90c95866d1
upgrade fosite to v0.49.0 and handle its API changes
2024-12-13 10:17:42 -08:00
87640ca54a
Callback endpoint emits audit log with authorizeID even when code param not found
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-12-09 12:47:54 -06:00
170cc3bba4
ran new hack script to update all majors: updated github mod
2024-12-03 12:52:29 -06:00
28e22d7dd2
Update error text assertion due to change in ory/fosite
...
- https://github.com/ory/fosite/commit/db74aa7abd9f22deb0d6779a6870c1a65445f298
2024-12-02 11:08:30 -06:00
ae5aad178d
TokenCredentialRequest uses actual cert expiry time instead of estimate
...
and also audit logs both the NotBefore and NotAfter of the issued cert.
Implemented by changing the return type of the cert issuer helpers
to make them also return the NotBefore and NotAfter values of the new
cert, along with the key PEM and cert PEM.
2024-11-27 13:53:03 -06:00
ecd23e86ce
callback endpoint renders more useful user-facing error messages
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:03 -06:00
54b35c30da
rename tokenIdentifier to tokenID in the audit logs
...
Because `tokenID` is more consistent with the names of
the other correlation keys.
2024-11-27 13:53:03 -06:00
4423d472da
allow audit correlation between token being issued and being used
2024-11-27 13:53:03 -06:00
ce2dcbdbb3
simplify godoc
2024-11-27 13:53:02 -06:00
c7e9ee1c61
Backfill unit tests for paramsSafeToLog
2024-11-27 13:53:02 -06:00
6bf9b64778
log response audit-id for tokencredentialrequests made from CLI
...
Only logged when PINNIPED_DEBUG=true is used.
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:02 -06:00
60bd118a9c
pinniped CLI should print the audit-ID in certain error cases
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-11-27 13:53:02 -06:00
d0905c02dd
use test helper in rest_test.go to reduce some duplication
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:02 -06:00
51fc86f950
don't audit log missing username or password, change query param value
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:02 -06:00
a84b76e56a
audit log session ID in token handler for every grant type
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:02 -06:00
c2018717b6
audit log OIDCClientSecretRequests
2024-11-27 13:53:02 -06:00
f388513145
resolve TODO by adding docs
2024-11-27 13:53:02 -06:00
c16ebe1707
add unit test for audit logging when token refresh updates groups
2024-11-27 13:53:02 -06:00
b54365c199
audit log request params on GET and POST login handlers
2024-11-27 13:53:02 -06:00
51d1cc7a96
refactor and add unit test for AuditRequestParams()
2024-11-27 13:53:02 -06:00
c06141c871
token handler uses common method to audit HTTP request parameters
2024-11-27 13:53:02 -06:00
eab3fde3af
introduce common method to audit HTTP request parameters
2024-11-27 13:53:02 -06:00
de7781b7f9
Use correct caller when generating audit events
2024-11-27 13:53:02 -06:00
611de03e01
Add audit event 'Incorrect Username Or Password' to auth_handler and audit event 'Using Upstream IDP' to callback_handler
2024-11-27 13:53:01 -06:00
de722332b1
Add audit logging to post_login_handler
2024-11-27 13:53:01 -06:00
438ca437ec
tokencredentialrequest audit logs failed requests
2024-11-27 13:53:01 -06:00
e21e1326b7
tokencredentialrequest audit logs successful responses
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:01 -06:00
37e12b4024
Start backfilling some audit unit tests in post_login_handler
2024-11-27 13:53:01 -06:00
e126ee5495
all callers of Audit() identify which keys may contain PII
2024-11-27 13:53:01 -06:00
a308f3f22a
audit log: keep key ordering in personalInfo, render nil slices and maps
2024-11-27 13:53:01 -06:00
c5f4cce3ae
make Audit() take struct as param for all optional params and redact PII
2024-11-27 13:53:01 -06:00
ced8686d11
add config for audit logging, remove Audit() from Logger interface
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-11-27 13:53:01 -06:00
76f6b725b8
Fix some rebase conflicts
2024-11-27 13:53:01 -06:00
f9e1dd4bec
Backfill unit tests for garbage_collector audit logging
2024-11-27 13:53:01 -06:00
f4f393e5de
Audit event 'HTTP Request Completed' will now log the location with err, error, and error_description query parameters
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-11-27 13:53:01 -06:00
2db5dda266
Add last audit log unit tests to auth_handler
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-11-27 13:53:01 -06:00
8cf9c59957
refactor to move audit event message types to their own pkg
2024-11-27 13:53:01 -06:00
088556193d
auth handler audit logs headers and params when http method is wrong
...
also refactor some related code into a helper, and fix linter errors
2024-11-27 13:53:01 -06:00
18d3ab3d15
The 'HTTP Request Parameters' audit event now logs params as a JSON object
2024-11-27 13:53:01 -06:00
dc6faa33bb
Log params to token_handler endpoint even during error cases
2024-11-27 13:53:01 -06:00
0d22ae2c1a
Fix lint and unit test compilation
2024-11-27 13:53:01 -06:00
362d982906
Start to backfill some audit unit tests for the token_handler
2024-11-27 13:53:01 -06:00
1006dd9379
resolve some todos
2024-11-27 13:53:01 -06:00
369316556a
Add configuration to audit internal endpoints and backfill unit tests
2024-11-27 13:53:01 -06:00
cf4b29de4b
Clarify docs
2024-11-27 13:53:00 -06:00
09ca7920ea
Extract testutil helper function
2024-11-27 13:53:00 -06:00
9994e033b2
Add audit event tests for login_handler
2024-11-27 13:53:00 -06:00
dd56f2b47f
Add audit event tests for callback_handler
2024-11-27 13:53:00 -06:00
dd42f35db0
plog.TestLogger returns a buffer that holds the logs
...
# Conflicts:
# internal/controller/apicerts/certs_expirer_test.go
# internal/plog/plog_test.go
# internal/plog/testing.go
# pkg/oidcclient/login_test.go
2024-11-27 13:53:00 -06:00
a67af9455b
Refactor: don't copy the loop variable in test loops
2024-11-27 13:53:00 -06:00
Ryan Richard
Joshua Casey