mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-28 02:52:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
2,868 Commits 16 Branches 54 Tags
eb891d77a5a2d03bbf372ebb76026d3bdb5cbb68
Commit Graph
912 Commits
Author SHA1 Message Date
Ryan Richard acc6c50e48 More unit tests for LDAP DNs which contain special chars 
Adding explicit coverage for PerformRefresh().
 2022-05-03 15:43:01 -07:00
Ryan Richard c74dea6405 Escape special characters in LDAP DNs when used in search filters 2022-05-02 13:37:32 -07:00
Ryan RichardandGitHub 0ec5e57114 Merge pull request #1131 from vmware-tanzu/bump_some_deps 
Bump some deps
 2022-04-19 13:29:28 -07:00
Margo Crawford 0b72f7084c JWTAuthenticator distributed claims resolution honors tls config 
Kube 1.23 introduced a new field on the OIDC Authenticator which
allows us to pass in a client with our own TLS config. See
https://github.com/kubernetes/kubernetes/pull/106141.

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-19 11:36:46 -07:00
Ryan Richard 132d2aac72 add a code comment 2022-04-19 11:35:46 -07:00
Ryan Richard 2d4f4e4efd Merge branch 'main' into bump_some_deps 2022-04-19 11:32:53 -07:00
Ryan Richard fb8083d024 bump some direct deps 2022-04-19 11:09:24 -07:00
hectorj2f a3f7afaec4 oidc: add code challenge supported methods 
Signed-off-by: hectorj2f <hectorf@vmware.com>
 2022-04-19 01:21:39 +02:00
Margo Crawford d5337c9c19 Error format of untrusted certificate errors should depend on OS 
Go 1.18.1 started using MacOS' x509 verification APIs on Macs
rather than Go's own. The error messages are different.

Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-14 17:37:36 -07:00
Margo Crawford 03f19da21c the http2RoundTripper should only use http2 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-04-14 10:51:25 -07:00
Monis Khan e0886c6948 Only emit FIPS startup log when running a server component 
Signed-off-by: Monis Khan <mok@vmware.com>
 2022-04-13 18:31:02 -04:00
Monis Khan 8fd77b72df Bump to go1.18.1 and fix linter errors 
Signed-off-by: Monis Khan <mok@vmware.com>
 2022-04-13 16:43:06 -04:00
Ryan Richard 53348b8464 Add custom prefix to downstream access and refresh tokens and authcodes 2022-04-13 10:13:27 -07:00
Monis Khan 6b4fbb6e0e Use klog to make sure FIPS init log is emitted 
We cannot use plog until the log level config has been setup, but
that occurs after this init function has run.

Signed-off-by: Monis Khan <mok@vmware.com>
 2022-04-12 14:36:06 -04:00
Ryan Richard 25d20d4081 Merge branch 'main' into disable_http 2022-04-05 09:00:26 -07:00
Monis Khan 07066e020d Explicitly set defaultServing ciphers in FIPS mode 
This is a no-op today, but could change in the future when we add
support for FIPS in non-strict mode.

Signed-off-by: Monis Khan <mok@vmware.com>
 2022-04-01 10:59:47 -04:00
Monis Khan 3f0753ec5a Remove duplication in secure TLS tests 
Signed-off-by: Monis Khan <mok@vmware.com>
 2022-04-01 10:56:38 -04:00
Monis Khan 15bc6a4a67 Add more details to FIPS comments 
Signed-off-by: Monis Khan <mok@vmware.com>
 2022-04-01 10:56:38 -04:00
Ryan Richard 51c527a965 Change to camel-case for insecureAcceptExternalUnencryptedHttpRequests 
- Use camel-case in the static configmap
- Parse the value into a boolean in the go struct instead of a string
- Add test for when unsupported value is used in the configmap
- Run the config_test.go tests in parallel
- Update some paragraphs in configure-supervisor.md for clarity
 2022-03-31 16:23:45 -07:00
Ryan Richard ae7aac020a Merge branch 'main' into disable_http 2022-03-30 11:30:32 -07:00
Margo Crawford 53597bb824 Introduce FIPS compatibility 
Signed-off-by: Margo Crawford <margaretc@vmware.com>
 2022-03-29 16:58:41 -07:00
Ryan Richard 488f08dd6e Provide a way to override the new HTTP loopback-only validation 
Add new deprecated_insecure_accept_external_unencrypted_http_requests
value in values.yaml. Allow it to be a boolean or a string to make it
easier to use (both --data-value and --data-value-yaml will work).

Also:
- Consider "ip6-localhost" and "ip6-loopback" to be loopback addresses
  for the validation
- Remove unused env.SupervisorHTTPAddress var
- Deprecate the `service_http_*` values in values.yaml by renaming them
  and causing a ytt render error when the old names are used
 2022-03-28 17:03:23 -07:00
Ryan Richard 8d12c1b674 HTTP listener: default disabled and may only bind to loopback interfaces 2022-03-24 15:46:10 -07:00
Ryan Richard 48c5a625a5 Remove our direct dependency on ory/x 
ory/x has new releases very often, sometimes multiple times per week,
causing a lot of noise from dependabot. We were barely using it
directly, so replace our direct usages with equivalent code.
 2022-03-24 10:24:54 -07:00
Ryan Richard fffcb7f5b4 Update to github.com/golangci/golangci-lint/cmd/golangci-lint@v1.44.2 
- Two of the linters changed their names
- Updated code and nolint comments to make all linters pass with 1.44.2
- Added a new hack/install-linter.sh script to help developers install
  the expected version of the linter for local development
 2022-03-08 12:28:09 -08:00
Monis Khan eae55a8595 Fix typo in group removed warning 
Signed-off-by: Monis Khan <mok@vmware.com>
 2022-03-02 12:58:30 -05:00
Margo Crawford 609b55a6d7 Pinniped Supervisor should issue a warning when groups change during refresh 2022-03-01 14:01:57 -08:00
Margo Crawford fdac4d16f0 Only run group refresh when the skipGroupRefresh boolean isn't set 
for AD and LDAP
 2022-02-17 12:50:28 -08:00
Margo Crawford 662f2cef9c Integration test for updating group search base 
Also a small change to a comment
 2022-02-17 11:29:59 -08:00
Margo Crawford ca523b1f20 Always update groups even if it's nil 
Also de-dup groups and various small formatting changes
 2022-02-17 11:29:59 -08:00
Margo Crawford c28602f275 Add unit tests for group parsing overrides 2022-02-17 11:29:59 -08:00
Margo Crawford dd11c02b6a Add back entries because I think it's actually necessary 2022-02-17 11:29:59 -08:00
Margo Crawford f890fad90c Rename a function, sort strings inside searchGroupsForUserDN 2022-02-17 11:29:59 -08:00
Margo Crawford cd7538861a Add integration test where we don't get groups back 2022-02-17 11:29:59 -08:00
Margo Crawford 013b521838 Upstream ldap group refresh: 
- Doing it inline on the refresh request
 2022-02-17 11:29:59 -08:00
Ryan Richard e5a60a8c84 Update a comment 2022-02-16 11:09:05 -08:00
Monis Khan 49e88dd74a Change some single quotes to double quotes in minified JS 
Signed-off-by: Monis Khan <mok@vmware.com>
 2022-02-10 16:15:26 -05:00
Ryan Richard 5d79d4b9dc Fix form_post.js mistake from recent commit; Better CORS on callback 2022-02-08 17:30:48 -08:00
Ryan Richard 6781bfd7d8 Fix JS bug: form post UI shows manual copy/paste UI upon failed callback 
When the POST to the CLI's localhost callback endpoint results in a
non-2XX status code, then treat that as a failed login attempt and
automatically show the manual copy/paste UI.
 2022-02-07 16:21:23 -08:00
Margo Crawford b30dad72ed Fix new refresh token grace period test to have warnings 2022-01-20 14:54:59 -08:00
Margo CrawfordandGitHub 31cdd808ac Merge pull request #951 from vmware-tanzu/short-session-warning 
Supervisor should emit a warning when access token lifetime is too short
 2022-01-20 14:44:32 -08:00
Ryan RichardandGitHub e85a6c09f6 Merge pull request #953 from vmware-tanzu/dependabot/go_modules/github.com/tdewolff/minify/v2-2.9.29 
Bump github.com/tdewolff/minify/v2 from 2.9.26 to 2.9.29
 2022-01-20 14:16:05 -08:00
Margo Crawford 38d184fe81 Integration test + making sure we get the session correctly in token handler 2022-01-20 13:48:50 -08:00
Margo Crawford b0ea7063c7 Supervisor should emit a warning when access token lifetime is too short 2022-01-20 13:48:50 -08:00
Ryan RichardandGitHub db789dc2bf Merge branch 'main' into dependabot/go_modules/github.com/tdewolff/minify/v2-2.9.29 2022-01-20 12:10:24 -08:00
Ryan RichardandGitHub 6ddc953989 Merge branch 'main' into dependabot/go_modules/github.com/ory/fosite-0.42.0 2022-01-20 12:10:01 -08:00
Ryan Richard dff53b8144 Changes for Fosite's new RevokeRefreshTokenMaybeGracePeriod() interface 
Fosite v0.42.0 introduced a new RevokeRefreshTokenMaybeGracePeriod()
interface function. Updated our code to support this change. We didn't
support grace periods on refresh tokens before, so implemented it by
making the new RevokeRefreshTokenMaybeGracePeriod() method just call
the old RevokeRefreshToken() method, therefore keeping our old behavior.
 2022-01-19 13:57:01 -08:00
Ryan Richard 3b1cc30e8d Update unit test to match new JS minify output after minify upgrade 2022-01-19 13:29:07 -08:00
Ryan Richard a4ca44ca14 Improve error handling when upstream groups is invalid during refresh 2022-01-19 12:57:47 -08:00
Ryan RichardandGitHub 78bdb1928a Merge branch 'main' into upstream-oidc-refresh-groups 2022-01-18 16:03:14 -08:00