44509d016e
standardize import of "k8s.io/client-go/kubernetes/fake"
2025-12-22 10:34:53 -08:00
9d1c65c3e6
fix deprecation of NewSimpleClientset by using NewClientset or ignoring
2025-12-19 12:00:56 -08:00
f798777a3b
Refactor: reorder parameters to MergeConditions
2024-08-08 08:12:41 -05:00
6b49cd7d28
add Unknown SearchBaseFound status condition for AD only
2024-08-06 16:08:25 -07:00
afa3aa2232
LDAP and AD IDPs now always report condition with type LDAPConnectionValid, even if the status is unknown
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-06 16:08:25 -07:00
1c59a41cc5
Remove some dead code from LDAP/AD controllers
2024-08-06 16:08:25 -07:00
e0235ed190
update docs and change struct name in types_tls.go.tmpl files
...
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:21 -07:00
9f17ba5ae4
change wording of TLS config loaded success messages
2024-08-05 11:32:20 -07:00
81d42cb3b9
add unit tests for validatedsettings cache storing ca bundle hash
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
a888083c50
Introduce type alias CABundleHash for the hash of a CA bundle ([32]byte)
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
a1dcba4731
add unit tests for validatedsettings cache storing ca bundle hash
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
2a62beeb5f
store ca bundle hash in validated settings cache
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
242fa8afb2
When reading CA bundle from a secret/configmap, return more specific err
...
When the bundle does not contain any certs, make the error more
specific.
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
199562fd05
get all supervisor unit tests to pass
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
3a969a83b7
update supervisor controllers
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
080c75efe6
refactor tls spec validation into its own package
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
bafd578866
Merge branch 'main' into jtc/add-importas-linter
2024-06-11 09:39:48 -05:00
f323690049
refactor upstream refresh test helpers to be more specific to IDP type
2024-05-23 13:35:31 -07:00
bdd79a9984
Enforce more imports
...
- go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/fake
- go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/fake
- go.pinniped.dev/generated/latest/client/concierge/informers/externalversions
- go.pinniped.dev/generated/latest/client/supervisor/informers/externalversions
2024-05-21 09:31:15 -05:00
513f43f465
Enforce more imports
...
- go.pinniped.dev/generated/latest/apis/concierge/config/v1alpha1
- go.pinniped.dev/generated/latest/client/concierge/clientset/versioned
- go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/scheme
- go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned
- go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/scheme
2024-05-21 09:31:15 -05:00
f5116cddb4
Enable 'makezero' and 'prealloc' linters, and require 'any' instead of 'interface{}'
...
Enforce importas:
- go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
- go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
2024-05-21 09:31:15 -05:00
e9252a9ee3
Enforce more imports
...
- k8s.io/apimachinery/pkg/apis/meta/v1
- k8s.io/api/core/v1
- github.com/coreos/go-oidc/v3/oidc
- github.com/ory/fosite/handler/oauth2
- go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1
2024-05-21 09:31:15 -05:00
791b785dea
Merge branch 'main' into jtc/merge-main-at-d7849c79-to-github
2024-05-10 14:22:09 -05:00
7b36c8ab54
Enable 'copyloopvar' linter
2024-05-10 12:51:02 -05:00
c9b61ef010
Populate internal GitHub IDP Config from CRD
2024-04-16 14:33:01 -05:00
bc8aebeffe
Use go.uber.org/mock instead of github.com/golang/mock and rerun mock generation
2024-03-11 13:42:30 -05:00
b68e7f3e9e
Lightly standardize import aliases
2023-11-15 13:52:17 -06:00
b6f0dc3ba7
Fix conflicts caused from rebasing main into multiple IDPs branch
2023-09-11 11:15:40 -07:00
86c791b8a6
reorganize federation domain packages to be more intuitive
...
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2023-09-11 11:11:52 -07:00
7af75dfe3c
First draft of implementation of multiple IDPs support
2023-09-11 11:09:49 -07:00
64f1bff13f
Use Conditions from apimachinery, specifically k8s.io/apimachinery/pkg/apis/meta/v1.Conditions
2023-09-11 10:13:39 -07:00
cd91edf26c
[LDAP] move attributeUnchangedSinceLogin from upstreamldap to activedirectoryupstreamwatcher
2023-09-06 14:52:01 -05:00
8fd55a1d81
Adjust test expectations for compilation differences with 1.21
...
- Requires some production code changes, to use pointers to function variables instead of pointers to functions
2023-09-06 14:52:01 -05:00
600d002a35
Use groupSearch.userAttributeForFilter during ActiveDirectory group searches
...
- Load the setting in the controller.
- The LDAP auth code is shared between AD and LDAP,
so no new changes there in this commit.
2023-05-31 11:17:40 -07:00
c187474499
Use groupSearch.userAttributeForFilter during LDAP group searches
...
Load the setting in the controller.
Use the setting during authentication and during refreshes.
2023-05-25 14:25:17 -07:00
a010e72b29
Merge branch 'dynamic_clients' into require-groups-scope
2022-06-22 14:27:06 -07:00
c70a0b99a8
Don't do ldap group search when group scope not specified
...
Signed-off-by: Margo Crawford <margaretc@vmware.com >
2022-06-22 10:58:08 -07:00
5aa0d91267
New controller watches OIDCClients and updates validation Conditions
2022-06-17 13:11:26 -04:00
0674215ef3
Switch to go.uber.org/zap for JSON formatted logging
...
Signed-off-by: Monis Khan <mok@vmware.com >
2022-05-24 11:17:42 -04:00
fdac4d16f0
Only run group refresh when the skipGroupRefresh boolean isn't set
...
for AD and LDAP
2022-02-17 12:50:28 -08:00
092a80f849
Refactor some variable names and update one comment
...
Change variable names to match previously renamed interface name.
2022-01-14 10:06:00 -08:00
7f99d78462
Fix bug where LDAP or AD status conditions were not updated correctly
...
When the LDAP and AD IDP watcher controllers encountered an update error
while trying to update the status conditions of the IDP resources, then
they would drop the computed desired new value of the condition on the
ground. Next time the controller ran it would not try to update the
condition again because it wants to use the cached settings and had
already forgotten the desired new value of the condition computed during
the previous run of the controller. This would leave the outdated value
of the condition on the IDP resource.
This bug would manifest in CI as random failures in which the expected
condition message and the actual condition message would refer to
different versions numbers of the bind secret. The actual condition
message would refer to an older version of the bind secret because the
update failed and then the new desired message got dropped on the
ground.
This commit changes the in-memory caching strategy to also cache the
computed condition messages, allowing the conditions to be updated
on the IDP resource during future calls to Sync() in the case of a
failed update.
2022-01-07 17:19:13 -08:00
c155c6e629
Clean up nits in AD code
...
- Make everything private
- Drop unused AuthTime field
- Use %q format string instead of "%s"
- Only rely on GetRawAttributeValues in AttributeUnchangedSinceLogin
Signed-off-by: Monis Khan <mok@vmware.com >
2021-12-17 08:53:44 -05:00
59d999956c
Move ad specific stuff to controller
...
also make extra refresh attributes a separate field rather than part of
Extra
Signed-off-by: Margo Crawford <margaretc@vmware.com >
2021-12-09 16:16:36 -08:00
acaad05341
Make pwdLastSet stuff more generic and not require parsing the timestamp
...
Signed-off-by: Margo Crawford <margaretc@vmware.com >
2021-12-09 16:16:36 -08:00
ee4f725209
Incorporate PR feedback
2021-12-09 16:16:36 -08:00
ef5a04c7ce
Check for locked users on ad upstream refresh
...
Signed-off-by: Margo Crawford <margaretc@vmware.com >
2021-12-09 16:16:36 -08:00
f62e9a2d33
Active directory checks for deactivated user
...
Signed-off-by: Margo Crawford <margaretc@vmware.com >
2021-12-09 16:16:36 -08:00
da9b4620b3
Active Directory checks whether password has changed recently during
...
upstream refresh
Signed-off-by: Margo Crawford <margaretc@vmware.com >
2021-12-09 16:16:35 -08:00
1bd346cbeb
Require refresh tokens for upstream OIDC and save more session data
...
- Requiring refresh tokens to be returned from upstream OIDC idps
- Storing refresh tokens (for oidc) and idp information (for all idps) in custom session data during authentication
- Don't pass access=offline all the time
2021-10-08 15:48:21 -07:00
Ryan Richard
Joshua Casey
Ashish Amarnath
Margo Crawford
Monis Khan