mirror/dex - dex - xhrpb gitea

Commit Graph

Author	SHA1	Message	Date
Maksim Nabokikh	47e84dba69	feat(connector): add compile-time checks for connector interfaces (#4591 ) Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>	3 weeks ago
Ivan Zviagintsev	4311931881	feat: saml support refresh tokens (#4565 ) Signed-off-by: Ivan Zvyagintsev <ivan.zvyagintsev@flant.com>	3 weeks ago
Oleksandr Redko	9891daa585	refactor: simplify tests by using slog.DiscardHandler (#4058 ) Signed-off-by: Oleksandr Redko <oleksandr.red+github@gmail.com>	12 months ago
Mark Sagi-Kazar	c7fd9620aa	chore: fix linter config and violations Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>	1 year ago
siarhei-haurylau	fe08a08923	saml connector: fix nil pointer on validate saml (#3793 ) Signed-off-by: Siarhei Haurylau <siarhei.haurylau@point-devel.com>	1 year ago
Sean Liao	0b6a78397e	use slog for structured logging (#3502 ) Signed-off-by: Sean Liao <sean+git@liao.dev>	2 years ago
mountcount	c6fa45568b	chore: fix function names in comment (#3464 ) Signed-off-by: mountcount <cuimoman@outlook.com>	2 years ago
Daniel Lipovetsky	07d7913049	chore: Upgrade golangci-lint to v1.50.1 from v1.46.0 (#2790 )	3 years ago
Eng Zer Jun	f0186ff265	refactor: move from io/ioutil to io and os package The io/ioutil package has been deprecated as of Go 1.16, see https://golang.org/doc/go1.16#ioutil. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	5 years ago
m.nabokikh	b2e9f67edc	Enable unparam, prealloc, sqlclosecheck linters Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>	5 years ago
Josh Soref	97d3e8fa7f	spelling: signature Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>	5 years ago
Josh Soref	d3d447fcf1	spelling: readable Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>	5 years ago
Josh Soref	a996c4ba54	spelling: guaranteeing Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>	5 years ago
Stephen Augustus	57640cc7a9	connector/saml: Validate XML roundtrip data before processing request Signed-off-by: Stephen Augustus <saugustus@vmware.com>	5 years ago
m.nabokikh	4d63e9cd68	fix: Bump golangci-lint version and fix some linter's problems Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>	5 years ago
Stephan Renatus	4a0feaf589	connector/saml: add 'FilterGroups' setting This should make AllowedGroups equivalent to an LDAP group filter: When set to true, only the groups from AllowedGroups will be included in the user's identity. Signed-off-by: Stephan Renatus <srenatus@chef.io>	6 years ago
Mark Sagi-Kazar	f141f2133b	Fix whitespace	6 years ago
Mark Sagi-Kazar	9bd5ae5197	Fix goimports	6 years ago
Mark Sagi-Kazar	142c96c210	Fix stylecheck	6 years ago
Ken Perkins	285c1f162e	connector/saml: Adding group filtering - 4 new tests - Doc changes to use the group filtering	7 years ago
wassan128	42e8619830	Fix typo	7 years ago
Stephan Renatus	d9487e553b	*: fix some lint issues Mostly gathered these using golangci-lint's deadcode and ineffassign linters. Signed-off-by: Stephan Renatus <srenatus@chef.io>	7 years ago
Mark Sagi-Kazar	06521ffa49	Remove the logrus logger wrapper	7 years ago
Mark Sagi-Kazar	be581fa7ff	Add logger interface and stop relying on Logrus directly	7 years ago
Stephan Renatus	26c0206627	connector/saml: make unparsable (trailing, non-space/newline) data an error Fixes #1304, if we want to be harsh. However, I think if it was the user's intention to pass two certs, and the second one couldn't be read, that shouldn't just disappear. After all, when attempting to login later, that might fail because the expected IdP cert data isn't there. Signed-off-by: Stephan Renatus <srenatus@chef.io>	8 years ago
Stephan Renatus	b9f6594bf0	*: github.com/coreos/dex -> github.com/dexidp/dex Signed-off-by: Stephan Renatus <srenatus@chef.io>	8 years ago
Stephan Renatus	608260d0f1	saml: add tests case covering tampered NameID field (comment) As sketched here: https://developer.okta.com/blog/2018/02/27/a-breakdown-of-the-new-saml-authentication-bypass-vulnerability Thought it was interesting to see how our SAML connector behaved. And it seems to be behaving well. :) Signed-off-by: Stephan Renatus <srenatus@chef.io>	8 years ago
Michael Stapelberg	a41d93db4a	Implement the “authproxy” connector (for Apache2 mod_auth etc.)	9 years ago
Eric Chiang	aad328bb35	*: add log events for login, LDAP queries, and SAML responses	9 years ago
Eric Stroczynski	4a88d0641a	: update {S->s}irupsen/logrus	9 years ago
Eric Chiang	00b5c99ffc	connector/saml/testdata: fix bad status test case Notice this when inspecting the code coverage results. For some reason this test wasn't triggering the bad status code path, maybe due to signature validation. Removing the comment fixed the code coverage.	9 years ago
Eric Chiang	362e0798a4	connector/saml: clean up SAML verification logic and comments	9 years ago
Phu Kieu	bd754e2b2d	Fix entityIssuer -> ssoIssuer typo	9 years ago
Phu Kieu	47897f73fa	Validate audience with entityIssuer if present, use redirectURI otherwise	9 years ago
Phu Kieu	217b5ca2c7	Add ssoIssuer to fix Response issuer checking Rename issuer to entityIssuer	9 years ago
Eric Chiang	a97cffcd52	connector/saml: refactor tests and add self-signed responses Introduces SAML tests which execute full response processing and compare user attributes. tesdata now includes a full, self-signed CA and documents signed using xmlsec1. Adds deprication notices to existing tests, but don't remove them since they still provide coverage.	9 years ago
Eric Chiang	e0709dc2ac	connector/saml: fix validation bug with multiple Assertion elements When a SAML response provided multiple Assertion elements, only the first one is checked for a valid signature. If the Assertion is verified, the original Assertion is removed and the canonicalized version is prepended to the Response. However, if there were multiple assertions, the second assertion could end up first in the list of Assertions, even if it was unsigned. For example this: <Response> <!-- Response unsigned. According to SAML spec must check assertion signature. --> <Assertion> <Signature> <!-- Correrctly signed assertion --> </Signature> </Assertion> <Assertion> <!-- Unsigned assertion inserted by attacker--> </Assertion> </Response> could be verified then re-ordered to the following: <Response> <!-- Response unsigned. According to SAML spec must check assertion signature. --> <Assertion> <!-- Unsigned assertion inserted by attacker--> </Assertion> <Assertion> <!-- Canonicalized, correrctly signed assertion --> </Assertion> </Response> Fix this by removing all unverified child elements of the Response, not just the original assertion.	9 years ago
Phu Kieu	6f9ef961bb	Use etreeutils.NSSelectOne to select Assertion element	9 years ago
rithu john	59502850f0	connector: Connectors without a RefreshConnector should not return a refresh token instead of erroring	9 years ago
Eric Chiang	50b223a9db	*: validate InResponseTo SAML response field and make issuer optional	9 years ago
Eric Chiang	33f0199077	*: fix spelling using github.com/client9/misspell	9 years ago
Holger Koser	e46f2ebe40	Improve SAML Signature and Response Validation * Improve Order of Namespace Declarations and Attributes in Canonical XML. This is related to an issue in goxmldsig for which I created an [pull request](https://github.com/russellhaering/goxmldsig/pull/17). * Do not compress the AuthnRequest if `HTTP-POST` binding is used. * SAML Response is valid if the Message and/or the Assertion is signed. * Add `AssertionConsumerServiceURL` to `AuthnRequest` * Validate Status on the Response * Validate Conditions on the Assertion * Validation SubjectConfirmation on the Subject	9 years ago
Eric Chiang	31dfb54b6f	connector: add a SAML connector	9 years ago

43 Commits (master)