Ryan Richard
44509d016e
standardize import of "k8s.io/client-go/kubernetes/fake"
2025-12-22 10:34:53 -08:00
Ryan Richard
9d1c65c3e6
fix deprecation of NewSimpleClientset by using NewClientset or ignoring
2025-12-19 12:00:56 -08:00
Ryan Richard
749633e43c
support response_mode=form_post in upstream OIDC IDPs
2025-03-06 15:28:47 -08:00
Joshua Casey
87640ca54a
Callback endpoint emits audit log with authorizeID even when code param not found
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-12-09 12:47:54 -06:00
Ryan Richard
ecd23e86ce
callback endpoint renders more useful user-facing error messages
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:03 -06:00
Joshua Casey
c7e9ee1c61
Backfill unit tests for paramsSafeToLog
2024-11-27 13:53:02 -06:00
Ryan Richard
51d1cc7a96
refactor and add unit test for AuditRequestParams()
2024-11-27 13:53:02 -06:00
Ryan Richard
c06141c871
token handler uses common method to audit HTTP request parameters
2024-11-27 13:53:02 -06:00
Ryan Richard
eab3fde3af
introduce common method to audit HTTP request parameters
2024-11-27 13:53:02 -06:00
Joshua Casey
611de03e01
Add audit event 'Incorrect Username Or Password' to auth_handler and audit event 'Using Upstream IDP' to callback_handler
2024-11-27 13:53:01 -06:00
Ryan Richard
e126ee5495
all callers of Audit() identify which keys may contain PII
2024-11-27 13:53:01 -06:00
Ryan Richard
ced8686d11
add config for audit logging, remove Audit() from Logger interface
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:01 -06:00
Joshua Casey
dc6faa33bb
Log params to token_handler endpoint even during error cases
2024-11-27 13:53:01 -06:00
Ryan Richard
1006dd9379
resolve some todos
2024-11-27 13:53:01 -06:00
Joshua Casey
09ca7920ea
Extract testutil helper function
2024-11-27 13:53:00 -06:00
Joshua Casey
dd56f2b47f
Add audit event tests for callback_handler
2024-11-27 13:53:00 -06:00
Joshua Casey
44e218194b
Add 'AuthorizeID From Parameters' audit logs to the /callback and /login endpoints
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-11-27 13:53:00 -06:00
Joshua Casey
aee56c388f
Check the sessionID as well
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-11-27 13:53:00 -06:00
Ryan Richard
4f9530eec7
audit logging WIP
2024-11-27 13:53:00 -06:00
Joshua Casey
678be9902a
Lint new files from the GitHub branch
2024-06-11 10:16:18 -05:00
Joshua Casey
bafd578866
Merge branch 'main' into jtc/add-importas-linter
2024-06-11 09:39:48 -05:00
Joshua Casey
cc8d637715
Fix lint
2024-05-28 20:33:55 -05:00
Joshua Casey
d3fb567fdb
Add callback_handler tests for GitHub+IdentityTransformations
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-05-28 15:59:52 -05:00
Joshua Casey
8b1e5aa320
Add callback_handler tests to confirm GitHub with downstream form_post and GitHub with an error case
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-05-28 15:17:04 -05:00
Joshua Casey
37e654faa0
bunch of renames
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-05-28 13:41:52 -05:00
Ryan Richard
0a15d488c8
Merge callback_handler_github_test.go into callback_handler_test.go
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-05-22 21:21:45 -05:00
Ryan Richard
49c468f00a
Add GetUser() interface and implement LoginFromCallback() for GitHub
...
ALso fixed some of the GitHub test helpers
2024-05-22 21:21:45 -05:00
Joshua Casey
b7f79f0adc
Add github-specific tests in callback_handler_github_test.go
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-05-22 21:21:45 -05:00
Joshua Casey
f5116cddb4
Enable 'makezero' and 'prealloc' linters, and require 'any' instead of 'interface{}'
...
Enforce importas:
- go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
- go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
2024-05-21 09:31:15 -05:00
Joshua Casey
7b36c8ab54
Enable 'copyloopvar' linter
2024-05-10 12:51:02 -05:00
Ryan Richard
a1efcefdce
Unit tests for token endpoint for custom ID token lifetimes
2024-04-24 14:13:41 -07:00
Ryan Richard
1bc13e94f7
Refactor to extract interface for upstream IDP interactions
...
Create an interface to abstract the upstream IDP from the
authorize, IDP discovery, callback, choose IDP, and login
endpoints. This commit does not refactor the token endpoint,
which will be refactored in a similar way in the next commit.
2024-02-20 09:26:34 -08:00
Ryan Richard
e2bdab9e2d
add the IDP display name to the downstream ID token's sub claim
...
To make the subject of the downstream ID token more unique when
there are multiple IDPs. It is possible to define two IDPs in a
FederationDomain using the same identity provider CR, in which
case the only thing that would make the subject claim different
is adding the IDP display name into the values of the subject claim.
2023-09-11 11:15:40 -07:00
Ryan Richard
f653942065
add new unit tests in callback_handler_test.go
2023-09-11 11:14:06 -07:00
Ryan Richard
048f05d39c
fix callback_handler_test.go
...
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2023-09-11 11:11:56 -07:00
Ryan Richard
86c791b8a6
reorganize federation domain packages to be more intuitive
...
Co-authored-by: Benjamin A. Petersen <ben@benjaminapetersen.me >
2023-09-11 11:11:52 -07:00
