Ryan Richard
6b49cd7d28
add Unknown SearchBaseFound status condition for AD only
2024-08-06 16:08:25 -07:00
Joshua Casey and Ryan Richard
afa3aa2232
LDAP and AD IDPs now always report condition with type LDAPConnectionValid, even if the status is unknown
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-06 16:08:25 -07:00
Joshua Casey and Ryan Richard
1c59a41cc5
Remove some dead code from LDAP/AD controllers
2024-08-06 16:08:25 -07:00
a888083c50
Introduce type alias CABundleHash for the hash of a CA bundle ([32]byte)
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
fcceeed9fa
Refactor tlsconfigutil.CABundle 'getters' to not have 'get' in the name
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Ashish Amarnath and Ryan Richard
005dbf3aa8
refactor tlsconfigutil to return a caBundle type
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ashish Amarnath and Ryan Richard
2a62beeb5f
store ca bundle hash in validated settings cache
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
6e9023e090
add code review todos and light refactoring
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
199562fd05
get all supervisor unit tests to pass
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
aab1ee9edc
unify TLS Spec between supervisor and concierge
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
080c75efe6
refactor tls spec validation into its own package
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Joshua Casey
f5116cddb4
Enable 'makezero' and 'prealloc' linters, and require 'any' instead of 'interface{}'
...
Enforce importas:
- go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
- go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
2024-05-21 09:31:15 -05:00
Ryan Richard and Benjamin A. Petersen
86c791b8a6
reorganize federation domain packages to be more intuitive
...
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2023-09-11 11:11:52 -07:00
Ryan Richard
7af75dfe3c
First draft of implementation of multiple IDPs support
2023-09-11 11:09:49 -07:00
Joshua Casey and Ryan Richard
64f1bff13f
Use Conditions from apimachinery, specifically k8s.io/apimachinery/pkg/apis/meta/v1.Conditions
2023-09-11 10:13:39 -07:00
Ryan Richard
c187474499
Use groupSearch.userAttributeForFilter during LDAP group searches
...
Load the setting in the controller.
Use the setting during authentication and during refreshes.
2023-05-25 14:25:17 -07:00
Ryan Richard
092a80f849
Refactor some variable names and update one comment
...
Change variable names to match previously renamed interface name.
2022-01-14 10:06:00 -08:00
Ryan Richard
7f99d78462
Fix bug where LDAP or AD status conditions were not updated correctly
...
When the LDAP and AD IDP watcher controllers encountered an update error
while trying to update the status conditions of the IDP resources, then
they would drop the computed desired new value of the condition on the
ground. Next time the controller ran it would not try to update the
condition again because it wants to use the cached settings and had
already forgotten the desired new value of the condition computed during
the previous run of the controller. This would leave the outdated value
of the condition on the IDP resource.
This bug would manifest in CI as random failures in which the expected
condition message and the actual condition message would refer to
different versions numbers of the bind secret. The actual condition
message would refer to an older version of the bind secret because the
update failed and then the new desired message got dropped on the
ground.
This commit changes the in-memory caching strategy to also cache the
computed condition messages, allowing the conditions to be updated
on the IDP resource during future calls to Sync() in the case of a
failed update.
2022-01-07 17:19:13 -08:00
Margo Crawford
0a1ee9e37c
Remove unused functions
2021-09-08 10:34:42 -07:00
Margo Crawford
05f5bac405
ValidatedSettings is all or nothing
...
If either the search base or the tls settings is invalid, just
recheck everything.
2021-09-07 13:09:35 -07:00
Margo Crawford
27c1d2144a
Make sure search base in the validatedSettings cache is properly updated when the bind secret changes
2021-09-07 13:09:35 -07:00
Margo Crawford
6f221678df
Change sAMAccountName env vars to userPrincipalName
...
and add E2E ActiveDirectory test
also fixed regexes in supervisor_login_test to be anchored to the
beginning and end
2021-08-26 16:18:05 -07:00
Margo Crawford
cc3875f048
PR feedback
2021-07-26 16:03:12 -07:00
Margo Crawford
cb0ee07b51
Fetch AD search base from defaultNamingContext when not specified
2021-07-23 13:01:41 -07:00
Margo Crawford
5d8d7246c2
Refactor active directory and ldap controllers to share almost everything
...
Signed-off-by: Ryan Richard <richardry@vmware.com >
2021-07-23 13:01:41 -07:00
Ryan Richard
1ae3c6a1ad
Split package upstreamwatchers into four packages
2021-05-12 14:00:39 -07:00
Ryan Richard
Joshua CaseyandRyan Richard
Margo Crawford