawford b098435290 Refactor validatetoken to handle refresh case without id token 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-01-10 11:03:37 -08:00
Margo Crawford 74b007ff66 Validate that issuer url and urls returned from discovery are https 
and that they have no query or fragment

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2022-01-10 11:03:37 -08:00
Margo Crawford ed96b597c7 Check for subject matching with upstream refresh 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-01-10 11:03:37 -08:00
Mo KhanandGitHub d438bfbc99 Merge pull request #939 from vmware-tanzu/dependabot/go_modules/github.com/ory/x-0.0.331 
Bump github.com/ory/x from 0.0.330 to 0.0.331
 2022-01-09 12:04:56 -05:00
dependabot[bot]andGitHub a7ff638f4c Bump github.com/ory/x from 0.0.330 to 0.0.331 
Bumps [github.com/ory/x](https://github.com/ory/x) from 0.0.330 to 0.0.331.
- [Release notes](https://github.com/ory/x/releases)
- [Commits](https://github.com/ory/x/compare/v0.0.330...v0.0.331)

---
updated-dependencies:
- dependency-name: github.com/ory/x
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-01-07 13:45:37 +00:00
Mo KhanandGitHub 287d5094ec Merge pull request #938 from vmware-tanzu/dependabot/docker/golang-1.17.6 
Bump golang from 1.17.5 to 1.17.6
 2022-01-07 08:13:16 -05:00
dependabot[bot]andGitHub f2b4d667d1 Bump golang from 1.17.5 to 1.17.6 
Bumps golang from 1.17.5 to 1.17.6.

---
updated-dependencies:
- dependency-name: golang
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-01-07 01:04:10 +00:00
Mo KhanandGitHub fff27a4270 Merge pull request #935 from enj/enj/i/bump_0001 
Bump all deps to latest
 2022-01-03 19:48:08 -05:00
Monis Khan f90f173826 Bump all deps to latest 
Ran:

go get -u ./... && go mod tidy

Pinned all go.opentelemetry.io deps to match k/k.
This is needed to make the go get command work.

Signed-off-by: Monis Khan <mok@vmware.com>
 2022-01-03 17:48:59 -05:00
Mo KhanandGitHub cc88d2a334 Merge pull request #931 from vmware-tanzu/dependabot/docker/distroless/static-80c956f 
Bump distroless/static from `bca3c20` to `80c956f`
 2022-01-03 10:49:08 -05:00
dependabot[bot]andGitHub a0ddf4a945 Bump distroless/static from bca3c20 to 80c956f 
Bumps distroless/static from `bca3c20` to `80c956f`.

---
updated-dependencies:
- dependency-name: distroless/static
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-12-27 01:17:24 +00:00
Mo KhanandGitHub 05277a5579 Merge pull request #925 from enj/enj/i/flexible_cli_redirect 
pinniped CLI: allow all forms of http redirects
 2021-12-17 15:51:44 -05:00
Monis Khan c155c6e629 Clean up nits in AD code 
- Make everything private
- Drop unused AuthTime field
- Use %q format string instead of "%s"
- Only rely on GetRawAttributeValues in AttributeUnchangedSinceLogin

Signed-off-by: Monis Khan <mok@vmware.com>
 2021-12-17 08:53:44 -05:00
Monis Khan a6085c9678 Drop unsafe unwrapper for exec.roundTripper 
exec.roundTripper now implements utilnet.RoundTripperWrapper so this
unsafe hack is no longer needed.

Signed-off-by: Monis Khan <mok@vmware.com>
 2021-12-17 08:28:30 -05:00
Monis Khan 86f2bea8c5 pinniped CLI: allow all forms of http redirects 
For password based login on the CLI (i.e. no browser), this change
relaxes the response code check to allow for any redirect code
handled by the Go standard library.  In the future, we can drop the
rewriteStatusSeeOtherToStatusFoundForBrowserless logic from the
server side code.

Signed-off-by: Monis Khan <mok@vmware.com>
 2021-12-17 08:28:29 -05:00
Mo KhanandGitHub adf04d29f7 Merge pull request #914 from enj/enj/i/bump_0.23.0 
Update all deps to latest where possible, bump Kube deps to v0.23.1
 2021-12-16 21:45:32 -05:00
Monis Khan 9599ffcfb9 Update all deps to latest where possible, bump Kube deps to v0.23.1 
Highlights from this dep bump:

1. Made a copy of the v0.4.0 github.com/go-logr/stdr implementation
   for use in tests.  We must bump this dep as Kube code uses a
   newer version now.  We would have to rewrite hundreds of test log
   assertions without this copy.
2. Use github.com/felixge/httpsnoop to undo the changes made by
   ory/fosite#636 for CLI based login flows.  This is required for
   backwards compatibility with older versions of our CLI.  A
   separate change after this will update the CLI to be more
   flexible (it is purposefully not part of this change to confirm
   that we did not break anything).  For all browser login flows, we
   now redirect using http.StatusSeeOther instead of http.StatusFound.
3. Drop plog.RemoveKlogGlobalFlags as klog no longer mutates global
   process flags
4. Only bump github.com/ory/x to v0.0.297 instead of the latest
   v0.0.321 because v0.0.298+ pulls in a newer version of
   go.opentelemetry.io/otel/semconv which breaks k8s.io/apiserver.
   We should update k8s.io/apiserver to use the newer code.
5. Migrate all code from k8s.io/apimachinery/pkg/util/clock to
   k8s.io/utils/clock and k8s.io/utils/clock/testing
6. Delete testutil.NewDeleteOptionsRecorder and migrate to the new
   kubetesting.NewDeleteActionWithOptions
7. Updated ExpectedAuthorizeCodeSessionJSONFromFuzzing caused by
   fosite's new rotated_secrets OAuth client field.  This new field
   is currently not relevant to us as we have no private clients.

Signed-off-by: Monis Khan <mok@vmware.com>
 2021-12-16 21:15:27 -05:00
Mo KhanandGitHub 69d5951296 Merge pull request #919 from microwavables/updating-community-details 
Updated community and resources pages
 2021-12-16 17:14:21 -05:00
Mo KhanandGitHub b148359337 Merge pull request #918 from vmware-tanzu/replace_reflections 
Replace reflections in go.mod
 2021-12-16 17:10:28 -05:00
Nanci Lancaster e31a410096 Updated community and resources pages 2021-12-16 16:02:47 -06:00
Ryan Richard 6bf67f44ef replace reflections in go.mod 2021-12-16 11:15:24 -08:00
Mo KhanandGitHub fdc91ec56c Merge pull request #909 from vmware-tanzu/dependabot/docker/golang-1.17.5 
Bump golang from 1.17.4 to 1.17.5
 2021-12-10 12:41:02 -05:00
dependabot[bot]andGitHub 884d18bade Bump golang from 1.17.4 to 1.17.5 
Bumps golang from 1.17.4 to 1.17.5.

---
updated-dependencies:
- dependency-name: golang
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-12-10 17:03:50 +00:00
Mo KhanandGitHub ca2ee26c86 Merge pull request #884 from vmware-tanzu/upstream-ad-refresh 
Upstream active directory refresh checks for password changes, deactivated and locked users
 2021-12-09 20:51:46 -05:00
Margo Crawford 59d999956c Move ad specific stuff to controller 
also make extra refresh attributes a separate field rather than part of
Extra

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-12-09 16:16:36 -08:00
Margo Crawford acaad05341 Make pwdLastSet stuff more generic and not require parsing the timestamp 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-12-09 16:16:36 -08:00
Margo Crawford 65f3464995 Fix issue with very high integer value parsing, add unit tests 
also add comment about urgent replication
 2021-12-09 16:16:36 -08:00
Margo Crawford ee4f725209 Incorporate PR feedback 2021-12-09 16:16:36 -08:00
Margo Crawford ef5a04c7ce Check for locked users on ad upstream refresh 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-12-09 16:16:36 -08:00
Margo Crawford f62e9a2d33 Active directory checks for deactivated user 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-12-09 16:16:36 -08:00
Margo Crawford da9b4620b3 Active Directory checks whether password has changed recently during 
upstream refresh

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2021-12-09 16:16:35 -08:00
Margo Crawford 8db0203839 Add test for upstream ldap idp not found, wrong idp uid, and malformed 
fosite session storage
 2021-12-09 16:16:35 -08:00
anjalitelangandGitHub 4110297a8f Update ROADMAP.md 
Updated roadmap to reflect current velocity
 2021-12-09 16:59:09 -05:00
Mo KhanandGitHub 7a3b5e3571 Merge pull request #908 from vmware-tanzu/microwavables-main 
Added GOVERNANCE.md file to repo
 2021-12-08 14:38:21 -05:00
Nanci LancasterandMonis Khan 505bc47ae1 Added GOVERNANCE.md file to repo 
Signed-off-by: Nanci Lancaster <nancil@vmware.com>
 2021-12-08 14:29:16 -05:00