mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-29 19:25:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
4,824 Commits 43 Branches 54 Tags
5d9b7a3346a9307e4e5dafba2a3c2f94de73cb89
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Margo Crawford 98b0b6b21c One line fix to the supervisor warnings test 
Make the scopes in the cache key include the new groups scope

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-24 08:09:32 -07:00
Margo Crawford 8adc1ce345 Fix failing active directory integration test 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-22 16:16:32 -07:00
Margo Crawford a010e72b29 Merge branch 'dynamic_clients' into require-groups-scope 2022-06-22 14:27:06 -07:00
Margo Crawford dac0395680 Add a couple tests, address pr comments 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-22 14:19:55 -07:00
Margo Crawford f2005b4c7f Merge branch 'dynamic_clients' into require-groups-scope 2022-06-22 12:30:54 -07:00
Margo Crawford c70a0b99a8 Don't do ldap group search when group scope not specified 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-22 10:58:08 -07:00
Margo Crawford 9903c5f79e Handle refresh requests without groups scope 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-22 08:21:16 -07:00
Margo Crawford 64cd8b0b9f Add e2e test for groups scope 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-15 13:41:22 -07:00
Margo Crawford ff26c424ae Remove unused role binding 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-15 10:19:56 -07:00
Margo Crawford 424f925a14 Merge branch 'dynamic_clients' into client-secret-api-noop 2022-06-15 09:38:55 -07:00
Margo Crawford c117329553 Updates based on code review 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-15 09:38:21 -07:00
Margo Crawford 4d0c2e16f4 require groups scope to get groups back from supervisor 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-15 08:00:17 -07:00
Margo Crawford c95efad180 Merge branch 'dynamic_clients' into client-secret-api-noop 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-13 17:12:00 -07:00
Margo Crawford 104e08b0f6 Merge branch 'dynamic_clients' into client-secret-api-noop 2022-06-13 15:52:34 -07:00
Margo Crawford 0c1f48cbc1 Move oidcclient into config.supervisor.pinniped.dev 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-13 15:48:54 -07:00
Margo Crawford 8f4285dbff Change group names 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-13 14:28:05 -07:00
Margo Crawford ba371423d9 Add integration test for OIDCClientSecretRequest 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-10 13:56:15 -07:00
Margo CrawfordandGitHub 018bdacc6d Merge pull request #1191 from vmware-tanzu/codegen-docker-pull-always 
Always attempt to docker pull before codegen
 2022-06-10 13:31:47 -07:00
Margo Crawford b3ad29fe1c Always attempt to docker pull before codegen 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-10 12:26:40 -07:00
Margo Crawford 479b6c421d fix out of date codegen images 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-10 09:51:37 -07:00
Margo Crawford 157b5a7079 Update 1.24 codegen 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-10 07:55:46 -07:00
Margo Crawford 37884e7015 reran update.sh to get the codegen up to date 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-09 14:39:06 -07:00
Margo Crawford 889348e999 WIP aggregated api for oidcclientsecretrequest 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-09 13:47:19 -07:00
Margo CrawfordandGitHub e5a96e353c Merge pull request #1185 from vmware-tanzu/oidc_client_crd 
OIDC client crd
 2022-06-06 14:16:10 -07:00
Margo CrawfordandGitHub d6442ed53d Merge pull request #1180 from vmware-tanzu/cli_flow_env_var 
Allow `PINNIPED_UPSTREAM_IDENTITY_PROVIDER_FLOW` env var to override `--upstream-identity-provider-flow` CLI flag
 2022-06-06 11:49:00 -07:00
Margo Crawford 0dec2eee32 Add enum validation for scopes and grant types 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-06 10:15:25 -07:00
Margo Crawford 3cacb5b022 Fix typo in oidcclient spec and status descriptions 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-06 07:38:57 -07:00
Margo Crawford ca3da0bc90 Fix some disallowed kubebuilder annotations, fix kube api discovery test 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-04 21:04:40 -07:00
Margo Crawford cd47ba53c2 Add CRD for OIDCClient 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-06-03 16:22:15 -07:00
Margo Crawford 22aea6ab9d Address some small comments to make the doc more understandable 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-05-09 12:55:32 -07:00
Margo Crawford 408e390094 Add more detail on how we should display errors 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-05-06 11:00:01 -07:00
Margo CrawfordandGitHub b458cd43b9 Merge pull request #1159 from vmware-tanzu/fix-openldap-typo 
Tiny fix to openldap group name: pinninpeds->pinnipeds
 2022-05-05 12:50:43 -07:00
Margo CrawfordandGitHub 07a3faf449 Merge branch 'main' into fix-openldap-typo 2022-05-05 10:51:09 -07:00
Margo Crawford 329d41aac7 Add the full end to end test for ldap web ui 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-05-05 08:49:58 -07:00
Margo Crawford 079908fb50 Update to reflect further conversations we've had 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-05-04 13:28:54 -07:00
Margo Crawford eb891d77a5 Tiny fix: pinninpeds->pinnipeds 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-05-04 12:42:55 -07:00
Margo Crawford 388cdb6ddd Fix bug where form was posting to the wrong path 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-05-03 15:18:38 -07:00
Margo Crawford 646c6ec9ed Show error message on login page 
Also add autocomplete attribute and title element

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-29 10:36:13 -07:00
Margo Crawford 453c69af7d Fix some errors and pass state as form element 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-28 12:07:04 -07:00
Margo Crawford 07b2306254 Add basic outline of login get handler 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-28 11:51:36 -07:00
Margo Crawford 77f016fb64 Allow browser_authcode flow for pinniped login command 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-27 08:53:53 -07:00
Margo Crawford ae60d4356b Some refactoring of shared code between OIDC and LDAP browser flows 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-27 08:51:37 -07:00
Margo Crawford 379a803509 when password header but not username is sent to password grant, error 
also add more unit tests

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-26 16:46:58 -07:00
Margo Crawford eb1d3812ec Update authorization endpoint to redirect to new login page 
Also fix some test failures on the callback handler, register the
new login handler in manager.go and add a (half baked) integration test

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-26 12:51:56 -07:00
Margo Crawford 8832362b94 WIP: Add login handler for LDAP/AD web login 
Also change state param to include IDP type
 2022-04-25 16:41:55 -07:00
Margo Crawford 694e4d6df6 Advertise browser_authcode flow in ldap idp discovery 
To keep this backwards compatible, this PR changes how
the cli deals with ambiguous flows. Previously, if there
was more than one flow advertised, the cli would require users
to set the flag --upstream-identity-provider-flow. Now it
chooses the first one in the list.

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-25 14:54:21 -07:00
Margo Crawford 444cf111d0 Add more detail about how the flow should work 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-20 16:17:49 -07:00
Margo CrawfordandGitHub 311bb05993 Merge pull request #1130 from vmware-tanzu/kube-versions-april-22 
Update kube versions to latest patch
 2022-04-19 13:30:40 -07:00
Margo CrawfordandGitHub 63779ddac2 Merge pull request #1129 from vmware-tanzu/jwt-authenticator-client-field 
JWTAuthenticator distributed claims resolution honors tls config
 2022-04-19 13:28:43 -07:00
Margo Crawford 0b72f7084c JWTAuthenticator distributed claims resolution honors tls config 
Kube 1.23 introduced a new field on the OIDC Authenticator which
allows us to pass in a client with our own TLS config. See
https://github.com/kubernetes/kubernetes/pull/106141.

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-19 11:36:46 -07:00
Margo CrawfordandGitHub c40bca5e65 Merge pull request #1127 from hectorj2f/add_code_challenge_method_support 
oidc: add code challenge supported methods to the discovery doc
 2022-04-19 11:23:57 -07:00
Margo Crawford 019750a292 Update kube versions to latest patch 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-19 11:19:24 -07:00
Margo CrawfordandGitHub f5cf3276d5 Merge pull request #1123 from vmware-tanzu/macos-untrusted-certificate-errors 2022-04-14 20:15:31 -07:00
Margo Crawford d5337c9c19 Error format of untrusted certificate errors should depend on OS 
Go 1.18.1 started using MacOS' x509 verification APIs on Macs
rather than Go's own. The error messages are different.

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-14 17:37:36 -07:00
Margo Crawford 96137cd0ee ldap/ad web ui proposal 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-14 13:58:31 -07:00
Margo Crawford 03f19da21c the http2RoundTripper should only use http2 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-14 10:51:25 -07:00
Margo Crawford 96c705bf94 document how to use the fips dockerfile on our website 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-13 12:45:58 -07:00
Margo Crawford 53597bb824 Introduce FIPS compatibility 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-03-29 16:58:41 -07:00
Margo CrawfordandGitHub a9b054e2f4 Merge pull request #1087 from vmware-tanzu/update-install-linter-1.45.0 
Update install-linter.sh to use v1.45.0
 2022-03-22 10:57:34 -07:00
Margo Crawford 051a228a8c Update install-linter.sh to use v1.45.0 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-03-22 10:29:08 -07:00
Margo CrawfordandGitHub 636d2014a7 Merge pull request #1086 from pnbrown/patch-1 
Update MAINTAINERS.md
 2022-03-21 15:02:05 -07:00
Margo CrawfordandGitHub b987783c62 Merge pull request #1047 from vmware-tanzu/docs-k8s-codegen-version 
Update docs to reference the latest k8s codegen version
 2022-03-03 11:14:33 -08:00
Margo Crawford b8bdfa1b9a Update docs to reference the latest k8s codegen version 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-03-03 10:36:42 -08:00
Margo Crawford 60d2b852ae Corresponds with making our CI use the head of the master branch of crd-ref-docs 
This fixes #906

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-03-02 14:31:58 -08:00
Margo Crawford f6ad5d5c45 Add group change warning test for Active Directory 
Also refactor some of the AD test helper functions

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-03-02 11:54:36 -08:00
Margo CrawfordandGitHub 9a4a862808 Merge pull request #1039 from vmware-tanzu/group-change-warning 
Group change warning
 2022-03-01 14:38:35 -08:00
Margo Crawford 609b55a6d7 Pinniped Supervisor should issue a warning when groups change during refresh 2022-03-01 14:01:57 -08:00
Margo CrawfordandGitHub 339bb84765 Merge pull request #982 from vmware-tanzu/upstream-ldap-group-refresh-skip 
Only run group refresh when the skipGroupRefresh boolean isn't set
 2022-02-17 13:59:07 -08:00
Margo Crawford b9582f864e Update comment for skipGroupRefresh 2022-02-17 12:50:28 -08:00
Margo Crawford e2c6dcd6e6 Add integration test 2022-02-17 12:50:28 -08:00
Margo Crawford fdac4d16f0 Only run group refresh when the skipGroupRefresh boolean isn't set 
for AD and LDAP
 2022-02-17 12:50:28 -08:00
Margo CrawfordandGitHub c7aaa69b4b Merge pull request #975 from vmware-tanzu/upstream-ldap-group-refresh 
Inline upstream ldap group refresh
 2022-02-17 12:47:22 -08:00
Margo Crawford 662f2cef9c Integration test for updating group search base 
Also a small change to a comment
 2022-02-17 11:29:59 -08:00
Margo Crawford ca523b1f20 Always update groups even if it's nil 
Also de-dup groups and various small formatting changes
 2022-02-17 11:29:59 -08:00
Margo Crawford c28602f275 Add unit tests for group parsing overrides 2022-02-17 11:29:59 -08:00
Margo Crawford dd11c02b6a Add back entries because I think it's actually necessary 2022-02-17 11:29:59 -08:00
Margo Crawford f890fad90c Rename a function, sort strings inside searchGroupsForUserDN 2022-02-17 11:29:59 -08:00
Margo Crawford cd7538861a Add integration test where we don't get groups back 2022-02-17 11:29:59 -08:00
Margo Crawford 013b521838 Upstream ldap group refresh: 
- Doing it inline on the refresh request
 2022-02-17 11:29:59 -08:00
Margo Crawford 3b1153cd91 Update latest version to v0.13.0 2022-01-21 15:19:40 -08:00
Margo CrawfordandGitHub dea9bf9b90 Merge pull request #970 from vmware-tanzu/kubectl-apply-resources 
When instructing users how to install the concierge with kubectl apply,
 2022-01-21 13:36:52 -08:00
Margo Crawford 726e88ea03 When instructing users how to install the concierge with kubectl apply, 
reccommend using install-pinniped-concierge-crds.yaml, then
install-pinniped-concierge-resources.yaml.

Previously we recommended install-pinniped-concierge-crds (a subset),
then install-pinniped-concierge (everything concierge related, including
the crds). This works fine for install, but not uninstall. Instead we
should use a separate yaml file that contains everything in
install-pinniped-concierge but *not* in install-pinniped-concierge-crds.

We have been generating this file in CI since a5ced4286b6febc7474b7adee34eeb1b62ec82b7
but we haven't released since then so we haven't been able to recommend
its use.
 2022-01-21 10:26:45 -08:00
Margo CrawfordandGitHub 70c99c6d44 Merge pull request #969 from vmware-tanzu/request-offline-access-in-docs 
Request offline_access in the concierge with supervisor demo
 2022-01-21 10:24:04 -08:00
Margo Crawford 62a8967db1 Request offline_access in the concierge with supervisor demo 
It's a generic config and not OIDC provider specific
but since most providers require it it seems like the
best default.
 2022-01-21 09:58:04 -08:00
Margo Crawford b30dad72ed Fix new refresh token grace period test to have warnings 2022-01-20 14:54:59 -08:00
Margo CrawfordandGitHub 31cdd808ac Merge pull request #951 from vmware-tanzu/short-session-warning 
Supervisor should emit a warning when access token lifetime is too short
 2022-01-20 14:44:32 -08:00
Margo Crawford 842ef38868 Ensure warning is on stderr and not stdout. 2022-01-20 13:48:50 -08:00
Margo Crawford acd23c4c37 Separate test for access token refresh 2022-01-20 13:48:50 -08:00
Margo Crawford 38d184fe81 Integration test + making sure we get the session correctly in token handler 2022-01-20 13:48:50 -08:00
Margo Crawford b0ea7063c7 Supervisor should emit a warning when access token lifetime is too short 2022-01-20 13:48:50 -08:00
Margo CrawfordandGitHub 6c923d3bc6 Merge pull request #956 from vmware-tanzu/fix-scopes-access-token-refresh-test 
Keep all scopes except offline_access in access token refresh integration test
 2022-01-19 16:19:13 -08:00
Margo Crawford 513c943e87 Keep all scopes except offline_access in integration test 2022-01-19 13:29:26 -08:00
Margo CrawfordandGitHub 50e4871d65 Merge pull request #944 from vmware-tanzu/refresh-with-no-refresh-token 
Access Token based OIDC refresh by checking the UserInfo endpoint
 2022-01-14 10:23:41 -08:00
Margo Crawford 5b161be334 Refactored oidcUpstreamRefresh 
Various style changes, updated some comments and variable names and
extracted a helper function for validation.
 2022-01-12 18:05:22 -08:00
Margo Crawford 62be761ef1 Perform access token based refresh by fetching the userinfo 2022-01-12 18:05:10 -08:00
Margo Crawford 6f3977de9d Store access token when refresh not available for authcode flow. 
Also refactor oidc downstreamsessiondata code to be shared between
callback handler and auth handler.

Signed-off-by: Ryan Richard <richardry@vmware.com>
 2022-01-12 18:03:25 -08:00
Margo Crawford 683a2c5b23 WIP adding access token to storage upon login 2022-01-12 18:03:25 -08:00
Margo Crawford 2b744b2eef Add back comment about deferring validation when id token subject is missing 2022-01-12 11:19:43 -08:00
Margo Crawford 2958461970 Addressing PR feedback 
store issuer and subject in storage for refresh
Clean up some constants

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-01-10 11:03:37 -08:00
Margo Crawford f2d2144932 rename ValidateToken to ValidateTokenAndMergeWithUserInfo to better reflect what it's doing 
Also changed a few comments and small things
 2022-01-10 11:03:37 -08:00