Signed-off-by: a-buck <5923598+a-buck@users.noreply.github.com>
Signed-off-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
Signed-off-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
This commit enables universal nested group search support across a
variety of LDAP server implementations. It updates the code to allow
recursive group membership discovery during user authentication and
provides CI tests to validate the functionality.
Based on @paroque’s original https://github.com/dexidp/dex/pull/1058
PR.
- Removed `Recursive` boolean flag from config and logic
- Made recursion behavior dependant on presence of `RecursionGroupAttr`
- Updated log messages to reflect changes and follow `slog` structured format
Signed-off-by: Ethan Dieterich <ethandieterich@gmail.com>
Signed-off-by: zvlb <vl.zemtsov@gmail.com>
Signed-off-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
Signed-off-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
* Use scheme without :// suffix
* Make test ldap server listen on custom ports to avoid stepping into go-ldap defaults
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
OpenStack Keystone allows a user to authenticate against a domain. That
domain can be specified either as the domain ID or the domain name when
authenticating. The domain ID is a UUID or the special "default" domain
ID so key off of that when deciding what to submit to the keystone API.
Collapsed the code to share the domainKeystone struct by utilizing
omitempty to skip unset fields.
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
With the change introduced in https://github.com/dexidp/dex/pull/3372 Dex declines passwords that contain special characters. Since password is not passed to any kind of filters, it is safe to pass a password as is. No LDAP query injections are possible.
This commit is a revert of password escaping.
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
Enhanced the OIDC connector to allow specifying an empty promptType parameter. Previously, the default behavior always appended 'consent' if promptType was not specified. This adjustment was necessary due to variations in default behaviors across certain Identity Providers (IDPs).
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
Signed-off-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
- Add missing json tag.
- Control delimiter cleaning with a configuration key.
- Use better variable names
- concatenate string using slice and join
Signed-off-by: Oded Ben-Ozer <obenozer@wayfair.com>
The provider.Verifier.Verify endpoint we were using only works with ID
tokens. This isn't an issue with systems which use ID tokens as access
tokens (e.g. dex), but for systems with opaque access tokens (e.g.
Google / GCP), those access tokens could not be verified.
Instead, check the access token against the getUserInfo endpoint.
Signed-off-by: Sean Liao <sean+git@liao.dev>
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
Mark Sagi-Kazar
Alex B
Mathias Petermann
Vasily Maryutenkov
EthanDieterich
Oleksandr Redko
Kot C
Melroy Dsouza
Vladimir
siarhei-haurylau
Maksim Nabokikh
Jack Warren
Mathew Wicks
Doug Goldstein
Sean Liao
sohgaura
MichaelKo
mountcount
Abhisek Datta
hsinhoyeh
Chris
Patrick Pacher
Matt Pryor
Jackson Argo
Oded Ben-Ozer
Oded Ben Ozer
Márk Sági-Kazár
Pradeep Mudlapur
Josh Soref