Commit graph

669 commits

Author SHA1 Message Date
Renovate Bot
d597af9de4 chore(deps): update module golang/protobuf to v1.3.5 2020-03-17 13:35:07 +00:00
Renovate Bot
8ddb702572 chore(deps): update module golang/mock to v1.4.3 2020-03-17 11:48:19 +00:00
Renovate Bot
1b8db111f5 chore(deps): update github.com/pomerium/autocache commit hash to 227c993 2020-03-16 01:34:39 +00:00
Bobby DeSimone
6f4b26abe2
identity: support oidc UserInfo Response (#529)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-03-12 20:56:40 -07:00
Bobby DeSimone
8d1732582e
authorize: use jwt insead of state struct (#514)
authenticate: unmarshal and verify state from jwt, instead of middleware
authorize: embed opa policy using statik
authorize: have IsAuthorized handle authorization for all routes
authorize: if no signing key is provided, one is generated
authorize: remove IsAdmin grpc endpoint
authorize/client: return authorize decision struct
cmd/pomerium: main logger no longer contains email and group
cryptutil: add ECDSA signing methods
dashboard: have impersonate form show up for all users, but have api gated by authz
docs: fix typo in signed jwt header
encoding/jws: remove unused es256 signer
frontend: namespace static web assets
internal/sessions: remove leeway to match authz policy
proxy:  move signing functionality to authz
proxy: remove jwt attestation from proxy (authZ does now)
proxy: remove non-signed headers from headers
proxy: remove special handling of x-forwarded-host
sessions: do not verify state in middleware
sessions: remove leeway from state to match authz
sessions/{all}: store jwt directly instead of state

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-03-10 11:19:26 -07:00
Renovate Bot
a477af9378 chore(deps): update module prometheus/client_golang to v1.5.0 2020-03-10 11:42:23 +00:00
Bobby DeSimone
855860136c
depedency: use go mod versioned redis (#528)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-03-08 10:48:53 -07:00
Renovate Bot
7e1c4fa498 chore(deps): update module google.golang.org/api to v0.20.0 2020-03-07 15:53:20 +00:00
Renovate Bot
9515a48ba0 chore(deps): update golang.org/x/crypto commit hash to 78000ba 2020-03-07 14:44:21 +00:00
Renovate Bot
702f63fea1 chore(deps): update module open-policy-agent/opa to v0.17.3 2020-03-07 13:01:58 +00:00
Renovate Bot
32904cfe36 chore(deps): update module rakyll/statik to v0.1.7 2020-03-07 03:03:35 +00:00
Renovate Bot
3378a5ecf8 chore(deps): update module golang/protobuf to v1.3.4 2020-03-07 01:18:26 +00:00
Renovate Bot
37a50b3a34 chore(deps): update module gorilla/mux to v1.7.4 2020-03-06 23:49:00 +00:00
Renovate Bot
c6281d1f49 chore(deps): update github.com/pomerium/autocache commit hash to 6c66ed5 2020-03-06 23:40:24 +00:00
renovate[bot]
f64edc0914
chore(deps): update module rs/zerolog to v1.18.0 (#507)
Co-authored-by: Renovate Bot <bot@renovateapp.com>
2020-03-06 18:03:55 -05:00
renovate[bot]
7c67599efd
chore(deps): update module google.golang.org/grpc to v1.27.1 (#496) 2020-02-12 20:23:29 -05:00
renovate[bot]
23fe11f562
chore(deps): update module prometheus/client_golang to v1.4.1 (#498) 2020-02-10 22:02:08 -05:00
renovate[bot]
b13603c55b
chore(deps): update module open-policy-agent/opa to v0.17.1 (#497)
Co-authored-by: WhiteSource Renovate <renovatebot@gmail.com>
2020-02-10 08:55:26 -08:00
renovate[bot]
55b50af101
chore(deps): update module go.opencensus.io to v0.22.3 (#483)
Co-authored-by: WhiteSource Renovate <renovatebot@gmail.com>
2020-02-10 08:54:46 -08:00
Travis Groth
1901cb5ca0
Roll back grpc to v1.25.1 (#484) 2020-02-03 06:30:54 -05:00
Bobby DeSimone
2f13488598
authorize: use opa for policy engine (#474)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-02-02 11:18:22 -08:00
renovate[bot]
36abc9fd65 chore(deps): update module golang/mock to v1.4.0 (#470)
Co-authored-by: WhiteSource Renovate <renovatebot@gmail.com>
2020-01-27 11:58:43 -08:00
renovate[bot]
78c396ea9d chore(deps): update module yaml to v2.2.8 (#471)
Co-authored-by: WhiteSource Renovate <renovatebot@gmail.com>
2020-01-27 11:58:31 -08:00
Bobby DeSimone
1db1a75a8b
chore(deps): update bolt and autocache (#465)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-01-21 09:00:54 -08:00
Bobby DeSimone
dccc7cd2ff
cache : add cache service (#457)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-01-20 18:25:34 -08:00
renovate[bot]
8a9cb0f803 chore(deps): update golang.org/x/crypto commit hash to 530e935 (#458)
Co-authored-by: WhiteSource Renovate <renovatebot@gmail.com>
2020-01-20 12:04:46 -08:00
renovate[bot]
3c414c37d8 chore(deps): update module spf13/viper to v1.6.2 (#459)
Co-authored-by: WhiteSource Renovate <renovatebot@gmail.com>
2020-01-20 12:32:13 -05:00
renovate[bot]
2f6142eb35 chore(deps): update golang.org/x/crypto commit hash to 61a8779 (#452)
Co-authored-by: WhiteSource Renovate <renovatebot@gmail.com>
2020-01-14 14:01:37 -08:00
renovate[bot]
4779c83013 chore(deps): update golang.org/x/oauth2 commit hash to bf48bf1 (#453)
Co-authored-by: WhiteSource Renovate <renovatebot@gmail.com>
2020-01-14 14:01:26 -08:00
renovate[bot]
4c8320f064 chore(deps): update module google/go-cmp to v0.4.0 (#454)
Co-authored-by: WhiteSource Renovate <renovatebot@gmail.com>
2020-01-14 14:01:16 -08:00
renovate[bot]
0d9d90b3af chore(deps): update module google.golang.org/grpc to v1.26.0 (#433) 2019-12-30 10:49:48 -08:00
renovate[bot]
ca824c6161 chore(deps): update golang.org/x/crypto commit hash to 53104e6 (#431) 2019-12-30 10:48:51 -08:00
Bobby DeSimone
ec029c679b
authenticate/proxy: add backend refresh (#438) 2019-12-30 10:47:54 -08:00
renovate[bot]
fd7873d5d3 chore(deps): update module square/go-jose to v2.4.1 (#435) 2019-12-23 20:58:24 -08:00
renovate[bot]
a29ae6428f chore(deps): update module spf13/viper to v1.6.1 (#423) 2019-12-19 08:30:33 -05:00
renovate[bot]
bed85cd5f7 chore(deps): update golang.org/x/oauth2 commit hash to 858c2ad (#415) 2019-12-06 11:08:36 -08:00
renovate[bot]
3a32c0e60a chore(deps): update golang.org/x/crypto commit hash to e9b2fee (#414) 2019-12-06 11:08:10 -08:00
Bobby DeSimone
1f567d884d
depedency: regen grpc without /x/net (#407)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2019-11-27 08:36:06 -08:00
Bobby DeSimone
773deed761
depedencies: update minor and patch (#402) 2019-11-25 20:53:33 -08:00
Bobby DeSimone
ebee64b70b
internal/frontend : serve static assets (#392)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2019-11-22 17:46:01 -08:00
Bobby DeSimone
00c29f4e77
authenticate: handle XHR redirect flow (#387)
- authenticate: add cors preflight check support for sign_in endpoint
- internal/httputil: indicate responses that originate from pomerium vs the app
- proxy: detect XHR requests and do not redirect on failure.
- authenticate: removed default session duration; should be maintained out of band with rpc.
2019-11-14 19:37:31 -08:00
Bobby DeSimone
d3d60d1055 all: support route scoped sessions
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2019-11-06 17:54:15 -08:00
Bobby DeSimone
bca5caf77a
httputil: add explicit healthcheck handler (#354)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2019-10-07 17:38:28 -07:00
Bobby DeSimone
7aa4621b1b
proxy: update mux to support routing with ports (#353)
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2019-10-06 10:21:23 -07:00
Bobby DeSimone
df822a4bae
all: support insecure mode
- pomerium/authenticate: add cookie secure setting
- internal/config: transport security validation moved to options
- internal/config: certificate struct hydrated
- internal/grpcutil: add grpc server mirroring http one
- internal/grpcutil: move grpc middleware
- cmd/pomerium: use run wrapper around main to pass back errors
- cmd/pomerium: add waitgroup (block on) all servers http/grpc

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2019-10-02 18:44:19 -07:00
Bobby DeSimone
7c755d833f
authenticate: encrypt & mac oauth2 callback state
- cryptutil: add hmac & tests
- cryptutil: rename cipher / encoders to be more clear
- cryptutil: simplify SecureEncoder interface
- cryptutil: renamed NewCipherFromBase64 to NewAEADCipherFromBase64
- cryptutil: move key & random generators to helpers

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2019-09-23 19:15:52 -07:00
Bobby DeSimone
dc12947241
all: refactor handler logic
- all: prefer `FormValues` to `ParseForm` with subsequent `Form.Get`s
- all: refactor authentication stack to be checked by middleware, and accessible via request context.
- all: replace http.ServeMux with gorilla/mux’s router
- all: replace custom CSRF checks with gorilla/csrf middleware
- authenticate: extract callback path as constant.
- internal/config: implement stringer interface for policy
- internal/cryptutil: add helper func `NewBase64Key`
- internal/cryptutil: rename `GenerateKey` to `NewKey`
- internal/cryptutil: rename `GenerateRandomString` to `NewRandomStringN`
- internal/middleware: removed alice in favor of gorilla/mux
- internal/sessions: remove unused `ValidateRedirectURI` and `ValidateClientSecret`
- internal/sessions: replace custom CSRF with gorilla/csrf fork that supports custom handler protection
- internal/urlutil: add `SignedRedirectURL` to create hmac'd URLs
- internal/urlutil: add `ValidateURL` helper to parse URL options
- internal/urlutil: add `GetAbsoluteURL` which takes a request and returns its absolute URL.
- proxy: remove holdover state verification checks; we no longer are setting sessions in any proxy routes so we don’t need them.
- proxy: replace un-named http.ServeMux with named domain routes.

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2019-09-16 18:01:14 -07:00
Bobby DeSimone
380d314404
authenticate: make service http only
- Rename SessionState to State to avoid stutter.
- Simplified option validation to use a wrapper function for base64 secrets.
- Removed authenticates grpc code.
- Abstracted logic to load and validate a user's authenticate session.
- Removed instances of url.Parse in favor of urlutil's version.
- proxy: replaces grpc refresh logic with forced deadline advancement.
- internal/sessions: remove rest store; parse authorize header as part of session store.
- proxy: refactor request signer
- sessions: remove extend deadline (fixes #294)
- remove AuthenticateInternalAddr
- remove AuthenticateInternalAddrString
- omit type tag.Key from declaration of vars TagKey* it will be inferred
  from the right-hand side
- remove compatibility package xerrors
- use cloned http.DefaultTransport as base transport
2019-09-04 16:27:08 -07:00
Bobby DeSimone
6e6ab3baa0
httputil: use http error wrapper
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2019-08-24 09:15:07 -07:00
Bobby DeSimone
5edfa7b03f
telemetry: add tracing
- telemetry/tace: add traces throughout code
- telemetry/metrics: nest metrics and trace under telemetry
- telemetry/tace: add service name span to HTTPMetricsHandler.
- telemetry/metrics: removed chain dependency middleware_tests.
- telemetry/metrics: wrap and encapsulate variatic view registration.
- telemetry/tace: add jaeger support for tracing.
- cmd/pomerium: move `parseOptions` to internal/config.
- cmd/pomerium: offload server handling to httputil and sub pkgs.
- httputil: standardize creation/shutdown of http listeners.
- httputil: prefer curve X25519 to P256 when negotiating TLS.
- fileutil: use standardized Getw

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2019-07-24 09:20:16 -07:00