mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-28 02:52:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
4,469 Commits 16 Branches 54 Tags
eab3fde3afef52b1a0bb1cb87c6678eae5f37a82
Commit Graph
1414 Commits
Author SHA1 Message Date
Ryan RichardandJoshua Casey eab3fde3af introduce common method to audit HTTP request parameters 2024-11-27 13:53:02 -06:00
Joshua Casey de7781b7f9 Use correct caller when generating audit events 2024-11-27 13:53:02 -06:00
Joshua Casey 611de03e01 Add audit event 'Incorrect Username Or Password' to auth_handler and audit event 'Using Upstream IDP' to callback_handler 2024-11-27 13:53:01 -06:00
Joshua Casey de722332b1 Add audit logging to post_login_handler 2024-11-27 13:53:01 -06:00
Ryan RichardandJoshua Casey 438ca437ec tokencredentialrequest audit logs failed requests 2024-11-27 13:53:01 -06:00
Ryan RichardJoshua CaseyJoshua Casey
 		e21e1326b7 tokencredentialrequest audit logs successful responses 
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>
 2024-11-27 13:53:01 -06:00
Joshua Casey 37e12b4024 Start backfilling some audit unit tests in post_login_handler 2024-11-27 13:53:01 -06:00
Ryan RichardandJoshua Casey e126ee5495 all callers of Audit() identify which keys may contain PII 2024-11-27 13:53:01 -06:00
Ryan RichardandJoshua Casey a308f3f22a audit log: keep key ordering in personalInfo, render nil slices and maps 2024-11-27 13:53:01 -06:00
Ryan RichardandJoshua Casey c5f4cce3ae make Audit() take struct as param for all optional params and redact PII 2024-11-27 13:53:01 -06:00
Ryan RichardJoshua CaseyJoshua Casey
 		ced8686d11 add config for audit logging, remove Audit() from Logger interface 
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>
 2024-11-27 13:53:01 -06:00
Joshua Casey 76f6b725b8 Fix some rebase conflicts 2024-11-27 13:53:01 -06:00
Joshua Casey f9e1dd4bec Backfill unit tests for garbage_collector audit logging 2024-11-27 13:53:01 -06:00
Joshua CaseyandRyan Richard f4f393e5de Audit event 'HTTP Request Completed' will now log the location with err, error, and error_description query parameters 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-11-27 13:53:01 -06:00
Joshua CaseyandRyan Richard 2db5dda266 Add last audit log unit tests to auth_handler 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-11-27 13:53:01 -06:00
Ryan RichardandJoshua Casey 8cf9c59957 refactor to move audit event message types to their own pkg 2024-11-27 13:53:01 -06:00
Ryan RichardandJoshua Casey 088556193d auth handler audit logs headers and params when http method is wrong 
also refactor some related code into a helper, and fix linter errors
 2024-11-27 13:53:01 -06:00
Joshua Casey 18d3ab3d15 The 'HTTP Request Parameters' audit event now logs params as a JSON object 2024-11-27 13:53:01 -06:00
Joshua Casey dc6faa33bb Log params to token_handler endpoint even during error cases 2024-11-27 13:53:01 -06:00
Joshua Casey 0d22ae2c1a Fix lint and unit test compilation 2024-11-27 13:53:01 -06:00
Joshua Casey 362d982906 Start to backfill some audit unit tests for the token_handler 2024-11-27 13:53:01 -06:00
Ryan RichardandJoshua Casey 1006dd9379 resolve some todos 2024-11-27 13:53:01 -06:00
Joshua Casey 369316556a Add configuration to audit internal endpoints and backfill unit tests 2024-11-27 13:53:01 -06:00
Joshua Casey cf4b29de4b Clarify docs 2024-11-27 13:53:00 -06:00
Joshua Casey 09ca7920ea Extract testutil helper function 2024-11-27 13:53:00 -06:00
Joshua Casey 9994e033b2 Add audit event tests for login_handler 2024-11-27 13:53:00 -06:00
Joshua Casey dd56f2b47f Add audit event tests for callback_handler 2024-11-27 13:53:00 -06:00
Joshua Casey dd42f35db0 plog.TestLogger returns a buffer that holds the logs 
# Conflicts:
#	internal/controller/apicerts/certs_expirer_test.go
#	internal/plog/plog_test.go
#	internal/plog/testing.go
#	pkg/oidcclient/login_test.go
 2024-11-27 13:53:00 -06:00
Joshua Casey a67af9455b Refactor: don't copy the loop variable in test loops 2024-11-27 13:53:00 -06:00
Joshua Casey d729c82f84 fix lint 2024-11-27 13:53:00 -06:00
Joshua CaseyandRyan Richard 44e218194b Add 'AuthorizeID From Parameters' audit logs to the /callback and /login endpoints 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-11-27 13:53:00 -06:00
Joshua Casey bf1e37f149 Use a helper to verify audit messages 2024-11-27 13:53:00 -06:00
Joshua CaseyandRyan Richard aee56c388f Check the sessionID as well 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-11-27 13:53:00 -06:00
Joshua Casey fd5a10bee7 WIP: Add audit event when upstream redirect occurs and backfill tests 2024-11-27 13:53:00 -06:00
Joshua Casey b20e890f15 Add testutil.RequireLogLines to verify multiple log lines at once 2024-11-27 13:53:00 -06:00
Ryan RichardandJoshua Casey 4f9530eec7 audit logging WIP 2024-11-27 13:53:00 -06:00
Ryan Richard e44d70b41d kube cert agent controller avoids unschedulable nodes when possible 2024-11-25 14:20:12 -08:00
Joshua Casey 0c131f11f8 plog.TestLogger returns a buffer instead of taking one in 2024-11-07 17:46:01 -06:00
Ryan Richard 106a480dad JWTAuthenticator must reload when spec.audience or spec.claims changes 2024-11-04 12:49:18 -08:00
Joshua Casey 590f001f17 Run go generate with new version of mock library 2024-10-23 09:09:41 -05:00
Ryan Richard e37d1444c4 bump to github.com/google/go-github/v66 2024-10-15 14:06:34 -07:00
Ryan Richard f36298c542 use required headers for GitHub API connection probe request 2024-10-14 11:12:34 -07:00
Ryan Richard dc195536d0 also use port number when checking https proxy for WebhookAuthenticator 2024-10-11 14:49:46 -07:00
Ryan Richard 4d2bbac674 use .cluster.local address for LUA (squid cannot resolve .svc addresses) 2024-10-10 14:44:14 -07:00
Ryan Richard 4f661aaa69 pay attention to web proxy settings during connection probes 
- WebhookAuthenticator will now detect the proxy setting and skip
  dialing the connection probe if it should go through a proxy
- GitHubIdentityProvider will avoid using tls.Dial altogether
  by instead making a real request to the GitHub API as its
  connection probe, because this will respect the proxy settings
 2024-10-10 10:41:31 -07:00
Joshua T CaseyandJoshua Casey 629f89d95b Check TLS bundle before dialing for performance reasons, and add godoc to clarify intent 
Signed-off-by: Ryan Richard <richardry@vmware.com>
 2024-10-02 14:54:30 -05:00
Joshua Casey 01c2377de0 Refactor tests to use a table 2024-09-24 14:45:07 -05:00
Ashish AmarnathandJoshua Casey 0fab37c089 Update internal/crypto/ptls/dialer_test.go 
ignore lint error on nil context in unit test validating nil context
 2024-09-24 14:14:48 -05:00
Joshua CaseyandJoshua Casey f7fd209f29 Address PR feedback 2024-09-24 14:14:48 -05:00
Joshua CaseyandJoshua Casey 76a116641f Add ptls.Dialer to provide some common configuration for tls.Dial operations 2024-09-24 14:14:48 -05:00