64 commits

Author	SHA1	Message	Date
Bobby DeSimone	666fd6aa35	authenticate: save oauth2 tokens to cache (#698) ... Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>	2020-05-18 17:10:10 -04:00
Caleb Doxsey	41855e5419	envoy: use envoy request id for logging across systems with http and gRPC (#691)	2020-05-18 17:10:10 -04:00
Caleb Doxsey	5819bf1408	authorize: return jwt claims in request headers (#688) ... * authorize: refactor session loading, implement headers and query params * authorize: fix http recorder header, use constant for pomerium authorization header * fix compile * remove dead code * authorize: return jwt claims in request headers	2020-05-18 17:10:10 -04:00
Caleb Doxsey	af649d3eb0	envoy: implement header and query param session loading (#684) ... * authorize: refactor session loading, implement headers and query params * authorize: fix http recorder header, use constant for pomerium authorization header * fix compile * remove dead code	2020-05-18 17:10:10 -04:00
Caleb Doxsey	0d9a372182	envoy: implement refresh session (#674) ... * authorize: refresh session WIP * remove upstream cookie with lua * only refresh session on expired * authorize: handle session expiration * authorize: add refresh test, fix isExpired check * proxy: implement preserve host header option * authorize: allow CORS preflight requests * proxy: add request headers * authenticate: use id token expiry	2020-05-18 17:10:10 -04:00
Caleb Doxsey	98d2f194a0	authorize: allow CORS preflight requests (#672) ... * proxy: implement preserve host header option * authorize: allow CORS preflight requests	2020-05-18 17:10:10 -04:00
Travis Groth	99e788a9b4	envoy: Initial changes	2020-05-18 17:10:10 -04:00
Caleb Doxsey	b1d3bbaf56	authorize: add support for .pomerium and unauthenticated routes (#639) ... * authorize: add support for .pomerium and unauthenticated routes integration-tests: add test for forward auth dashboard urls * proxy: fix ctx error test to return a 200 when authorize allows it	2020-04-29 10:55:46 -06:00
Caleb Doxsey	5ad0e0ebdc	authorize: build full URL from gRPC request	2020-04-20 18:24:26 -06:00
Bobby DeSimone	ba14ea246d	*: remove import path comments (#545) ... - import path comments are obsoleted by the go.mod file's module statement Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>	2020-03-16 10:13:47 -07:00
Bobby DeSimone	8d1732582e	authorize: use jwt insead of state struct (#514) ... authenticate: unmarshal and verify state from jwt, instead of middleware authorize: embed opa policy using statik authorize: have IsAuthorized handle authorization for all routes authorize: if no signing key is provided, one is generated authorize: remove IsAdmin grpc endpoint authorize/client: return authorize decision struct cmd/pomerium: main logger no longer contains email and group cryptutil: add ECDSA signing methods dashboard: have impersonate form show up for all users, but have api gated by authz docs: fix typo in signed jwt header encoding/jws: remove unused es256 signer frontend: namespace static web assets internal/sessions: remove leeway to match authz policy proxy: move signing functionality to authz proxy: remove jwt attestation from proxy (authZ does now) proxy: remove non-signed headers from headers proxy: remove special handling of x-forwarded-host sessions: do not verify state in middleware sessions: remove leeway from state to match authz sessions/{all}: store jwt directly instead of state Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>	2020-03-10 11:19:26 -07:00
Bobby DeSimone	2f13488598	authorize: use opa for policy engine (#474) ... Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>	2020-02-02 11:18:22 -08:00
Bobby DeSimone	dccc7cd2ff	cache : add cache service (#457) ... Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>	2020-01-20 18:25:34 -08:00
Bobby DeSimone	acac2cee9a	authorize: s/gprc/grpc (#443) ... Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>	2019-12-30 10:48:26 -08:00

Renamed from authorize/gprc.go (Browse further)