mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-06 16:17:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
4,792 Commits 33 Branches 54 Tags
cba4e2a2e85f79b137f0efdf982011e2f8a3d5e9
Commit Graph
1087 Commits
Author SHA1 Message Date
Joshua Casey 7b36c8ab54 Enable 'copyloopvar' linter 2024-05-10 12:51:02 -05:00
Joshua Casey e04e5e0185 Fix revive linter issues for all production code, and exclude revive linter issues for test code 2024-05-10 12:51:02 -05:00
Ryan Richard 7c85a511a2 first draft of an e2e integration test for GitHub login (skip while WIP) 2024-05-09 15:35:37 -07:00
Ryan Richard 6be92f92fb bump Supervisor session storage versions 2024-05-09 15:35:37 -07:00
Joshua Casey 96e4442181 Add docs to configure the Supervisor with a GitHub IDP. 
- Does not include docs for configuring GitHub Apps or GitHub OAuth Apps
 2024-05-08 15:57:21 -05:00
Benjamin A. Petersen c43193a0c8 Merge branch 'main' into github_identity_provider 2024-05-01 12:15:08 -04:00
Benjamin A. Petersen 00567645d0 Add conditional AD to IDP discovery test 2024-04-30 15:43:32 -04:00
Benjamin A. Petersen 92b9d68863 Add OIDC, LDAP to supervisor discovery test 2024-04-30 14:19:54 -04:00
Ryan Richard 1ac2215724 update an assertion in integration test leaderelection_test.go 2024-04-29 13:22:14 -07:00
Benjamin A. Petersen 6424f45c19 Add IDP Discovery integration test for GitHub 2024-04-29 14:57:14 -04:00
Joshua CaseyandRyan Richard 9c2df74e54 Adjust to new K8s 1.30 API 2024-04-26 11:54:53 -07:00
Benjamin A. Petersen 2753b468fd Update TestSupervisorFederationDomainStatus test 2024-04-25 17:02:07 -04:00
Ryan Richard 57a07a498f Refactors for custom ID token lifetime based on PR feedback 2024-04-24 15:05:00 -07:00
Ryan Richard 136bc7ac09 Mild refactor of integration test for custom ID token lifetimes 2024-04-24 14:13:41 -07:00
Ryan Richard 5dbf05c31d Update the session storage versions due to new ID token lifetime field 2024-04-24 14:13:41 -07:00
Joshua CaseyandRyan Richard b31a893caf Add integration test and fix totalExpectedAPIFields 2024-04-24 14:13:40 -07:00
Ryan Richard def2b35e6e Make ID token lifetimes configurable on OIDCClient resources 2024-04-24 14:13:40 -07:00
Joshua Casey 14b1b7c862 Polish up the github_upstream_watcher: default and verify spec.claims correctly 2024-04-24 13:37:40 -05:00
Joshua Casey fe5d037600 Merge branch 'main' into jtc/merge-main-5fe94c4e-into-github 2024-04-23 12:42:07 -05:00
Ryan Richard 1d8310ed44 clarify error message for when there is no healthy controller manager 2024-04-22 09:29:37 -07:00
Ryan Richard 7c0c3211d1 fix typo in securetls_fips_test.go 2024-04-19 12:50:05 -07:00
Joshua Casey 94bee9e882 Remove testutil.TLSTestServerWithCert in favor of the testutil/tlsserver package 2024-04-19 10:30:23 -05:00
Joshua Casey 206a16f9e3 Integration test fixes - updated condition messages 2024-04-18 21:32:54 -05:00
Joshua Casey c9b61ef010 Populate internal GitHub IDP Config from CRD 2024-04-16 14:33:01 -05:00
Joshua Casey 8ea339139e ldap.Conn.Start() is now deprecated as of https://github.com/go-ldap/ldap/releases/tag/v3.4.7 2024-04-08 06:49:03 -05:00
Joshua Casey 42dd8d1d9d First draft of a GitHubIdentityProvider CRD 2024-04-01 15:10:46 -05:00
Benjamin A. Petersen c6b0820438 Fix some utils, spacing, func naming, test inputs, etc. 2024-03-26 16:22:51 -04:00
Benjamin A. Petersen f86c46e160 Update WebhookAuthenticator Status WebhookConnectionValid 
- ConnectionProbeValid -> WebhookConnectionValid
  - This is to conform with the pattern of other controllers, ex:
    LDAPConnectionValid
 2024-03-26 15:33:44 -04:00
Benjamin A. Petersen bec5fe85cc change WebhookAuthenticator TLSConnectionNegotiationValid to ConnectionProbeValid 2024-03-19 18:00:40 -04:00
Benjamin A. Petersen 5bc4e678bf WebhookAuthenticator Status integration test refactor to test table 2024-03-19 17:45:26 -04:00
Benjamin A. Petersen 097e6d5340 Always pass spec to CreateTestWebhookAuthenticator 2024-03-19 16:48:07 -04:00
Benjamin A. Petersen 5c1fa6d52c Adjust testlib/client.go for lint quirk 2024-03-19 16:48:06 -04:00
Benjamin A. Petersen 337459feb0 Update webhook status integration tests 
- total api fields test 260->261
 2024-03-19 16:48:05 -04:00
Benjamin A. Petersen 590e2d18f7 Add WebhookAuthenticator integration tests, expand unit tests 
- Add WebhookAuthenticator unit tests, update generated code
- Add validateTLSNegotiation(), update tests
- Update validateTLSNegotiation, add unit tests, factor out helpers
- Update generated code
 2024-03-19 16:48:05 -04:00
Benjamin A. Petersen ef36b454ba Improve WebhookAuthenticator Status and Validations 
- Validate TLS Configuration
- Validate Endpoint
- Validate TLS Negotiation
  - Report status handshake negotiation with webhook
- Unit tests
- Integration tests
 2024-03-19 16:48:03 -04:00
Ryan RichardandGitHub d49b011d65 Merge branch 'main' into cli_callback_cors_get 2024-03-08 11:36:32 -08:00
Ryan Richard f55d56bf4a CLI's localhost listener handles CORS preflight requests for GETs 2024-03-08 10:45:57 -08:00
Joshua Casey ffc49d96b3 Integration tests should use a valid value for CredentialIssuer spec.impersonationProxy.service.type 2024-03-08 11:19:15 -06:00
Joshua Casey ab0682917a whoami integration test now allows for additional extra fields in K8s 1.30+ 2024-03-07 08:09:16 -06:00
Ryan RichardandJoshua Casey e43cf81c38 Add some logging and comments making it easier to debug with chrome 
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>
 2024-03-05 13:26:08 -08:00
Ryan Richard f498cb3918 wait for JWTAuthenticator to be phase=ready in supervisor warnings test 2024-02-27 15:45:33 -08:00
Benjamin A. PetersenandRyan Richard e8482ab9e9 Update jwtauthenticator unit tests to check actions 
- Add test to verify timestamps are particularly updated
- Improve diff output in tests for actions
- Make jwtauthenticator status tests parallel
- Update copyright headers in multiple files
 2024-02-27 15:45:32 -08:00
Benjamin A. PetersenandRyan Richard 868ff9ed2b Update jwk authenticator status integration tests 2024-02-27 15:45:32 -08:00
Benjamin A. PetersenandRyan Richard 73e4d3144b Add integration tests for JWTAuthenticators 
- paired with changes to e2e_test.go, adds Status.Condition assertions
  around JWTAuthenticators
 2024-02-27 15:45:32 -08:00
Benjamin A. PetersenandRyan Richard 1a633adde6 add WaitForJWTAuthenticatorStatusPhase() integration helper 2024-02-27 15:45:32 -08:00
Benjamin A. PetersenandRyan Richard 09bd51f481 fix comment in testlib/client.go 2024-02-27 15:45:32 -08:00
Benjamin A. PetersenandRyan Richard 084c3114f4 Improve jwtcachefiller tests 
- some format updates
- add timestamp to test
- fix order of expect,actual in some assertions
- remove some commented code no longer needed
 2024-02-27 15:45:32 -08:00
Ryan Richard 0d31e955ae Don't skip upstream group memberships when groups scope is not granted 
Background: For dynamic clients, the groups scope is not always allowed
and/or requested by the client, so it will not always be granted by the
Supervisor for an authorization request.

Previously, when the groups scope was not granted, we would skip
searching for upstream groups in some scenarios.

This commit changes the behavior of authorization flows so that even
when the groups scope is not granted we still search for the upstream
group memberships as configured, and we pass the upstream group
memberships into any configured identity transformations. The identity
transformations could potentially reject the user's authentication based
on their upstream group membership.

When the groups scope is not granted, we don't include the groups in
the final Supervisor-issued ID token. This behavior is not changed.
 2024-02-21 13:12:18 -08:00
Ryan Richard 9db87132b1 More refactoring of auth handler and related refactor of upstreamldap 
- continued refactoring the auth handler to share more code between
  the two supported browserless flows: OIDC and LDAP/AD
- the upstreamldap package should not know about the concept of
  OIDC granted scopes, so refactored it to be a skipGroups bool
 2024-02-20 09:26:34 -08:00
Ryan Richard dce9409ccc login oidc cmd checks access token expiry before doing token exchange 
In the RFC8693 token exchange, the CLI sends your access token and
receives in exchange a new cluster-scoped ID token.

Fix a bug in the CLI. Whenever the "pinniped login oidc" command was
planning to perform the RFC8693 token exchange, it failed to check if
the cached access token was still valid before performing the exchange,
which sends the access token. It instead checked if the cached ID token
was still valid, but that it not relevant in this situation because the
ID token is not going to be used for anything (instead the new ID token
returned by the RFC8693 token exchange will be used for auth).

This bug doesn't actually matter today, because the Supervisor-issued
access and ID tokens always both have the same 2-minute lifetimes.
However, future enhancements may cause them to have different lifetimes
in certain circumstances. Fixing this CLI bug now to prepare for those
potential future enhancements.
 2024-02-09 13:33:30 -08:00