Caleb Doxsey
e5a7b994b6
core/authenticate: validate the identity profile ( #4545 )
2023-09-15 14:16:28 -06:00
guangwu
4674b98cfb
chore: unnecessary use of fmt.Sprintf ( #4349 )
...
Remove fmt.Sprintf() calls where the format string contains no formatting verbs.
2023-07-12 09:44:29 -07:00
Kenneth Jenkins
2f4005cc09
authenticate: remove extraneous error log ( #4319 )
...
Currently the Authenticate.storeIdentityProfile() method always emits an
Error log. If there is no error from cookieChunker.SetCookie(), this
results in an empty log entry:
{"level":"error","time":"2023-06-27T23:56:38Z"}
Refactor this method to instead return the error from SetCookie(), and
update the calling code so that it logs a message only when this error
is non-nil.
(Moving the log call to the calling method gives access to the request
context, so the log entry will include the request ID and other related
info.)
2023-06-28 11:02:06 -07:00
Denis Mishin
2db2d66eba
authenticate: add aws cognito ( #4137 )
2023-05-16 12:28:12 -04:00
Caleb Doxsey
be0104b842
config: add cookie_same_site option ( #4148 )
2023-05-03 14:36:42 -06:00
Caleb Doxsey
facf9ab093
hpke: compress query string ( #4147 )
...
* hpke: compress query string
* only use v2 in authenticate if v2 was used for the initial request
* fix comment
2023-05-02 14:12:34 -06:00
Denis Mishin
0ab2057714
authenticate: add events ( #4051 )
2023-05-01 15:11:30 -04:00
Caleb Doxsey
bbed421cd8
config: remove source, remove deadcode, fix linting issues ( #4118 )
...
* remove source, remove deadcode, fix linting issues
* use github action for lint
* fix missing envoy
2023-04-21 17:25:11 -06:00
Denis Mishin
860a881fe0
authenticate: have an option to trim the contents of the callback ( #4090 )
2023-03-31 11:48:31 -04:00
Denis Mishin
6e39ebc189
store authenticate state on creation ( #4064 )
2023-03-17 18:25:29 -04:00
Caleb Doxsey
2b8d51def5
urlutil: add version to query string ( #4028 )
2023-02-28 14:01:13 -07:00
Caleb Doxsey
00c047b114
authenticate: fix identity provider id in encrypted query string ( #4006 )
...
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
2023-02-23 08:30:50 -07:00
Caleb Doxsey
be13027fe0
authenticate: don't require a session for sign_out ( #4007 )
...
authenticate: dont require a session for sign_out
2023-02-22 21:42:10 -07:00
Caleb Doxsey
b62efeb16c
authenticate: only use csrf none for apple ( #3979 )
2023-02-16 08:52:39 -07:00
Caleb Doxsey
3f2a3d6f23
authenticate: save the session cookie with a different name ( #3978 )
2023-02-16 08:52:18 -07:00
Mike Nestor
1d4474f7c5
Appleid ( #3959 )
...
* appleid oauth works but probably not implemented the best
chore(deps): bump golang from 1.19.5-buster to 1.20.0-buster (#3949 )
Bumps golang from 1.19.5-buster to 1.20.0-buster.
---
updated-dependencies:
- dependency-name: golang
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
implemented correct expiration, refresh and revoke
chore(deps): bump golang from 1.19.5-buster to 1.20.0-buster (#3949 )
Bumps golang from 1.19.5-buster to 1.20.0-buster.
---
updated-dependencies:
- dependency-name: golang
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Denis Mishin <dmishin@pomerium.com>
fixed lint issues and maybe ignored G101
* Update internal/identity/oauth/apple/apple.go
Co-authored-by: Caleb Doxsey <caleb@doxsey.net>
* Update internal/identity/oauth/apple/apple.go
Co-authored-by: Caleb Doxsey <caleb@doxsey.net>
* Update internal/identity/oauth/apple/apple.go
Co-authored-by: Caleb Doxsey <caleb@doxsey.net>
* Update internal/identity/oauth/apple/apple.go
Co-authored-by: Caleb Doxsey <caleb@doxsey.net>
* Update internal/identity/oauth/apple/apple.go
Co-authored-by: Caleb Doxsey <caleb@doxsey.net>
* Update internal/identity/oauth/apple/apple.go
Co-authored-by: Caleb Doxsey <caleb@doxsey.net>
---------
Co-authored-by: Caleb Doxsey <caleb@doxsey.net>
2023-02-13 18:01:00 -07:00
Caleb Doxsey
54676afce2
authenticate: always trust the passed in idp ( #3917 )
2023-01-30 18:59:07 -07:00
Caleb Doxsey
bfcd15435f
authenticate: add additional error details for hmac errors ( #3878 )
2023-01-11 07:53:11 -07:00
Caleb Doxsey
3e892a8533
options: support multiple signing keys ( #3828 )
...
* options: support multiple signing keys
* fix controlplane method, errors
2022-12-22 09:31:09 -07:00
Caleb Doxsey
539fd51579
authenticate: remove databroker dependency ( #3820 )
2022-12-17 09:03:46 -07:00
Caleb Doxsey
c86ca6f76f
webauthn: require session when accessing /.pomerium/webauthn ( #3814 )
...
* webauthn: require session when accessing /.pomerium/webauthn
* remove dead code
* remove unusued PomeriumDomains field
2022-12-16 10:59:21 -07:00
Caleb Doxsey
57217af7dd
authenticate: implement hpke-based login flow ( #3779 )
...
* urlutil: add time validation functions
* authenticate: implement hpke-based login flow
* fix import cycle
* fix tests
* log error
* fix callback url
* add idp param
* fix test
* fix test
2022-12-05 15:31:07 -07:00
Caleb Doxsey
fa26587f19
remove forward auth ( #3628 )
2022-11-23 15:59:28 -07:00
Caleb Doxsey
c1a522cd82
proxy: add userinfo and webauthn endpoints ( #3755 )
...
* proxy: add userinfo and webauthn endpoints
* use TLD for RP id
* use EffectiveTLDPlusOne
* upgrade webauthn
* fix test
* Update internal/handlers/jwks.go
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
2022-11-22 10:26:35 -07:00
Caleb Doxsey
9413123c0f
config: generate cookie secret if not set in all-in-one mode ( #3742 )
...
* config: generate cookie secret if not set in all-in-one mode
* fix tests
* config: add warning about cookie_secret
* breakup lines
2022-11-11 14:14:30 -07:00
Caleb Doxsey
2b319822a4
authenticate: update user info dashboard to show group info for enterprise ( #3736 )
...
* authenticate: update user info dashboard to show group info for enterprise
* Update ui/src/components/GroupDetails.tsx
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
2022-11-09 07:44:35 -07:00
Caleb Doxsey
c178819875
move directory providers ( #3633 )
...
* remove directory providers and support for groups
* idp: remove directory providers
* better error messages
* fix errors
* restore postgres
* fix test
2022-11-03 11:33:56 -06:00
Caleb Doxsey
3f9dfbef76
device: add generic methods for working with user+session devices ( #3710 )
2022-10-28 08:41:12 -06:00
Caleb Doxsey
30bdae3d9e
sessions: check idp id to detect provider changes to force session invalidation ( #3707 )
...
* sessions: check idp id to detect provider changes to force session invalidation
* remove dead code
* fix test
2022-10-25 16:20:32 -06:00
Caleb Doxsey
b68dc1ff4f
controlplane: move jwks.json endpoint to control plane ( #3691 )
2022-10-25 08:01:33 -06:00
Caleb Doxsey
63b210e51d
httputil: remove error details ( #3703 )
2022-10-25 08:00:21 -06:00
Caleb Doxsey
75634dfca2
authenticate: remove ecjson ( #3688 )
2022-10-20 10:37:21 -06:00
Caleb Doxsey
bdd6145e91
authenticate: get/set identity provider id for all sessions ( #3597 )
2022-09-07 10:06:59 -06:00
Alex
fc21579e4b
Fix typos ( #3575 )
...
typos
2022-08-30 15:51:40 -07:00
Caleb Doxsey
5f51510e91
authenticate: add CORS headers to jwks endpoint ( #3574 )
2022-08-25 16:09:11 -06:00
Caleb Doxsey
e9e52d8225
authenticate: fix branding for webauthn device registration page ( #3572 )
2022-08-24 15:51:34 -06:00
Caleb Doxsey
46703b9419
config: add branding settings ( #3558 )
2022-08-16 14:51:47 -06:00
Caleb Doxsey
6140ee1d88
controlplane: add well-known endpoint to the controlplane http handler ( #3555 )
...
* controlplane: add well-known endpoint to the controlplane http handler
* add support for trailing /
* remove redundant test
2022-08-16 09:59:39 -06:00
Caleb Doxsey
0ac7e45a21
atomicutil: use atomicutil.Value wherever possible ( #3517 )
...
* atomicutil: use atomicutil.Value wherever possible
* fix test
* fix mux router
2022-07-28 15:38:38 -06:00
Caleb Doxsey
86625a4ddb
config: support files for shared_secret, client_secret, cookie_secret and signing_key ( #3453 )
2022-06-29 10:44:08 -06:00
Caleb Doxsey
a938a23ea2
device enrollment: fix ip address ( #3430 )
2022-06-16 11:30:38 -06:00
Caleb Doxsey
464ccdf767
authenticate: fix internal service URL dashboard redirect ( #3305 )
2022-04-29 08:09:28 -06:00
Caleb Doxsey
9dbe12fe99
authenticate: save session for bare webauthn redirects, consider external service URL to be a pomerium url ( #3280 )
2022-04-19 16:03:11 -06:00
Caleb Doxsey
61ffeb837d
authenticate: fix internal service URL CORS check ( #3279 )
2022-04-19 10:09:47 -06:00
Caleb Doxsey
36f73fa6c7
authorize: track session and service account access date ( #3220 )
...
* session: add accessed at date
* authorize: track session and service account access times
* Revert "databroker: add support for field masks on Put (#3210 )"
This reverts commit 2dc778035d
2022-03-31 09:19:04 -06:00
Caleb Doxsey
69ba511c64
authenticate: fix internal url with webauthn ( #3194 )
2022-03-28 06:36:48 -06:00
Caleb Doxsey
7d00ad9b7d
remove version ( #3184 )
2022-03-23 11:51:24 -06:00
Caleb Doxsey
da97546de1
authenticate: show the device enrolled page as the user info page ( #3151 )
2022-03-17 11:15:57 -07:00
Nathan Hayfield
351f562c42
adds pomerium version to the user info endpoint ( #3093 )
...
* adds pomerium version to the user info endpoint
* linting
* order imports
2022-03-03 20:00:17 +01:00
Caleb Doxsey
1342523cda
grpc: remove ptypes references ( #3078 )
2022-02-24 08:37:59 -07:00
