Caleb Doxsey
a0e64b1cf9
authorize: add request IP to rego evaluation ( #3107 )
2022-03-07 15:07:58 -07:00
Caleb Doxsey
99b9a3ee12
authorize: add support for passing access or id token upstream ( #3047 )
...
* authorize: add support for passing access or id token upstream
* use an enum
2022-02-17 09:28:31 -07:00
Caleb Doxsey
f9b95a276b
authenticate: support for per-route client id and client secret ( #3030 )
...
* implement dynamic provider support
* authenticate: support per-route client id and secret
2022-02-16 12:31:55 -07:00
Caleb Doxsey
46c4d5fa7e
session: remove unused session state properties ( #3022 )
...
* fix error page
* share dashboard code
* sessions: remove unused session state properties
* remove programmatic
* remove version
2022-02-09 10:59:06 -07:00
Caleb Doxsey
0898dd4f34
proxy: fix error page ( #3020 )
...
* fix error page
* proxy: fix error page
* share dashboard code
* fix test
2022-02-09 09:14:24 -07:00
Caleb Doxsey
2824faecbf
frontend: react+mui ( #3004 )
...
* mui v5 wip
* wip
* wip
* wip
* use compressor for all controlplane endpoints
* wip
* wip
* add deps
* fix authenticate URL
* fix test
* fix test
* fix build
* maybe fix build
* fix integration test
* remove image asset test
* add yarn.lock
2022-02-07 08:47:58 -07:00
Caleb Doxsey
5b9a981191
handle device states in deny block, fix default device type ( #2919 )
...
* handle device states in deny block, fix default device type
* fix tests
2022-01-11 11:56:54 -07:00
cfanbo
84dad4c612
remove deprecated ioutil usages ( #2877 )
...
* fix: Fixed return description error
* config/options: Adjust the position of TracingJaegerAgentEndpoint option
* DOCS: Remove duplicate configuration items
Remove duplicate configuration items of route
* remove deprecated ioutil usages
2021-12-30 10:02:12 -08:00
Caleb Doxsey
a3be1b7cc5
devices: switch "default" device type to two built-in default device types ( #2835 )
2021-12-20 10:44:29 -07:00
Caleb Doxsey
5a858f5d48
config: add internal service URLs ( #2801 )
...
* config: add internal service URLs
* maybe fix integration tests
* add docs
* fix integration tests
* for databroker connect to external name, but listen on internal name
* Update docs/reference/readme.md
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/readme.md
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/readme.md
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
2021-12-10 14:04:37 -05:00
Caleb Doxsey
2d04106e6d
ppl: add support for http_path and http_method ( #2813 )
...
* ppl: add support for http_path and http_method
* fix import ordering
2021-12-10 07:28:51 -07:00
Caleb Doxsey
c97dcf7e0f
envoy: add hash policy and routing key for hash-based load balancers ( #2791 )
...
* envoy: add hash policy and routing key for hash-based load balancers
* fix integration test
* fix nginx
2021-12-01 13:42:12 -07:00
Caleb Doxsey
a8b76bd623
authorize: support X-Pomerium-Authorization in addition to Authorization ( #2780 )
...
* authorize: support X-Pomerium-Authorization in addition to Authorization
* tangentental correction
Co-authored-by: alexfornuto <alex@fornuto.com>
2021-11-29 12:19:14 -07:00
Caleb Doxsey
d390e80b30
authenticate: add databroker versions to session cookie ( #2709 )
...
* authenticate: add databroker versions to session cookie
authorize: wait for databroker synchronization on updated sessions
* fix test
2021-10-26 14:45:53 -06:00
Caleb Doxsey
3497c39b9b
authorize: add support for webauthn device policy enforcement ( #2700 )
...
* authorize: add support for webauthn device policy enforcement
* update docs
* group statuses
2021-10-25 09:41:03 -06:00
Caleb Doxsey
6e48627b4d
ppl: add support for additional data ( #2696 )
...
* ppl: add support for additional data
* remove unused NewCriterionDeviceRule
2021-10-22 12:32:20 -06:00
Caleb Doxsey
efffe57bf0
ppl: pass contextual information through policy ( #2612 )
...
* ppl: pass contextual information through policy
* maybe fix nginx
* fix nginx
* pr comments
* go mod tidy
2021-09-20 16:02:26 -06:00
Caleb Doxsey
0786c7fc45
authorize: use session.user_id in headers ( #2571 )
2021-09-03 14:51:09 -06:00
Caleb Doxsey
33f5190572
config: remove signature_key_algorithm ( #2557 )
...
* config: remove signature_key_algorithm
* typo
* add more tests
2021-09-02 11:36:43 -06:00
Caleb Doxsey
de1ed61b9a
authorize: fix google cloudrun header audience ( #2558 )
2021-09-02 09:55:06 -06:00
Caleb Doxsey
ef55829cb0
authorize: fix X-Pomerium-Claim-Groups ( #2539 )
2021-08-26 20:29:57 -06:00
Caleb Doxsey
f5a558d4a0
grpc: disable gRPC connection re-use across services ( #2515 )
2021-08-24 11:47:16 -06:00
Caleb Doxsey
526f946097
fix forward-auth, logging ( #2509 )
...
* fix forward-auth, logging
* move error message
2021-08-23 17:50:04 -06:00
Caleb Doxsey
bbec2cae9f
grpc: send client traffic through envoy ( #2469 )
...
* wip
* wip
* handle wildcards in override name
* remove wait for ready, add comment about sync, force initial sync complete in test
* address comments
2021-08-16 16:12:22 -06:00
bobby
87c3c675d2
all: remove unused handler code ( #2439 )
...
* - Remove unused middleware
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
* remove unused func weightedStrings
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
* remove unused func getJWTSetCookieHeaders
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
* Fix test name
2021-08-16 16:04:39 -04:00
Caleb Doxsey
6af0655206
protoutil: add NewAny method for deterministic serialization ( #2462 )
2021-08-09 17:51:57 -06:00
Caleb Doxsey
a64e5b5fa1
authorize: add sid to JWT claims ( #2420 )
...
* authorize: add sid to JWT claims
* fix import ordering
2021-08-02 16:11:05 -06:00
Caleb Doxsey
57c0c0a1bc
authorize: log additional session details ( #2419 )
2021-08-02 12:08:34 -06:00
Caleb Doxsey
1a95036b8c
sessions: add impersonate_session_id, remove legacy impersonation ( #2407 )
...
* sessions: add impersonate_session_id, remove legacy impersonation
* show impersonated user details
* fix headers
* address feedback
* only check impersonate id on non-nil pbSession
* Revert "only check impersonate id on non-nil pbSession"
This reverts commit a6f7ca5abd
2021-07-30 08:42:36 -06:00
bobby
aa0e6872de
evaluator: use cryputil to hash ( #2384 )
...
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2021-07-22 06:15:54 -07:00
Caleb Doxsey
c7a8f11d9a
authorize: add additional tracing for rego evaluation ( #2381 )
2021-07-21 15:37:51 -06:00
Caleb Doxsey
cef08a1c2d
authorize: remove service account impersonate user id, email and groups ( #2365 )
2021-07-15 09:31:45 -06:00
Caleb Doxsey
360aa89505
authorize: allow redirects on deny ( #2361 )
2021-07-13 15:41:36 -06:00
Caleb Doxsey
b4b86dccb4
authorize: decode CheckRequest path for redirect ( #2357 )
2021-07-13 13:17:21 -06:00
Caleb Doxsey
8e155bdf61
authorize: log service account and impersonation details ( #2354 )
2021-07-12 14:21:37 -06:00
Caleb Doxsey
21ffe44dff
authorize: support boolean deny results ( #2338 )
...
* authorize: support boolean deny results
* add client certificate test
* handle different array lengths
2021-07-06 12:52:26 -06:00
wasaga
7d0db7d8ff
authorize: do not send redirects to gRPC ( #2314 )
2021-07-06 10:24:33 -04:00
Caleb Doxsey
f9675f61cc
deps: upgrade to go-jose v3 ( #2284 )
2021-06-10 09:35:44 -06:00
Caleb Doxsey
2156dbc553
envoy: always set jwt claim headers even if no value is available ( #2261 )
...
* envoy: always set jwt claim headers even if no value is available
* add test
2021-06-04 10:01:00 -07:00
Caleb Doxsey
699f3f461f
authorize: handle grpc-web content types like json ( #2268 )
2021-06-04 10:12:55 -06:00
Caleb Doxsey
9dc90d02d0
authorize: only redirect for HTML pages ( #2264 )
...
* authorize: only redirect for HTML pages
* authorize: only redirect for HTML pages
2021-06-02 16:18:02 -06:00
wasaga
40ddc2c4b3
jwt: round timestamp ( #2258 )
2021-06-01 14:12:45 -07:00
wasaga
12c8bb2da4
authorize: preserve original context ( #2247 )
2021-06-01 11:10:35 -04:00
Caleb Doxsey
dad35bcfb0
ppl: refactor authorize to evaluate PPL ( #2224 )
...
* ppl: refactor authorize to evaluate PPL
* remove opa test step
* add log statement
* simplify assignment
* deny with forbidden if logged in
* add safeEval function
* create evaluator-specific config and options
* embed the headers rego file directly
2021-05-21 09:50:18 -06:00
Caleb Doxsey
0adbf4f24c
controlplane: save configuration events to databroker ( #2153 )
...
* envoy: save events to databroker
* controlplane: add tests for envoy configuration events
* format imports
2021-04-29 15:51:46 -06:00
Caleb Doxsey
c85c8b0778
authorize: refactor store locking ( #2151 )
...
* authorize: refactor store locking
* fix nil reference panic
2021-04-29 08:37:27 -06:00
bobby
9215833a0b
control plane: add request id to all error pages ( #2149 )
...
* controlplane: add request id to all error pages
- use a single http error handler for both envoy and go control plane
- add http lib style status text for our custom statuses.
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2021-04-28 15:04:44 -07:00
bobby
7973ab43fe
authorize: audit log had duplicate "message" key ( #2141 )
...
* authorize: audit log had duplicate "message" key
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2021-04-27 15:26:16 -06:00
Caleb Doxsey
f365b30e02
authorize: remove log ( #2122 )
2021-04-23 14:00:08 -06:00
Caleb Doxsey
762b565239
authorize: fix empty sub policy arrays ( #2119 )
2021-04-23 11:00:30 -06:00
