Kenneth Jenkins
b7896b3153
authenticateflow: move stateless flow logic ( #4820 )
...
Consolidate all logic specific to the stateless authenticate flow into a
a new Stateless type in a new package internal/authenticateflow. This is
in preparation for adding a new Stateful type implementing the older
stateful authenticate flow (from Pomerium v0.20 and previous).
This change is intended as a pure refactoring of existing logic, with no
changes in functionality.
2023-12-06 16:55:57 -08:00
Caleb Doxsey
a0c92896ef
core/authenticate: refactor idp sign out ( #4582 )
2023-09-28 08:41:19 -07:00
guangwu
4674b98cfb
chore: unnecessary use of fmt.Sprintf ( #4349 )
...
Remove fmt.Sprintf() calls where the format string contains no formatting verbs.
2023-07-12 09:44:29 -07:00
Caleb Doxsey
bbed421cd8
config: remove source, remove deadcode, fix linting issues ( #4118 )
...
* remove source, remove deadcode, fix linting issues
* use github action for lint
* fix missing envoy
2023-04-21 17:25:11 -06:00
Caleb Doxsey
539fd51579
authenticate: remove databroker dependency ( #3820 )
2022-12-17 09:03:46 -07:00
Caleb Doxsey
57217af7dd
authenticate: implement hpke-based login flow ( #3779 )
...
* urlutil: add time validation functions
* authenticate: implement hpke-based login flow
* fix import cycle
* fix tests
* log error
* fix callback url
* add idp param
* fix test
* fix test
2022-12-05 15:31:07 -07:00
Caleb Doxsey
fa26587f19
remove forward auth ( #3628 )
2022-11-23 15:59:28 -07:00
Caleb Doxsey
c1a522cd82
proxy: add userinfo and webauthn endpoints ( #3755 )
...
* proxy: add userinfo and webauthn endpoints
* use TLD for RP id
* use EffectiveTLDPlusOne
* upgrade webauthn
* fix test
* Update internal/handlers/jwks.go
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
2022-11-22 10:26:35 -07:00
Caleb Doxsey
c178819875
move directory providers ( #3633 )
...
* remove directory providers and support for groups
* idp: remove directory providers
* better error messages
* fix errors
* restore postgres
* fix test
2022-11-03 11:33:56 -06:00
Caleb Doxsey
b68dc1ff4f
controlplane: move jwks.json endpoint to control plane ( #3691 )
2022-10-25 08:01:33 -06:00
Caleb Doxsey
63b210e51d
httputil: remove error details ( #3703 )
2022-10-25 08:00:21 -06:00
Caleb Doxsey
75634dfca2
authenticate: remove ecjson ( #3688 )
2022-10-20 10:37:21 -06:00
Caleb Doxsey
bdd6145e91
authenticate: get/set identity provider id for all sessions ( #3597 )
2022-09-07 10:06:59 -06:00
Alex
fc21579e4b
Fix typos ( #3575 )
...
typos
2022-08-30 15:51:40 -07:00
Caleb Doxsey
6140ee1d88
controlplane: add well-known endpoint to the controlplane http handler ( #3555 )
...
* controlplane: add well-known endpoint to the controlplane http handler
* add support for trailing /
* remove redundant test
2022-08-16 09:59:39 -06:00
Caleb Doxsey
0ac7e45a21
atomicutil: use atomicutil.Value wherever possible ( #3517 )
...
* atomicutil: use atomicutil.Value wherever possible
* fix test
* fix mux router
2022-07-28 15:38:38 -06:00
Caleb Doxsey
464ccdf767
authenticate: fix internal service URL dashboard redirect ( #3305 )
2022-04-29 08:09:28 -06:00
Caleb Doxsey
1342523cda
grpc: remove ptypes references ( #3078 )
2022-02-24 08:37:59 -07:00
Caleb Doxsey
35f697e491
userinfo: add webauthn buttons to user info page ( #3075 )
...
* userinfo: add webauthn buttons to user info page
* use new buttons on original page
* fix test
2022-02-23 10:08:24 -07:00
Caleb Doxsey
38c7089642
userinfo: fix logout button, add sign out confirm page ( #3058 )
...
* userinfo: fix logout button, add sign out confirm page
* fix test
2022-02-23 08:15:00 -07:00
Caleb Doxsey
f9b95a276b
authenticate: support for per-route client id and client secret ( #3030 )
...
* implement dynamic provider support
* authenticate: support per-route client id and secret
2022-02-16 12:31:55 -07:00
Caleb Doxsey
46c4d5fa7e
session: remove unused session state properties ( #3022 )
...
* fix error page
* share dashboard code
* sessions: remove unused session state properties
* remove programmatic
* remove version
2022-02-09 10:59:06 -07:00
Caleb Doxsey
2824faecbf
frontend: react+mui ( #3004 )
...
* mui v5 wip
* wip
* wip
* wip
* use compressor for all controlplane endpoints
* wip
* wip
* add deps
* fix authenticate URL
* fix test
* fix test
* fix build
* maybe fix build
* fix integration test
* remove image asset test
* add yarn.lock
2022-02-07 08:47:58 -07:00
dependabot[bot]
34b8af77d1
chore(deps): bump github.com/rs/cors from 1.7.0 to 1.8.0 ( #2334 )
...
* chore(deps): bump github.com/rs/cors from 1.7.0 to 1.8.0
Bumps [github.com/rs/cors](https://github.com/rs/cors ) from 1.7.0 to 1.8.0.
- [Release notes](https://github.com/rs/cors/releases )
- [Commits](https://github.com/rs/cors/compare/v1.7.0...v1.8.0 )
---
updated-dependencies:
- dependency-name: github.com/rs/cors
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix test to handle 204
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>
2021-07-14 10:08:03 -06:00
Caleb Doxsey
f9675f61cc
deps: upgrade to go-jose v3 ( #2284 )
2021-06-10 09:35:44 -06:00
Caleb Doxsey
a51c7140ea
cryptutil: use bytes for hmac ( #2067 )
2021-04-07 14:57:24 -06:00
Travis Groth
0635c838c9
authenticate: validate signature on /.pomerium, /.pomerium/sign_in and /.pomerium/sign_out ( #2048 )
...
Co-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>
2021-04-01 10:04:16 -04:00
Caleb Doxsey
3690a32855
config: use getters for authenticate, signout and forward auth urls ( #2000 )
2021-03-19 14:49:25 -06:00
Caleb Doxsey
5d60cff21e
databroker: refactor databroker to sync all changes ( #1879 )
...
* refactor backend, implement encrypted store
* refactor in-memory store
* wip
* wip
* wip
* add syncer test
* fix redis expiry
* fix linting issues
* fix test by skipping non-config records
* fix backoff import
* fix init issues
* fix query
* wait for initial sync before starting directory sync
* add type to SyncLatest
* add more log messages, fix deadlock in in-memory store, always return server version from SyncLatest
* update sync types and tests
* add redis tests
* skip macos in github actions
* add comments to proto
* split getBackend into separate methods
* handle errors in initVersion
* return different error for not found vs other errors in get
* use exponential backoff for redis transaction retry
* rename raw to result
* use context instead of close channel
* store type urls as constants in databroker
* use timestampb instead of ptypes
* fix group merging not waiting
* change locked names
* update GetAll to return latest record version
* add method to grpcutil to get the type url for a protobuf type
2021-02-18 15:24:33 -07:00
bobby
c3e3ed9b50
authenticate: validate origin of signout ( #1876 )
...
* authenticate: validate origin of signout
- add a debug task to kill envoy
- improve various function docs
- userinfo: return "error" page if user is logged out without redirect uri set
- remove front channel logout. There's little difference between it, and the signout function.
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2021-02-11 21:37:54 -08:00
bobby
6466efddd5
authenticate: update user info screens ( #1774 )
...
- rename "dashboard" to userinfo to avoid confusion
- don't leak version from error page.
- fix typo in state.go
- make statik determenistic on modtime
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2021-01-13 13:15:31 -08:00
Caleb Doxsey
ab4a68f56f
remove user impersonation and service account cli ( #1768 )
...
* remove user impersonation and service account cli
* update doc
* remove user impersonation url query params
* fix flaky test
2021-01-12 09:28:29 -07:00
Caleb Doxsey
b16236496b
jws: remove issuer ( #1754 )
2021-01-11 07:57:54 -07:00
bobby
f837c92741
dev: update linter ( #1728 )
...
- gofumpt everything
- fix TLS MinVersion to be at least 1.2
- add octal syntax
- remove newlines
- fix potential decompression bomb in ecjson
- remove implicit memory aliasing in for loops.
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-12-30 09:02:57 -08:00
Philip Wassermann
2d3190c74e
authenticate: oidc frontchannel-logout endpoint ( #1586 )
...
* authenticate: oidc frontchannel-logout endpoint
* move frontchannellogout route and extract logout process
* add frontchannel_logout_uri to wellknown handler
* authenticate: add context to logs in signout process
* docs: single sign-out topic
* gofmt, wording, refactoring method names
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
Co-authored-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-12-24 14:30:48 -08:00
bobby
f719d885b7
authenticate: remove unused paths, generate cipher at startup, remove qp store ( #1495 )
...
* authenticate: remove unused paths, generate cipher on boot
- internal/httputil: add JSON renderer
- internal/httputil: remove unused query param store and references
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-10-19 08:09:53 -07:00
Caleb Doxsey
04c582121d
add flag to enable user impersonation ( #1514 )
...
* add flag to enable user impersonation
* fix typo
2020-10-14 08:17:59 -06:00
Caleb Doxsey
aa731ae068
directory: add explicit RefreshUser endpoint for faster sync ( #1460 )
...
* directory: add explicit RefreshUser endpoint for faster sync
* add test
* implement azure
* update api call
* add test for azure User
* implement github
* implement AccessToken, gitlab
* implement okta
* implement onelogin
* fix test
* fix inconsistent test
* implement auth0
2020-10-05 08:23:15 -06:00
Caleb Doxsey
2864859252
dashboard: format timestamps ( #1468 )
...
* format timestamps
* fix test
2020-09-28 16:00:42 -06:00
Cuong Manh Le
9de99d0211
all: add signout redirect url ( #1324 )
...
Fixes #1213
2020-08-25 01:23:58 +07:00
bobby
c1b3b45d12
proxy: remove unused handlers ( #1317 )
...
proxy: remove unused handlers
authenticate: remove unused references to refresh_token
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-08-22 10:02:12 -07:00
Caleb Doxsey
882b6b54ee
authenticate: move databroker connection to state ( #1292 )
...
* authenticate: move databroker connection to state
* re-use err
* just return
* remove nil checks
2020-08-18 09:33:43 -06:00
Caleb Doxsey
d608526998
authenticate: move properties to atomically updated state ( #1277 )
...
* authenticate: remove cookie options
* authenticate: remove shared key field
* authenticate: remove shared cipher property
* authenticate: move properties to separate state struct
2020-08-14 07:53:11 -06:00
Caleb Doxsey
045c10edc6
authenticate: support reloading IDP settings ( #1273 )
...
* identity: add name method to provider
* authenticate: support dynamically loading the provider
2020-08-13 12:14:30 -06:00
Caleb Doxsey
97f85481f8
fix redirect loop, remove user/session services, remove duplicate deleted_at fields ( #1162 )
...
* fix redirect loop, remove user/session services, remove duplicate deleted_at fields
* change loop
* reuse err variable
* wrap errors, use cookie timeout
* wrap error, duplicate if
2020-07-30 09:41:57 -06:00
Cuong Manh Le
fd544b7072
authenticate: fix wrong condition checking in VerifySession ( #1146 )
...
The code checks session client not nil, but using databroker client in
the body instead.
2020-07-28 21:18:39 +07:00
Cuong Manh Le
9dae633fe5
internal/frontend/assets/html: make timestamp human readable ( #1107 )
...
Since we switch to use databroker, time in template is now protobuf
timestamp instead of time.Time, that causes it appears in raw form
instead of human-readable format.
Fix this by converting protobuf timestamp to time.Time in template.
There's still a breaking change, though. The time will now appears in
UTC instead of local time.
Fixes #1100
2020-07-20 13:35:57 +07:00
Caleb Doxsey
d3a7ee38be
options refactor ( #1088 )
...
* refactor config loading
* wip
* move autocert to its own config source
* refactor options updaters
* fix stuttering
* fix autocert validate check
2020-07-16 14:30:15 -06:00
Caleb Doxsey
fae02791f5
cryptutil: move to pkg dir, add token generator ( #1029 )
...
* cryptutil: move to pkg dir, add token generator
* add gitignored files
* add tests
2020-06-30 15:55:33 -06:00
Caleb Doxsey
091b71f12e
grpc: rename internal/grpc to pkg/grpc ( #1010 )
...
* grpc: rename internal/grpc to pkg/grpc
* don't ignore pkg dir
* remove debug line
2020-06-26 09:17:02 -06:00
