wasaga
a935c1ba30
config related metrics ( #2065 )
2021-04-07 12:29:36 -07:00
Caleb Doxsey
f4c4fe314a
authorize: audit logging ( #2050 )
...
* authorize: add databroker server and record version to result, force sync via polling
* authorize: audit logging
2021-04-05 09:58:55 -06:00
Travis Groth
c7d243d742
proxy: restrict programmatic URLs to localhost ( #2049 )
...
Co-authored-by: Caleb Doxsey <cdoxsey@pomerium.com>
2021-04-01 10:04:49 -04:00
Caleb Doxsey
d7ab817de7
authorize: add databroker server and record version to result, force sync via polling ( #2024 )
...
* authorize: add databroker server and record version to result, force sync via polling
* wrap inmem store to take read lock when grabbing databroker versions
* address code review comments
* reset max to 0
2021-03-31 10:09:06 -06:00
wasaga
80c55dd50c
databroker: return server version in Get ( #2039 )
2021-03-29 13:18:38 -04:00
Caleb Doxsey
e2ebef44ef
telemetry: add installation id ( #2017 )
...
* telemetry: add installation id
* set installation id globally
* remove unneeded changes
2021-03-24 07:22:54 -06:00
ntoofu
fee4979246
Add xff_num_trusted_hops config option ( #2003 )
...
* Add `xff_num_trusted_hops` config option
* Fix code formatting with gofmt
* Update docs for `xff_num_trusted_hops`
2021-03-22 10:30:20 -06:00
Caleb Doxsey
23bc3f979f
config: add headers to config proto ( #1996 )
2021-03-19 08:06:01 -06:00
Caleb Doxsey
46ae3cf358
add rewrite_response_headers to protobuf ( #1962 )
2021-03-05 13:57:27 -07:00
Caleb Doxsey
664358dfad
config: multiple endpoints for authorize and databroker ( #1957 )
...
* wip
* update docs
* remove dead code
2021-03-03 09:53:19 -07:00
Caleb Doxsey
a825b06014
metrics: add TLS options ( #1939 )
...
* move metrics listener to envoy
* add metrics tls options
* add test
* update docs
* update config proto
* add function to validate metric addr
* fix validation
2021-02-24 09:42:53 -07:00
Caleb Doxsey
8b42eb5ebd
config: add metrics_basic_auth option ( #1917 )
...
* config: add metrics_basic_auth option
* remove println
* use constant time compare
2021-02-22 13:37:18 -07:00
Caleb Doxsey
5d60cff21e
databroker: refactor databroker to sync all changes ( #1879 )
...
* refactor backend, implement encrypted store
* refactor in-memory store
* wip
* wip
* wip
* add syncer test
* fix redis expiry
* fix linting issues
* fix test by skipping non-config records
* fix backoff import
* fix init issues
* fix query
* wait for initial sync before starting directory sync
* add type to SyncLatest
* add more log messages, fix deadlock in in-memory store, always return server version from SyncLatest
* update sync types and tests
* add redis tests
* skip macos in github actions
* add comments to proto
* split getBackend into separate methods
* handle errors in initVersion
* return different error for not found vs other errors in get
* use exponential backoff for redis transaction retry
* rename raw to result
* use context instead of close channel
* store type urls as constants in databroker
* use timestampb instead of ptypes
* fix group merging not waiting
* change locked names
* update GetAll to return latest record version
* add method to grpcutil to get the type url for a protobuf type
2021-02-18 15:24:33 -07:00
Caleb Doxsey
1a1cc30c67
config: support map of jwt claim headers ( #1906 )
...
* config: support map of jwt claim headers
* fix array handling, add test
* update docs
* use separate hook, add tests
2021-02-17 13:43:18 -07:00
wasaga
d04416a5fd
in-memory service registry ( #1892 )
2021-02-17 14:28:54 -05:00
Caleb Doxsey
25b697a13d
authorize: allow access by user id ( #1850 )
2021-02-03 07:15:44 -07:00
Caleb Doxsey
b7f0242090
authorize: remove admin ( #1833 )
...
* authorize: remove admin
* regen rego
* add note to upgrading
2021-02-01 15:22:02 -07:00
Caleb Doxsey
cc85ea601d
policy: add new certificate-authority option for downstream mTLS client certificates ( #1835 )
...
* policy: add new certificate-authority option for downstream mTLS client certificates
* update proto, docs
2021-02-01 08:10:32 -07:00
wasaga
67f6030e1e
upstream endpoints load balancer weights ( #1830 )
2021-01-28 09:11:14 -05:00
Caleb Doxsey
3567183ce5
grpc: use custom resolver ( #1828 )
2021-01-27 16:19:16 -07:00
Caleb Doxsey
9c34fcbf29
protobuf: upgrade protoc to 3.14 ( #1832 )
2021-01-27 10:06:40 -07:00
Caleb Doxsey
e2db837d9f
fix go:generate for envoy config ( #1826 )
2021-01-26 11:53:04 -07:00
wasaga
19d78cb844
include envoy's proto specs into config.proto ( #1817 )
2021-01-25 13:15:50 -05:00
Caleb Doxsey
a4c7381eba
config: support multiple destination addresses ( #1789 )
...
* config: support multiple destination addresses
* use constructor for string slice
* add docs
* add test for multiple destinations
* fix name
2021-01-20 15:18:24 -07:00
wasaga
c6b6141d12
new skip_xff_append option ( #1788 )
...
Added `skip_xff_append` configuration option. When set, proxy would not append it's IP address to `x-forwarded-for` HTTP header.
2021-01-20 10:56:29 -05:00
Caleb Doxsey
d9699cbcb9
policy: add outlier_detection ( #1786 )
...
* add support for cluster outlier detection
* add docs
2021-01-20 08:33:48 -07:00
Caleb Doxsey
c99994bed8
config: support redirect actions ( #1776 )
...
* add route redirect options
* add xds support for redirect
* add test
* handle nil destinations
* remove unchanged statik files
* remove unchanged statik files
* update docs
* Update docs/reference/settings.yaml
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
2021-01-14 16:18:27 -07:00
Caleb Doxsey
ab4a68f56f
remove user impersonation and service account cli ( #1768 )
...
* remove user impersonation and service account cli
* update doc
* remove user impersonation url query params
* fix flaky test
2021-01-12 09:28:29 -07:00
Caleb Doxsey
a6bc9f492f
authorize: move impersonation into session/service account ( #1765 )
...
* move impersonation into session/service account
* replace frontend statik
* fix data race
* move JWT filling to separate function, break up functions
* maybe fix data race
* fix code climate issue
2021-01-11 15:40:08 -07:00
Caleb Doxsey
4f0ce4bc82
fix coverage ( #1741 )
...
* fix coverage
* fix data races
2021-01-06 08:30:38 -07:00
Caleb Doxsey
6cc720a1b5
fix error wrapping ( #1737 )
2021-01-05 12:46:14 -07:00
bobby
f837c92741
dev: update linter ( #1728 )
...
- gofumpt everything
- fix TLS MinVersion to be at least 1.2
- add octal syntax
- remove newlines
- fix potential decompression bomb in ecjson
- remove implicit memory aliasing in for loops.
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-12-30 09:02:57 -08:00
bobby
5bbd745934
authorize: add signature algo support (RSA / EdDSA) ( #1631 )
...
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-11-30 17:14:41 -08:00
Caleb Doxsey
aad8ac2e61
replace GetAllPages with InitialSync, improve merge performance ( #1624 )
...
* replace GetAllPages with InitialSync, improve merge performance
* fmt proto
* add test for base64 function
* add sync test
* go mod tidy
Co-authored-by: Bobby DeSimone <bobbydesimone@gmail.com>
2020-11-30 12:21:44 -07:00
Caleb Doxsey
2d5690dde6
remove deprecated cache_service_url config option ( #1614 )
...
* remove deprecated cache_service_url config option
* remove broken test
* update integration test config
* update nginx example
Co-authored-by: Travis Groth <travisgroth@users.noreply.github.com>
2020-11-23 14:57:29 -07:00
Caleb Doxsey
a41c37f9e0
add paging support to GetAll ( #1601 )
...
* add paging support to GetAll
* fix import
2020-11-18 17:02:57 -07:00
Philip Wassermann
85a5961e5e
authorize: add allow_any_authenticated_user policy ( #1515 )
2020-11-05 11:20:50 -07:00
Caleb Doxsey
ccdd1e5586
use custom default http transport ( #1576 )
...
* use custom default http transport
* Update config/http.go
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
* Update config/http.go
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
* return early
Co-authored-by: bobby <1544881+desimone@users.noreply.github.com>
2020-11-04 15:35:10 -07:00
Caleb Doxsey
10b5c5ca0e
fix querying claim data on the dashboard ( #1560 )
2020-10-29 10:49:02 -06:00
Caleb Doxsey
93c257259e
databroker: add audience to session ( #1557 )
...
* add audience to session
* update audience
* parse next url and add it to audience
2020-10-27 14:22:26 -06:00
Caleb Doxsey
a85b3b04c1
store raw id token so it can be passed to the logout url ( #1543 )
2020-10-26 10:20:23 -06:00
Caleb Doxsey
153e438eb6
authorize: implement allowed_idp_claims ( #1542 )
...
* add arbitrary claims to session
* add support for maps
* update flattened claims
* fix eol
* fix trailing whitespace
* fix tests
2020-10-23 14:05:37 -06:00
Caleb Doxsey
04c582121d
add flag to enable user impersonation ( #1514 )
...
* add flag to enable user impersonation
* fix typo
2020-10-14 08:17:59 -06:00
Caleb Doxsey
eb79cc0957
databroker: require JWT for access ( #1503 )
2020-10-09 11:08:40 -06:00
Caleb Doxsey
aa731ae068
directory: add explicit RefreshUser endpoint for faster sync ( #1460 )
...
* directory: add explicit RefreshUser endpoint for faster sync
* add test
* implement azure
* update api call
* add test for azure User
* implement github
* implement AccessToken, gitlab
* implement okta
* implement onelogin
* fix test
* fix inconsistent test
* implement auth0
2020-10-05 08:23:15 -06:00
Caleb Doxsey
3e86d2f9bf
directory: additional user info ( #1467 )
...
* directory: support additional user information
* implement github
* implement gitlab
* implement onelogin
* implement okta
* rename to display name
* implement google
* fill in properties
* fix azure email parsing
* fix tests, lint
* fix onelogin tests
* fix gitlab/github tests
2020-09-29 09:38:16 -06:00
Caleb Doxsey
2364da14c8
databroker: add support for querying the databroker ( #1443 )
...
* databroker: add support for querying the databroker
* remove query method, use getall so encryption works
* add test
* return early
2020-09-22 16:01:37 -06:00
Caleb Doxsey
54d37e62e8
config: add dns_lookup_family option to customize DNS IP resolution ( #1436 )
2020-09-21 15:32:37 -06:00
Caleb Doxsey
0a6796ff71
authorize: add support for service accounts ( #1374 )
2020-09-04 10:37:00 -06:00
Caleb Doxsey
4fb90fabe8
config: support explicit prefix and regex path rewriting ( #1363 )
...
* config: support explicity prefix and regex path rewriting
* add rewrite tests
2020-09-02 13:48:19 -06:00
