Commit Graph

  • 7cda6628a6 Merge branch 'main' into fosite-settings Ryan Richard 2020-12-11 18:19:37 -08:00
  • 020fbcf190 Adjust some expectations about the state and nonce lengths Ryan Richard 2020-12-11 17:39:58 -08:00
  • 791c50fd33 Merge pull request #278 from vmware-tanzu/fosite-storage-gc Ryan Richard 2020-12-11 17:17:15 -08:00
  • 2a19dd0d2e Pass prompt through to upstream login request Margo Crawford 2020-12-11 17:13:27 -08:00
  • ded28dff15 Update the fosite settings Margo Crawford 2020-12-11 16:15:50 -08:00
  • baa1a4a2fc Supervisor storage garbage collection controller enabled in production Ryan Richard 2020-12-11 15:21:34 -08:00
  • 022dcd1909 Update secretgenerator controller after synchronous review Andrew Keesler 2020-12-11 15:37:10 -05:00
  • e2aad48852 internal/oidc/dynamiccodec: loosen test to reduce flakes Andrew Keesler 2020-12-11 11:46:24 -05:00
  • e17bc31b29 Pass CSRF cookie signing key from controller to cache Andrew Keesler 2020-12-11 11:11:49 -05:00
  • 22c5b102ed internal/downward: add support for (optional) pod name Andrew Keesler 2020-12-11 10:57:20 -05:00
  • 0246e57d7f Set lifespans on state and CSRF cooking encoding Andrew Keesler 2020-12-11 11:11:10 -05:00
  • 9460b08873 Use just-in-time HMAC signing key fetching in our Fosite config Andrew Keesler 2020-12-11 11:01:07 -05:00
  • ed9b3ffce5 Add controller for garbage collecting secrets Margo Crawford 2020-12-10 17:34:05 -08:00
  • a3285fc187 Fix variable / package name collision aram price 2020-12-10 17:28:47 -08:00
  • e1173eb5eb manager.Manager is initialized with secret.Cache aram price 2020-12-10 17:27:02 -08:00
  • 72bc458c8e Manager uses secret.Cach with hardcoded values aram price 2020-12-10 17:18:02 -08:00
  • e067892ffc Add secret.Cache to hold crypto inputs Andrew Keesler 2020-12-10 13:54:02 -08:00
  • 2f87be3f94 Manager uses dynamiccodec.Codec for cookie encoding aram price 2020-12-10 11:35:32 -08:00
  • 1291380611 dynamiccodec.Codec uses securecookie.JSONEncoder Andrew Keesler 2020-12-10 11:34:39 -08:00
  • ccac124b7a Fix broken test aram price 2020-12-10 11:29:13 -08:00
  • d8212d1337 Whitespace Andrew Keesler 2020-12-10 11:01:03 -08:00
  • 030edaf72d KeyFunc no longer uses multi-value return aram price 2020-12-10 10:51:15 -08:00
  • c3f73ffb57 Check in some musings on a symmetric key generator controller Andrew Keesler 2020-12-10 11:54:36 -05:00
  • 3e112fb1ac internal/oidc/dynamiccodec: first draft Andrew Keesler 2020-12-10 09:37:06 -05:00
  • afd216308b KubeStorage annotates every Secret with garbage-collect-after timestamp Ryan Richard 2020-12-10 14:47:58 -08:00
  • b0c354637d WIP passing lifetime through to storage, unit tests are failing Margo Crawford 2020-12-10 12:15:40 -08:00
  • c001bb876e Merge pull request #275 from vmware-tanzu/fosite-storage-gc-prefactor Ryan Richard 2020-12-10 10:50:29 -08:00
  • 3c6d1a1924 Merge branch 'main' into fosite-storage-gc Ryan Richard 2020-12-10 10:45:26 -08:00
  • 6f40dcb471 Increase the RefreshTokenSessionStorageLifetime Margo Crawford 2020-12-10 10:44:27 -08:00
  • a561fd21d9 Consolidate the supervisor's timeout settings into a single struct Ryan Richard 2020-12-10 10:14:54 -08:00
  • 40c9e8472c Merge pull request #272 from mattmoyer/default-cli-scopes Matt Moyer 2020-12-10 11:41:22 -06:00
  • e7338da3dc Tweak default CLI --scopes parameter to match supervisor use case. Matt Moyer 2020-12-10 10:33:43 -06:00
  • 0c52739997 Merge pull request #271 from mattmoyer/fix-cli-content-type-parsing Matt Moyer 2020-12-10 10:46:10 -06:00
  • 9d3c98232b Fix bug in handling response content-type in oidcclient. Matt Moyer 2020-12-10 10:09:42 -06:00
  • 5a0918afde Merge pull request #270 from mattmoyer/default-cli-client-id Matt Moyer 2020-12-10 10:12:28 -06:00
  • 4395d5a0ca Add a default --client-id in pinniped login oidc command. Matt Moyer 2020-12-10 09:46:07 -06:00
  • d83927ae75 Merge pull request #268 from vmware-tanzu/secret-generation-prefactor Andrew Keesler 2020-12-10 08:39:32 -05:00
  • 86c75b7a80 CSRF cookie is no longer encrypted aram price 2020-12-09 17:29:44 -08:00
  • f1f8ffa456 Distinct Encoder's use distinct keys aram price 2020-12-09 17:26:48 -08:00
  • 4a5f8e30a8 Use distinct Encoder for state and csrf data aram price 2020-12-09 17:24:12 -08:00
  • e111ca02da Use the narrowest possible interface aram price 2020-12-09 17:20:57 -08:00
  • 6ec3589112 Use recorder Cookies() helper aram price 2020-12-09 16:29:25 -08:00
  • 2ddba8d825 Merge pull request #267 from vmware-tanzu/token-exchange-endpoint Margo Crawford 2020-12-09 17:13:28 -08:00
  • 218f27306c Integration test for refresh grant Margo Crawford 2020-12-09 17:07:37 -08:00
  • fde2e6fa97 Merge remote-tracking branch 'origin/main' into token-exchange-endpoint Margo Crawford 2020-12-09 15:22:54 -08:00
  • 4d82ec1283 Merge pull request #262 from vmware-tanzu/token-refresh Ryan Richard 2020-12-09 15:22:02 -08:00
  • 5b7c510577 Fixed error handling for token exchange when openid scope missing Ryan Richard 2020-12-09 15:15:50 -08:00
  • 0abadddb1a token_handler_test.go: modify a test about refresh request scopes param Ryan Richard 2020-12-09 15:03:52 -08:00
  • 5f6e7de785 Merge branch 'token-refresh' into token-exchange-endpoint Margo Crawford 2020-12-09 14:56:41 -08:00
  • 64631d5780 token_handler_test.go: add even more test cases for refresh grant Ryan Richard 2020-12-09 14:53:39 -08:00
  • 0386658d26 token_handler_test.go: add more test cases for refresh grant Ryan Richard 2020-12-09 14:12:00 -08:00
  • 167d440b65 Remove this unneccesary go113 nolint directives. Matt Moyer 2020-12-09 14:51:27 -06:00
  • 3e6ebab389 Clean up TestTokenExchange a bit. Matt Moyer 2020-12-09 14:49:44 -06:00
  • f90b5d48de Merge branch 'token-refresh' of github.com:vmware-tanzu/pinniped into token-exchange-endpoint Matt Moyer 2020-12-09 14:46:57 -06:00
  • 016b0e9a8e Satisfy the pedantic linter config 🙃. Matt Moyer 2020-12-09 14:41:27 -06:00
  • 51c828382f Supervisor token endpoint supports refresh grant type Ryan Richard 2020-12-09 12:12:59 -08:00
  • 02d96d731f Finish TestTokenExchange unit tests and add missing scope check. Matt Moyer 2020-12-09 13:56:53 -06:00
  • cac3a3520f Merge branch 'main' into token-refresh Ryan Richard 2020-12-09 09:58:21 -08:00
  • b04db6ad2b Fix some false positive gosec warnings. Matt Moyer 2020-12-09 10:42:37 -06:00
  • f1aff2faab Start extending TestSupervisorLogin to test the token exchange flow (WIP). Matt Moyer 2020-12-09 10:23:10 -06:00
  • b1542be7b1 In oidcclient token exchange request, pass client_id but don't bother with authorization header. Matt Moyer 2020-12-09 10:08:41 -06:00
  • 1db2ae3a45 Add more parameter validations and refactor internal/oidc/token_exchange.go. Matt Moyer 2020-12-09 10:04:58 -06:00
  • e25d090ca9 Merge branch 'main' of github.com:vmware-tanzu/pinniped into token-exchange-endpoint Matt Moyer 2020-12-09 10:00:54 -06:00
  • 5f4348c57d Merge pull request #266 from ankeesler/fix-jwt-auth-ca-bundle Andrew Keesler 2020-12-09 10:43:33 -05:00
  • 644cb687b9 Grant the Pinniped STS scope in authorize/callback handlers. Matt Moyer 2020-12-09 09:36:45 -06:00
  • bebe25c32e Merge branch 'main' of github.com:vmware-tanzu/pinniped into token-exchange-endpoint Matt Moyer 2020-12-09 09:25:58 -06:00
  • 4c0fb12cf6 test/integration: only set JWTAuthenticator CA bundle when it exists Andrew Keesler 2020-12-09 09:51:58 -05:00
  • 93cfd8c93a Fix prepare-for-integration-tests.sh and Tiltfile for kubectl 1.20 Andrew Keesler 2020-12-09 09:50:50 -05:00
  • 5f1bd5ec31 Update TestNullStorage_GetClient with adjusted pinniped-cli scopes. Matt Moyer 2020-12-09 09:12:32 -06:00
  • 8fcc176d8b Merge pull request #258 from ankeesler/jwt-authenticator Andrew Keesler 2020-12-09 08:21:04 -05:00
  • 6420caca94 Bring back the test that was skipped by the previous commit Ryan Richard 2020-12-08 18:25:01 -08:00
  • f84dda937b Merge branch 'token-refresh' into token-exchange-endpoint Ryan Richard 2020-12-08 18:12:12 -08:00
  • ef4ef583dc token_handler_test.go: Refactor how we specify the expected results Ryan Richard 2020-12-08 18:10:55 -08:00
  • f103c02408 Add check for grant type in tokenexchangehandler, Margo Crawford 2020-12-08 17:33:08 -08:00
  • ef3f837800 Merge remote-tracking branch 'origin/token-refresh' into token-exchange-endpoint Margo Crawford 2020-12-08 16:58:35 -08:00
  • 170982a688 refactor token_handler_test.go: easier to make more requests after initial authcode exchange Ryan Richard 2020-12-08 16:54:58 -08:00
  • a852baac75 Merge remote-tracking branch 'origin/token-refresh' into token-exchange-endpoint Margo Crawford 2020-12-08 12:55:44 -08:00
  • 381a2e749a impotent -> idempotent Andrew Keesler 2020-12-08 15:36:27 -05:00
  • 9ed5dcb031 Only create underlying jwt authenticator when spec has changed Aram Price 2020-12-08 15:14:05 -05:00
  • e0ee18a993 Always close JWTAuthenticator underlying authenticator Andrew Keesler 2020-12-08 11:08:53 -05:00
  • 0efc19a1b7 Support JWTAuthenticator in pinniped CLI Andrew Keesler 2020-12-07 20:40:20 -05:00
  • 57103e0a9f Add JWTAuthenticator controller Andrew Keesler 2020-12-07 20:39:51 -05:00
  • 946b0539d2 Add JWTAuthenticator API type Andrew Keesler 2020-12-07 20:37:43 -05:00
  • a9111f39af Merge branch 'main' into token-refresh Ryan Richard 2020-12-08 12:32:41 -08:00
  • 18d90a727e token_handler_test.go: refresh token gets deleted when authcode reused Ryan Richard 2020-12-08 12:12:55 -08:00
  • c090eb6a62 Supervisor token endpoint returns refresh tokens when requested Ryan Richard 2020-12-08 11:47:39 -08:00
  • 8f51993db2 Merge pull request #265 from vmware-tanzu/scope-constants Andrew Keesler 2020-12-08 14:32:09 -05:00
  • 8d2b8ae6b5 Use constants for scope values aram price 2020-12-08 10:46:05 -08:00
  • afbef23a51 WIP implementing TokenExchangeHandler methods Matt Moyer 2020-12-08 10:17:03 -08:00
  • e5ecaf01a0 WIP stubbing out tokenexchangehandler Margo Crawford 2020-12-07 17:28:51 -08:00
  • b7b6816531 Merge pull request #259 from mattmoyer/add-cli-request-audience Margo Crawford 2020-12-08 09:26:19 -08:00
  • bfcd2569e9 Add a --request-audience flag to the pinniped login oidc CLI command. Matt Moyer 2020-12-04 17:33:53 -06:00
  • d91baba240 authorize and callback endpoints now handle the offline_access scope Aram Price 2020-12-07 17:22:34 -08:00
  • 6a90a10123 Merge pull request #249 from vmware-tanzu/token-endpoint Ryan Richard 2020-12-07 15:08:07 -08:00
  • 12e5f94e75 Merge branch 'main' into token-endpoint Ryan Richard 2020-12-07 14:23:40 -08:00
  • e1ae48f2e4 Discovery does not return token_endpoint_auth_signing_alg_values_supported Ryan Richard 2020-12-07 14:15:31 -08:00
  • dcaf9166dc Merge pull request #261 from mattmoyer/remove-goerr113-linter Matt Moyer 2020-12-07 16:07:11 -06:00
  • 9e945d7547 Disable the goerr113 linter. Matt Moyer 2020-12-07 15:51:41 -06:00
  • 648fa4b9ba Backfill test for token endpoint error when JWK is not yet available Aram Price 2020-12-07 11:53:24 -08:00
  • e0b6133bf1 Integration tests call supervisor token endpoint and validate response Ryan Richard 2020-12-04 17:07:04 -08:00