The PKCE support added in v2.45.0 changed the CallbackConnector interface
signatures but missed updating the authproxy and oauth connectors. This
caused a type assertion failure in handleConnectorLogin(), resulting in
"Requested resource does not exist" errors when using these connectors.
Update LoginURL to return (string, []byte, error) and HandleCallback to
accept a []byte connData parameter for both connectors and their tests.
Signed-off-by: Mathias Gebbe <mathias.gebbe@gmail.com>
Signed-off-by: a-buck <5923598+a-buck@users.noreply.github.com>
Signed-off-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
Signed-off-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
This commit enables universal nested group search support across a
variety of LDAP server implementations. It updates the code to allow
recursive group membership discovery during user authentication and
provides CI tests to validate the functionality.
Based on @paroque’s original https://github.com/dexidp/dex/pull/1058
PR.
- Removed `Recursive` boolean flag from config and logic
- Made recursion behavior dependant on presence of `RecursionGroupAttr`
- Updated log messages to reflect changes and follow `slog` structured format
Signed-off-by: Ethan Dieterich <ethandieterich@gmail.com>
Signed-off-by: zvlb <vl.zemtsov@gmail.com>
Signed-off-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
Signed-off-by: Maksim Nabokikh <max.nabokih@gmail.com>
Co-authored-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
Co-authored-by: Maksim Nabokikh <max.nabokih@gmail.com>
* Use scheme without :// suffix
* Make test ldap server listen on custom ports to avoid stepping into go-ldap defaults
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
OpenStack Keystone allows a user to authenticate against a domain. That
domain can be specified either as the domain ID or the domain name when
authenticating. The domain ID is a UUID or the special "default" domain
ID so key off of that when deciding what to submit to the keystone API.
Collapsed the code to share the domainKeystone struct by utilizing
omitempty to skip unset fields.
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
With the change introduced in https://github.com/dexidp/dex/pull/3372 Dex declines passwords that contain special characters. Since password is not passed to any kind of filters, it is safe to pass a password as is. No LDAP query injections are possible.
This commit is a revert of password escaping.
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
Enhanced the OIDC connector to allow specifying an empty promptType parameter. Previously, the default behavior always appended 'consent' if promptType was not specified. This adjustment was necessary due to variations in default behaviors across certain Identity Providers (IDPs).
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>
Signed-off-by: Maksim Nabokikh <maksim.nabokikh@flant.com>
- Add missing json tag.
- Control delimiter cleaning with a configuration key.
- Use better variable names
- concatenate string using slice and join
Signed-off-by: Oded Ben-Ozer <obenozer@wayfair.com>
Uğur Tafralı
Maksim Nabokikh
Mathias Gebbe
Ivan Zviagintsev
Aljoscha Bollmann
Giovanni Vella
Mark Sagi-Kazar
Alex B
Mathias Petermann
Vasily Maryutenkov
EthanDieterich
Oleksandr Redko
Kot C
Melroy Dsouza
Vladimir
siarhei-haurylau
Jack Warren
Mathew Wicks
Doug Goldstein
Sean Liao
sohgaura
MichaelKo
mountcount
Abhisek Datta
hsinhoyeh
Chris
Patrick Pacher
Matt Pryor
Jackson Argo
Oded Ben-Ozer
Oded Ben Ozer
Márk Sági-Kazár
Pradeep Mudlapur