Ryan Richard and Ashish Amarnath
dfef9f470f
fix bug in webhookcachefiller caused when status update returns error
...
Also refactor test assertions regarding log statements in
jwtcachefiller_test.go and webhookcachefiller_test.go
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ryan Richard and Ashish Amarnath
f5da417450
fix bug in jwtcachefiller caused when status update returns error
...
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
a888083c50
Introduce type alias CABundleHash for the hash of a CA bundle ([32]byte)
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
Co-authored-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
99cfc4fbce
Remove tlsconfigutil.CABundle.IsEqual and ensure that tlsconfigutil.NewCABundle handles nil/empty input
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
fcceeed9fa
Refactor tlsconfigutil.CABundle 'getters' to not have 'get' in the name
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
4cf0e46c38
tlsconfigutil.CABundle should generate its own certPool
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
34eff2a2f9
Refactor tlsconfigutil.buildCABundle to make it more clear where the bundle is coming from
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
e82cb2c7ba
Refactor tlsconfigutil.getCertPool to return a CABundle and change its name to buildCABundle
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
0711093ccd
Add tests for tlsconfigutil.CABundle and all callers should use the constructor
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
15d0006841
Pull tlsconfigutil.CABundle into a separate file
2024-08-05 11:32:20 -07:00
Ashish Amarnath and Ryan Richard
282b949c24
update jwtcachefiller to use new tlsconfigutil.CABundle type
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ashish Amarnath and Ryan Richard
005dbf3aa8
refactor tlsconfigutil to return a caBundle type
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ashish Amarnath and Ryan Richard
a1dcba4731
add unit tests for validatedsettings cache storing ca bundle hash
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Ashish Amarnath and Ryan Richard
2a62beeb5f
store ca bundle hash in validated settings cache
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
242fa8afb2
When reading CA bundle from a secret/configmap, return more specific err
...
When the bundle does not contain any certs, make the error more
specific.
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
e3ed722252
Minor refactor
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:20 -07:00
Joshua Casey and Ryan Richard
9420bfde5b
webhookcachefiller controller loops over all webhookauthenticators
2024-08-05 11:32:20 -07:00
Ryan Richard and Joshua Casey
06b47a5792
jwtcachefiller controller loops over all jwtauthenticators
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-08-05 11:32:20 -07:00
Ryan Richard
414ff503ef
extract some common condition reason string constants
2024-08-05 11:32:20 -07:00
Ryan Richard
09724cfa71
Add unit test: when discovery is already cached for OIDCIdentityProvider
2024-08-05 11:32:20 -07:00
Ryan Richard
0f103ed2a4
Add unit tests for external CA bundle in oidc_upstream_watcher_test.go
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
d62d6a1f27
Refactor github_controller_watcher to simplify the tls Dial
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
288e092d2e
GitHub IDP watcher should not dial an address that has already been validated
2024-08-05 11:32:19 -07:00
Ryan Richard
8060e82745
include external CA bundles in the cache key in oidc_upstream_watcher.go
2024-08-05 11:32:19 -07:00
Ryan Richard
373713f7e0
webhook controller redoes validations when external CA bundle changes
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
66401b42d8
Add GitHubIDP tests for a CA bundle in a Secret or a ConfigMap
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
2d5943b21a
Move conditions reason Success to conditions_util
2024-08-05 11:32:19 -07:00
Ryan Richard and Joshua Casey
920b519ebf
error when CA bundle from Secret or ConfigMap is empty
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
bf1c02d328
jwtauthenticator controller redoes validations when external CA bundle changes
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:19 -07:00
Joshua Casey and Ryan Richard
6e9023e090
add code review todos and light refactoring
...
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
1b7a26d932
test secret and configmap filtering in concierge authenticator controllers
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
cb4b63f8b3
integration tests for concierge authenticators
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
8eb15a924f
integration tests for supervisor oidc, ldap, activedirectory IDP
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
6a610a9d51
add namespace to jwt authenticator controller
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
9ab7c39d56
jwt cache filler
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
207bac9452
webhook cache filler
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
199562fd05
get all supervisor unit tests to pass
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
3a969a83b7
update supervisor controllers
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
aab1ee9edc
unify TLS Spec between supervisor and concierge
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Ashish Amarnath and Ryan Richard
080c75efe6
refactor tls spec validation into its own package
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
2024-08-05 11:32:19 -07:00
Joshua Casey and GitHub
bc10d500b7
Merge branch 'main' into host-name-case-insensitve
2024-07-30 09:27:45 -05:00
Ashish Amarnath and Ryan Richard
7c7f0fdae3
make host name parsing case-insensitive
...
Signed-off-by: Ashish Amarnath <ashish.amarnath@broadcom.com >
Co-authored-by: Ryan Richard <richardry@vmware.com >
2024-07-29 14:32:01 -07:00
Ryan Richard
a2be4b7b5e
clarify some comments based on PR feedback
2024-07-17 09:58:26 -07:00
Ryan Richard
b5a509f27f
fix authenticators bug: stop allowing usage when validation fails
2024-07-16 09:59:19 -07:00
Ryan Richard
e5cfa521da
remove unnecessary warning log message
...
This message is not needed because the IDP chooser page will take
care of the case where a browser-based authorization flow did not
request any specific IDP. For browserless flows (only allowed for
the `pinniped-cli` client), the client must request a specific IDP
(except in backwards-compatibility mode) because there is no browser
in which to show the IDP chooser page. Failing to request a specific
IDP in a browserless flow will result in a helpful error message
being returned.
2024-07-10 09:32:23 -07:00
Ryan Richard
0380a9ce33
upgrade github.com/go-jose/go-jose and github.com/coreos/go-oidc
...
Also standardize some related imports and fix some whitespace in a test
2024-06-21 11:16:40 -07:00
Ryan Richard
f7f32f2f98
some mild refactoring of ptls common.go (mostly renames)
2024-06-14 13:27:38 -07:00
Ryan Richard and Joshua Casey
f0f9efa277
Refactor to make profiles.go and profiles_fips_strict.go more similar
...
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com >
2024-06-14 10:42:17 -07:00
Joshua Casey and Ryan Richard
53031ad8d4
User can now configured allowed ciphers, to restrict the ciphers used by the Default profile
2024-06-14 10:42:17 -07:00
Joshua Casey and Ryan Richard
ce1ad010e9
Remove Legacy TLS Config, which is not used in the source code
2024-06-14 10:42:17 -07:00
