Ryan Richard
44509d016e
standardize import of "k8s.io/client-go/kubernetes/fake"
2025-12-22 10:34:53 -08:00
Ryan Richard
9d1c65c3e6
fix deprecation of NewSimpleClientset by using NewClientset or ignoring
2025-12-19 12:00:56 -08:00
Ryan Richard
749633e43c
support response_mode=form_post in upstream OIDC IDPs
2025-03-06 15:28:47 -08:00
Joshua Casey
87640ca54a
Callback endpoint emits audit log with authorizeID even when code param not found
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-12-09 12:47:54 -06:00
Ryan Richard
ecd23e86ce
callback endpoint renders more useful user-facing error messages
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:03 -06:00
Joshua Casey
c7e9ee1c61
Backfill unit tests for paramsSafeToLog
2024-11-27 13:53:02 -06:00
Ryan Richard
51d1cc7a96
refactor and add unit test for AuditRequestParams()
2024-11-27 13:53:02 -06:00
Ryan Richard
c06141c871
token handler uses common method to audit HTTP request parameters
2024-11-27 13:53:02 -06:00
Ryan Richard
eab3fde3af
introduce common method to audit HTTP request parameters
2024-11-27 13:53:02 -06:00
Joshua Casey
611de03e01
Add audit event 'Incorrect Username Or Password' to auth_handler and audit event 'Using Upstream IDP' to callback_handler
2024-11-27 13:53:01 -06:00
Joshua Casey
de722332b1
Add audit logging to post_login_handler
2024-11-27 13:53:01 -06:00
Ryan Richard
e126ee5495
all callers of Audit() identify which keys may contain PII
2024-11-27 13:53:01 -06:00
Ryan Richard
c5f4cce3ae
make Audit() take struct as param for all optional params and redact PII
2024-11-27 13:53:01 -06:00
Ryan Richard
ced8686d11
add config for audit logging, remove Audit() from Logger interface
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:01 -06:00
Ryan Richard
8cf9c59957
refactor to move audit event message types to their own pkg
2024-11-27 13:53:01 -06:00
Joshua Casey
dc6faa33bb
Log params to token_handler endpoint even during error cases
2024-11-27 13:53:01 -06:00
Ryan Richard
1006dd9379
resolve some todos
2024-11-27 13:53:01 -06:00
Joshua Casey
09ca7920ea
Extract testutil helper function
2024-11-27 13:53:00 -06:00
Joshua Casey
dd56f2b47f
Add audit event tests for callback_handler
2024-11-27 13:53:00 -06:00
Joshua Casey
44e218194b
Add 'AuthorizeID From Parameters' audit logs to the /callback and /login endpoints
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-11-27 13:53:00 -06:00
Joshua Casey
aee56c388f
Check the sessionID as well
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-11-27 13:53:00 -06:00
Ryan Richard
4f9530eec7
audit logging WIP
2024-11-27 13:53:00 -06:00
Ryan Richard
f194594e5b
failed token exchanges should show in log at default log config
2024-08-22 10:09:19 -07:00
Joshua Casey
678be9902a
Lint new files from the GitHub branch
2024-06-11 10:16:18 -05:00
Joshua Casey
bafd578866
Merge branch 'main' into jtc/add-importas-linter
2024-06-11 09:39:48 -05:00
Joshua Casey
58b4ecc0aa
user sees error msg when GitHub login is denied due to allowed orgs
...
Also renamed an interface function from GetName to GetResourceName.
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-06-03 10:56:28 -07:00
Joshua Casey
cc8d637715
Fix lint
2024-05-28 20:33:55 -05:00
Joshua Casey
d3fb567fdb
Add callback_handler tests for GitHub+IdentityTransformations
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-05-28 15:59:52 -05:00
Joshua Casey
8b1e5aa320
Add callback_handler tests to confirm GitHub with downstream form_post and GitHub with an error case
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-05-28 15:17:04 -05:00
Joshua Casey
37e654faa0
bunch of renames
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-05-28 13:41:52 -05:00
Ryan Richard
0a15d488c8
Merge callback_handler_github_test.go into callback_handler_test.go
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-05-22 21:21:45 -05:00
Ryan Richard
49c468f00a
Add GetUser() interface and implement LoginFromCallback() for GitHub
...
ALso fixed some of the GitHub test helpers
2024-05-22 21:21:45 -05:00
Joshua Casey
b7f79f0adc
Add github-specific tests in callback_handler_github_test.go
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-05-22 21:21:45 -05:00
Joshua Casey
f5116cddb4
Enable 'makezero' and 'prealloc' linters, and require 'any' instead of 'interface{}'
...
Enforce importas:
- go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
- go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
2024-05-21 09:31:15 -05:00
Joshua Casey
7b36c8ab54
Enable 'copyloopvar' linter
2024-05-10 12:51:02 -05:00
Ryan Richard
a1efcefdce
Unit tests for token endpoint for custom ID token lifetimes
2024-04-24 14:13:41 -07:00
Ryan Richard
4b4a4ad592
Rename a func and collapse applying id transforms into creating session
2024-02-20 14:47:28 -08:00
Ryan Richard
b341e52214
Refactor to move invocation of identity transforms out of IDP interfaces
...
Each endpoint handler is now responsible for applying the identity
transformations and creating most of the session data, rather than each
implementation of the upstream IDP interface. This shares code better,
and reduces the responsibilities of the implementations of the IDP
interface by letting them focus more on the upstream stuff.
Also refactor the parameters and return types of the IDP interfaces to
make them more clear, and because they can be more focused on upstream
identities (pre-identity transformation). This clarifies the
responsibilities of the implementations of the IDP interface.
2024-02-20 10:45:54 -08:00
Ryan Richard
1bc13e94f7
Refactor to extract interface for upstream IDP interactions
...
Create an interface to abstract the upstream IDP from the
authorize, IDP discovery, callback, choose IDP, and login
endpoints. This commit does not refactor the token endpoint,
which will be refactored in a similar way in the next commit.
2024-02-20 09:26:34 -08:00
Ryan Richard
9db87132b1
More refactoring of auth handler and related refactor of upstreamldap
...
- continued refactoring the auth handler to share more code between
the two supported browserless flows: OIDC and LDAP/AD
- the upstreamldap package should not know about the concept of
OIDC granted scopes, so refactored it to be a skipGroups bool
2024-02-20 09:26:34 -08:00
Ryan Richard
e2bdab9e2d
add the IDP display name to the downstream ID token's sub claim
...
To make the subject of the downstream ID token more unique when
there are multiple IDPs. It is possible to define two IDPs in a
FederationDomain using the same identity provider CR, in which
case the only thing that would make the subject claim different
is adding the IDP display name into the values of the subject claim.
2023-09-11 11:15:40 -07:00
Ryan Richard
f653942065
add new unit tests in callback_handler_test.go
2023-09-11 11:14:06 -07:00
Ryan Richard
048f05d39c
fix callback_handler_test.go
...
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2023-09-11 11:11:56 -07:00
Ryan Richard
86c791b8a6
reorganize federation domain packages to be more intuitive
...
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2023-09-11 11:11:52 -07:00
