Caleb Doxsey
a64e5b5fa1
authorize: add sid to JWT claims ( #2420 )
...
* authorize: add sid to JWT claims
* fix import ordering
2021-08-02 16:11:05 -06:00
Caleb Doxsey
57c0c0a1bc
authorize: log additional session details ( #2419 )
2021-08-02 12:08:34 -06:00
Caleb Doxsey
1a95036b8c
sessions: add impersonate_session_id, remove legacy impersonation ( #2407 )
...
* sessions: add impersonate_session_id, remove legacy impersonation
* show impersonated user details
* fix headers
* address feedback
* only check impersonate id on non-nil pbSession
* Revert "only check impersonate id on non-nil pbSession"
This reverts commit a6f7ca5abd
2021-07-30 08:42:36 -06:00
bobby
aa0e6872de
evaluator: use cryputil to hash ( #2384 )
...
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2021-07-22 06:15:54 -07:00
Caleb Doxsey
c7a8f11d9a
authorize: add additional tracing for rego evaluation ( #2381 )
2021-07-21 15:37:51 -06:00
Caleb Doxsey
cef08a1c2d
authorize: remove service account impersonate user id, email and groups ( #2365 )
2021-07-15 09:31:45 -06:00
Caleb Doxsey
360aa89505
authorize: allow redirects on deny ( #2361 )
2021-07-13 15:41:36 -06:00
Caleb Doxsey
b4b86dccb4
authorize: decode CheckRequest path for redirect ( #2357 )
2021-07-13 13:17:21 -06:00
Caleb Doxsey
8e155bdf61
authorize: log service account and impersonation details ( #2354 )
2021-07-12 14:21:37 -06:00
Caleb Doxsey
21ffe44dff
authorize: support boolean deny results ( #2338 )
...
* authorize: support boolean deny results
* add client certificate test
* handle different array lengths
2021-07-06 12:52:26 -06:00
wasaga
7d0db7d8ff
authorize: do not send redirects to gRPC ( #2314 )
2021-07-06 10:24:33 -04:00
Caleb Doxsey
f9675f61cc
deps: upgrade to go-jose v3 ( #2284 )
2021-06-10 09:35:44 -06:00
Caleb Doxsey
2156dbc553
envoy: always set jwt claim headers even if no value is available ( #2261 )
...
* envoy: always set jwt claim headers even if no value is available
* add test
2021-06-04 10:01:00 -07:00
Caleb Doxsey
699f3f461f
authorize: handle grpc-web content types like json ( #2268 )
2021-06-04 10:12:55 -06:00
Caleb Doxsey
9dc90d02d0
authorize: only redirect for HTML pages ( #2264 )
...
* authorize: only redirect for HTML pages
* authorize: only redirect for HTML pages
2021-06-02 16:18:02 -06:00
wasaga
40ddc2c4b3
jwt: round timestamp ( #2258 )
2021-06-01 14:12:45 -07:00
wasaga
12c8bb2da4
authorize: preserve original context ( #2247 )
2021-06-01 11:10:35 -04:00
Caleb Doxsey
dad35bcfb0
ppl: refactor authorize to evaluate PPL ( #2224 )
...
* ppl: refactor authorize to evaluate PPL
* remove opa test step
* add log statement
* simplify assignment
* deny with forbidden if logged in
* add safeEval function
* create evaluator-specific config and options
* embed the headers rego file directly
2021-05-21 09:50:18 -06:00
Caleb Doxsey
0adbf4f24c
controlplane: save configuration events to databroker ( #2153 )
...
* envoy: save events to databroker
* controlplane: add tests for envoy configuration events
* format imports
2021-04-29 15:51:46 -06:00
Caleb Doxsey
c85c8b0778
authorize: refactor store locking ( #2151 )
...
* authorize: refactor store locking
* fix nil reference panic
2021-04-29 08:37:27 -06:00
bobby
9215833a0b
control plane: add request id to all error pages ( #2149 )
...
* controlplane: add request id to all error pages
- use a single http error handler for both envoy and go control plane
- add http lib style status text for our custom statuses.
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2021-04-28 15:04:44 -07:00
bobby
7973ab43fe
authorize: audit log had duplicate "message" key ( #2141 )
...
* authorize: audit log had duplicate "message" key
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2021-04-27 15:26:16 -06:00
Caleb Doxsey
f365b30e02
authorize: remove log ( #2122 )
2021-04-23 14:00:08 -06:00
Caleb Doxsey
762b565239
authorize: fix empty sub policy arrays ( #2119 )
2021-04-23 11:00:30 -06:00
Caleb Doxsey
433831fbea
authorize: fix unsigned URL ( #2118 )
2021-04-22 17:33:46 -06:00
Caleb Doxsey
b1d62bb541
config: remove validate side effects ( #2109 )
...
* config: default shared key
* handle additional errors
* update grpc addr and grpc insecure
* update google cloud service authentication service account
* fix set response headers
* fix qps
* fix test
2021-04-22 15:10:50 -06:00
wasaga
e0c09a0998
log context ( #2107 )
2021-04-22 10:58:13 -04:00
Caleb Doxsey
3906b70bc5
authorize: support arbitrary jwt claims ( #2102 )
...
* authorize: support arbitrary jwt claims
* remove dead code
2021-04-19 14:55:08 -06:00
Caleb Doxsey
6d1d2bec54
crypto: use actual bytes of shared secret, not the base64 encoded representation ( #2075 )
...
* crypto: use actual bytes of shared secret, not the base64 encoded representation
* return errors
* return errors
2021-04-08 20:04:01 -06:00
Caleb Doxsey
a51c7140ea
cryptutil: use bytes for hmac ( #2067 )
2021-04-07 14:57:24 -06:00
wasaga
a935c1ba30
config related metrics ( #2065 )
2021-04-07 12:29:36 -07:00
Caleb Doxsey
8a2af8029b
authorize: additional tracing, add benchmark for encryptor ( #2059 )
2021-04-05 12:55:16 -06:00
Caleb Doxsey
f4c4fe314a
authorize: audit logging ( #2050 )
...
* authorize: add databroker server and record version to result, force sync via polling
* authorize: audit logging
2021-04-05 09:58:55 -06:00
Caleb Doxsey
d7ab817de7
authorize: add databroker server and record version to result, force sync via polling ( #2024 )
...
* authorize: add databroker server and record version to result, force sync via polling
* wrap inmem store to take read lock when grabbing databroker versions
* address code review comments
* reset max to 0
2021-03-31 10:09:06 -06:00
Caleb Doxsey
4218f49741
authorize: bypass data in rego for databroker data ( #2041 )
2021-03-30 14:14:32 -06:00
Caleb Doxsey
e2ebef44ef
telemetry: add installation id ( #2017 )
...
* telemetry: add installation id
* set installation id globally
* remove unneeded changes
2021-03-24 07:22:54 -06:00
Caleb Doxsey
853d2dd478
config: use getters for certificates ( #2001 )
...
* config: use getters for certificates
* update log message
2021-03-23 08:02:50 -06:00
Nándor István Krácser
45fb938317
oidc: use groups claim from ID token if present ( #1970 )
...
Signed-off-by: Nandor Kracser <bonifaido@gmail.com>
2021-03-22 11:46:01 -06:00
Caleb Doxsey
3690a32855
config: use getters for authenticate, signout and forward auth urls ( #2000 )
2021-03-19 14:49:25 -06:00
Caleb Doxsey
eddabc46c7
envoy: upgrade to v1.17.1 ( #1993 )
2021-03-17 19:32:58 -06:00
Caleb Doxsey
ae7626df3e
authorize: set JWT to expire after 5 minutes ( #1980 )
...
* authorize: set JWT to expire after 5 minutes
* use lesser of 5 minutes or id token expiration
* add test for expires at
2021-03-15 07:38:32 -06:00
Caleb Doxsey
b6ec01f377
assets: use embed instead of statik ( #1960 )
...
* assets: use embed instead of statik
* remove empty line
* maybe fix precommit
2021-03-03 18:56:55 -07:00
Caleb Doxsey
f396c2a0f7
config: log config source changes ( #1959 )
...
* config: log config source changes
* use internal log import
2021-03-03 09:54:08 -07:00
Caleb Doxsey
664358dfad
config: multiple endpoints for authorize and databroker ( #1957 )
...
* wip
* update docs
* remove dead code
2021-03-03 09:53:19 -07:00
Caleb Doxsey
5d60cff21e
databroker: refactor databroker to sync all changes ( #1879 )
...
* refactor backend, implement encrypted store
* refactor in-memory store
* wip
* wip
* wip
* add syncer test
* fix redis expiry
* fix linting issues
* fix test by skipping non-config records
* fix backoff import
* fix init issues
* fix query
* wait for initial sync before starting directory sync
* add type to SyncLatest
* add more log messages, fix deadlock in in-memory store, always return server version from SyncLatest
* update sync types and tests
* add redis tests
* skip macos in github actions
* add comments to proto
* split getBackend into separate methods
* handle errors in initVersion
* return different error for not found vs other errors in get
* use exponential backoff for redis transaction retry
* rename raw to result
* use context instead of close channel
* store type urls as constants in databroker
* use timestampb instead of ptypes
* fix group merging not waiting
* change locked names
* update GetAll to return latest record version
* add method to grpcutil to get the type url for a protobuf type
2021-02-18 15:24:33 -07:00
Caleb Doxsey
1a1cc30c67
config: support map of jwt claim headers ( #1906 )
...
* config: support map of jwt claim headers
* fix array handling, add test
* update docs
* use separate hook, add tests
2021-02-17 13:43:18 -07:00
Caleb Doxsey
eb08658cfc
logs: strip query string ( #1894 )
2021-02-16 14:23:52 -07:00
Caleb Doxsey
7d236ca1af
authorize: move headers and jwt signing to rego ( #1856 )
...
* wip
* wip
* wip
* remove SignedJWT field
* set google_cloud_serverless_authentication_service_account
* update jwt claim headers
* add mock get_google_cloud_serverless_headers for opa test
* swap issuer and audience
* add comment
* change default port in authz
2021-02-08 10:53:21 -07:00
Caleb Doxsey
25b697a13d
authorize: allow access by user id ( #1850 )
2021-02-03 07:15:44 -07:00
Caleb Doxsey
7a5c4fd0f6
authorize: handle null ( #1853 )
2021-02-02 17:29:21 -08:00
