mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-11 10:36:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
3,905 Commits 33 Branches 54 Tags
fe911a7b7a820d5fbd4993a5bed6e19a391b4812
Commit Graph
937 Commits
Author SHA1 Message Date
Joshua Casey fe911a7b7a Prefer slices package and slices.Concat where possible 2024-05-21 09:31:16 -05:00
Joshua Casey 513f43f465 Enforce more imports 
- go.pinniped.dev/generated/latest/apis/concierge/config/v1alpha1
- go.pinniped.dev/generated/latest/client/concierge/clientset/versioned
- go.pinniped.dev/generated/latest/client/concierge/clientset/versioned/scheme
- go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned
- go.pinniped.dev/generated/latest/client/supervisor/clientset/versioned/scheme
 2024-05-21 09:31:15 -05:00
Joshua Casey f5116cddb4 Enable 'makezero' and 'prealloc' linters, and require 'any' instead of 'interface{}' 
Enforce importas:

- go.pinniped.dev/generated/latest/apis/supervisor/config/v1alpha1
- go.pinniped.dev/generated/latest/apis/supervisor/idp/v1alpha1
 2024-05-21 09:31:15 -05:00
Joshua Casey bbe10004b4 Enforce more imports 
- go.pinniped.dev/generated/latest/apis/supervisor/clientsecret/v1alpha1
- go.pinniped.dev/internal/concierge/scheme
 2024-05-21 09:31:15 -05:00
Joshua Casey e9252a9ee3 Enforce more imports 
- k8s.io/apimachinery/pkg/apis/meta/v1
- k8s.io/api/core/v1
- github.com/coreos/go-oidc/v3/oidc
- github.com/ory/fosite/handler/oauth2
- go.pinniped.dev/generated/latest/apis/concierge/authentication/v1alpha1
 2024-05-21 09:31:15 -05:00
Joshua Casey 875b0739aa Enforce aliases for 'k8s.io/apimachinery/pkg/util/errors' and 'k8s.io/apimachinery/pkg/api/errors' 2024-05-21 09:31:15 -05:00
Joshua CaseyandRyan Richard 7787885463 Add federation domain cleanup in E2E integration test 
Co-authored-by: Ryan Richard <richardry@vmware.com>
 2024-05-16 14:18:43 -05:00
Ryan RichardJoshua CaseyJoshua T Casey
 		f320980006 Add integration test to prove that 'pinniped login oidc' will infer the flowtype from the Supervisor's IDP discovery 
Co-authored-by: Joshua T Casey <caseyj@vmware.com>
 2024-05-16 12:57:33 -05:00
Ryan RichardandJoshua Casey 7e0a3c114d Pinniped CLI and the oidc-client package are now enhanced by pinniped_supported_identity_provider_types 
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>
 2024-05-16 12:57:12 -05:00
Ryan Richard e13f4a7f29 refactor ptls to clarify the difference between FIPS and non-FIPS modes 
and backfill some basic tests
 2024-05-13 16:52:15 -07:00
Joshua Casey 81f3acfa38 Update some build tags since go1.22+ is now required 2024-05-10 12:51:03 -05:00
Joshua Casey e9d0ac5110 Enable 'intrange' linter 2024-05-10 12:51:02 -05:00
Joshua Casey 7b36c8ab54 Enable 'copyloopvar' linter 2024-05-10 12:51:02 -05:00
Joshua Casey e04e5e0185 Fix revive linter issues for all production code, and exclude revive linter issues for test code 2024-05-10 12:51:02 -05:00
Ryan Richard 1ac2215724 update an assertion in integration test leaderelection_test.go 2024-04-29 13:22:14 -07:00
Joshua CaseyandRyan Richard 9c2df74e54 Adjust to new K8s 1.30 API 2024-04-26 11:54:53 -07:00
Ryan Richard 57a07a498f Refactors for custom ID token lifetime based on PR feedback 2024-04-24 15:05:00 -07:00
Ryan Richard 136bc7ac09 Mild refactor of integration test for custom ID token lifetimes 2024-04-24 14:13:41 -07:00
Ryan Richard 5dbf05c31d Update the session storage versions due to new ID token lifetime field 2024-04-24 14:13:41 -07:00
Joshua CaseyandRyan Richard b31a893caf Add integration test and fix totalExpectedAPIFields 2024-04-24 14:13:40 -07:00
Ryan Richard def2b35e6e Make ID token lifetimes configurable on OIDCClient resources 2024-04-24 14:13:40 -07:00
Ryan Richard 1d8310ed44 clarify error message for when there is no healthy controller manager 2024-04-22 09:29:37 -07:00
Ryan Richard 7c0c3211d1 fix typo in securetls_fips_test.go 2024-04-19 12:50:05 -07:00
Joshua Casey 94bee9e882 Remove testutil.TLSTestServerWithCert in favor of the testutil/tlsserver package 2024-04-19 10:30:23 -05:00
Joshua Casey 206a16f9e3 Integration test fixes - updated condition messages 2024-04-18 21:32:54 -05:00
Joshua Casey 8ea339139e ldap.Conn.Start() is now deprecated as of https://github.com/go-ldap/ldap/releases/tag/v3.4.7 2024-04-08 06:49:03 -05:00
Benjamin A. Petersen c6b0820438 Fix some utils, spacing, func naming, test inputs, etc. 2024-03-26 16:22:51 -04:00
Benjamin A. Petersen f86c46e160 Update WebhookAuthenticator Status WebhookConnectionValid 
- ConnectionProbeValid -> WebhookConnectionValid
  - This is to conform with the pattern of other controllers, ex:
    LDAPConnectionValid
 2024-03-26 15:33:44 -04:00
Benjamin A. Petersen bec5fe85cc change WebhookAuthenticator TLSConnectionNegotiationValid to ConnectionProbeValid 2024-03-19 18:00:40 -04:00
Benjamin A. Petersen 5bc4e678bf WebhookAuthenticator Status integration test refactor to test table 2024-03-19 17:45:26 -04:00
Benjamin A. Petersen 097e6d5340 Always pass spec to CreateTestWebhookAuthenticator 2024-03-19 16:48:07 -04:00
Benjamin A. Petersen 5c1fa6d52c Adjust testlib/client.go for lint quirk 2024-03-19 16:48:06 -04:00
Benjamin A. Petersen 337459feb0 Update webhook status integration tests 
- total api fields test 260->261
 2024-03-19 16:48:05 -04:00
Benjamin A. Petersen 590e2d18f7 Add WebhookAuthenticator integration tests, expand unit tests 
- Add WebhookAuthenticator unit tests, update generated code
- Add validateTLSNegotiation(), update tests
- Update validateTLSNegotiation, add unit tests, factor out helpers
- Update generated code
 2024-03-19 16:48:05 -04:00
Benjamin A. Petersen ef36b454ba Improve WebhookAuthenticator Status and Validations 
- Validate TLS Configuration
- Validate Endpoint
- Validate TLS Negotiation
  - Report status handshake negotiation with webhook
- Unit tests
- Integration tests
 2024-03-19 16:48:03 -04:00
Ryan RichardandGitHub d49b011d65 Merge branch 'main' into cli_callback_cors_get 2024-03-08 11:36:32 -08:00
Ryan Richard f55d56bf4a CLI's localhost listener handles CORS preflight requests for GETs 2024-03-08 10:45:57 -08:00
Joshua Casey ffc49d96b3 Integration tests should use a valid value for CredentialIssuer spec.impersonationProxy.service.type 2024-03-08 11:19:15 -06:00
Joshua Casey ab0682917a whoami integration test now allows for additional extra fields in K8s 1.30+ 2024-03-07 08:09:16 -06:00
Ryan RichardandJoshua Casey e43cf81c38 Add some logging and comments making it easier to debug with chrome 
Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>
 2024-03-05 13:26:08 -08:00
Ryan Richard f498cb3918 wait for JWTAuthenticator to be phase=ready in supervisor warnings test 2024-02-27 15:45:33 -08:00
Benjamin A. PetersenandRyan Richard e8482ab9e9 Update jwtauthenticator unit tests to check actions 
- Add test to verify timestamps are particularly updated
- Improve diff output in tests for actions
- Make jwtauthenticator status tests parallel
- Update copyright headers in multiple files
 2024-02-27 15:45:32 -08:00
Benjamin A. PetersenandRyan Richard 868ff9ed2b Update jwk authenticator status integration tests 2024-02-27 15:45:32 -08:00
Benjamin A. PetersenandRyan Richard 73e4d3144b Add integration tests for JWTAuthenticators 
- paired with changes to e2e_test.go, adds Status.Condition assertions
  around JWTAuthenticators
 2024-02-27 15:45:32 -08:00
Benjamin A. PetersenandRyan Richard 1a633adde6 add WaitForJWTAuthenticatorStatusPhase() integration helper 2024-02-27 15:45:32 -08:00
Benjamin A. PetersenandRyan Richard 09bd51f481 fix comment in testlib/client.go 2024-02-27 15:45:32 -08:00
Benjamin A. PetersenandRyan Richard 084c3114f4 Improve jwtcachefiller tests 
- some format updates
- add timestamp to test
- fix order of expect,actual in some assertions
- remove some commented code no longer needed
 2024-02-27 15:45:32 -08:00
Ryan Richard 0d31e955ae Don't skip upstream group memberships when groups scope is not granted 
Background: For dynamic clients, the groups scope is not always allowed
and/or requested by the client, so it will not always be granted by the
Supervisor for an authorization request.

Previously, when the groups scope was not granted, we would skip
searching for upstream groups in some scenarios.

This commit changes the behavior of authorization flows so that even
when the groups scope is not granted we still search for the upstream
group memberships as configured, and we pass the upstream group
memberships into any configured identity transformations. The identity
transformations could potentially reject the user's authentication based
on their upstream group membership.

When the groups scope is not granted, we don't include the groups in
the final Supervisor-issued ID token. This behavior is not changed.
 2024-02-21 13:12:18 -08:00
Ryan Richard 9db87132b1 More refactoring of auth handler and related refactor of upstreamldap 
- continued refactoring the auth handler to share more code between
  the two supported browserless flows: OIDC and LDAP/AD
- the upstreamldap package should not know about the concept of
  OIDC granted scopes, so refactored it to be a skipGroups bool
 2024-02-20 09:26:34 -08:00
Ryan Richard dce9409ccc login oidc cmd checks access token expiry before doing token exchange 
In the RFC8693 token exchange, the CLI sends your access token and
receives in exchange a new cluster-scoped ID token.

Fix a bug in the CLI. Whenever the "pinniped login oidc" command was
planning to perform the RFC8693 token exchange, it failed to check if
the cached access token was still valid before performing the exchange,
which sends the access token. It instead checked if the cached ID token
was still valid, but that it not relevant in this situation because the
ID token is not going to be used for anything (instead the new ID token
returned by the RFC8693 token exchange will be used for auth).

This bug doesn't actually matter today, because the Supervisor-issued
access and ID tokens always both have the same 2-minute lifetimes.
However, future enhancements may cause them to have different lifetimes
in certain circumstances. Fixing this CLI bug now to prepare for those
potential future enhancements.
 2024-02-09 13:33:30 -08:00