mirror/dex - dex - xhrpb gitea

Commit Graph

Author	SHA1	Message	Date
Mark Sagi-Kazar	f141f2133b	Fix whitespace	6 years ago
Stephan Renatus	d9487e553b	*: fix some lint issues Mostly gathered these using golangci-lint's deadcode and ineffassign linters. Signed-off-by: Stephan Renatus <srenatus@chef.io>	7 years ago
LanceH	07a77e0dac	Use connector_id param to skip directly to a specific connector	7 years ago
Andy Lindeman	59b6595c37	userinfo_endpoint is required	7 years ago
Andy Lindeman	840065faaf	Assert something about the returned userinfo	7 years ago
Andy Lindeman	46f5726d11	Use oidc.Verifier to verify tokens	7 years ago
Andy Lindeman	157c359f3e	Bump go-oidc to latest v2	7 years ago
Mark Sagi-Kazar	06521ffa49	Remove the logrus logger wrapper	7 years ago
Mark Sagi-Kazar	be581fa7ff	Add logger interface and stop relying on Logrus directly	7 years ago
Stephan Renatus	b9f6594bf0	*: github.com/coreos/dex -> github.com/dexidp/dex Signed-off-by: Stephan Renatus <srenatus@chef.io>	8 years ago
Frederic Branczyk	5f03479d29	*: Add go runtime, process, HTTP and gRPC metrics	8 years ago
Stephan Renatus	b09a13458f	password connectors: allow overriding the username attribute (password prompt) This allows users of the LDAP connector to give users of Dex' login prompt an idea of what they should enter for a username. Before, irregardless of how the LDAP connector was set up, the prompt was Username [_________________] Password [_________________] Now, this is configurable, and can be used to say "MyCorp SSO Login" if that's what it is. If it's not configured, it will default to "Username". For the passwordDB connector (local users), it is set to "Email Address", since this is what it uses. Signed-off-by: Stephan Renatus <srenatus@chef.io>	8 years ago
Damian Pacierpnik	e3c9b49299	Cross clients improvement - requesting client ID always added to the audience claim	9 years ago
Eric Stroczynski	2b354c8fdb	server: set sane bcrypt cost upper bound	9 years ago
Eric Stroczynski	4bcb0aaae9	server: log bcrypt cost if > 12, error on runtime > 10s The bcrypt hashing algorithm runtime grows exponentially with cost, and might cause a timeout if the cost is too high. Notifying the user of high cost and of long running calculations will help with tuning and debugging.	9 years ago
Eric Stroczynski	4a88d0641a	: update {S->s}irupsen/logrus	9 years ago
rithu john	8c9c2518f5	server: account for dynamically changing connector object in storage.	9 years ago
Eric Chiang	33f0199077	*: fix spelling using github.com/client9/misspell	9 years ago
Eric Chiang	777eeafabc	*: update go-oidc and use standard library's context package	9 years ago
rithu john	d928ac0677	storage: Add OfflineSession object to backend storage.	9 years ago
Eric Chiang	80038847de	server: clean up test comments and code flow	9 years ago
Eric Chiang	1eda382789	server: add at_hash claim support The "at_hash" claim, which provides hash verification for the "access_token," is a required claim for implicit and hybrid flow requests. Previously we did not include it (against spec). This PR implements the "at_hash" logic and adds the claim to all responses. As a cleanup, it also moves some JOSE signing logic out of the storage package and into the server package. For details see: https://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken	9 years ago
Eric Chiang	f778b2d33b	server: update refresh tokens instead of deleting and creating another The server implements a strategy called "Refresh Token Rotation" to ensure refresh tokens can only be claimed once. ref: https://tools.ietf.org/html/rfc6819#section-5.2.2.3 Previously "refresh_token" values in token responses where just the ID of the internal refresh object. To implement rotation, when a client redeemed a refresh token, the object would be deleted, a new one created, and the new ID returned as the new "refresh_token". However, this means there was no consistent ID for refresh tokens internally, making things like foreign keys very hard to implement. This is problematic for revocation features like showing all the refresh tokens a user or client has out. This PR updates the "refresh_token" to be an encoded protobuf message, which holds the internal ID and a nonce. When a refresh token is used, the nonce is updated to prevent reuse, but the ID remains the same. Additionally it adds the timestamp of each token's last use.	9 years ago
Eric Chiang	f926d74157	server: fixes for the implicit and hybrid flow Accept the following response_type for the implicit flow: id_token token id_token And the following for hybrid flow code id_token code token code token id_token This corrects the previous behavior of the implicit flow, which only accepted "token" (now correctly rejected).	9 years ago
rithu john	9949a1313c	server: modify error messages to use logrus.	9 years ago
rithu john	2e22a948cf	cmd/dex: add logging config and serve logger for different modules.	9 years ago
Eric Chiang	391dc51c13	*: add theme based frontend configuration This PR reworks the web layout so static files can be provided and a "themes" directory to allow a certain degree of control over logos, styles, etc. This PR does NOT add general support for frontend customization, only enough to allow us to start exploring theming internally. The dex binary also must now be run from the root directory since templates are no longer "compiled into" the binary. The docker image has been updated with frontend assets.	9 years ago
Eric Chiang	522749b5d8	*: switch oidc client to github.com/coreos/go-oidc This saves us from having to import two different versions of square/go-jose.	9 years ago
Eric Chiang	55e97d90a6	*: add tests for the RefreshConnector	9 years ago
Eric Chiang	952e0f81f5	connector: add RefreshConnector interface	9 years ago
Eric Chiang	5c602d36d9	server: fix expiry test flake Ensure compared times are within a second of one another instead of rounding, which can flake if the two times are different enough to do round to different values. Tested using the golang.org/x/tools/cmd/stress tool. The following set of commands fail without this patch: $ go get golang.org/x/tools/cmd/stress $ go test -o server.test github.com/coreos/dex/server $ stress ./server.test -test.run=TestOAuth2CodeFlow 219 runs so far, 0 failures 425 runs so far, 0 failures 618 runs so far, 0 failures 802 runs so far, 0 failures ^C Closes #699	9 years ago
Eric Chiang	12a5c0ada3	server: use seconds instead of nano seconds for expires_in and expiry	9 years ago
Eric Chiang	57a59d4631	*: don't error out if a username doesn't exist in the backing connector Instead of throwing a 500 error if a user enters an invalid name, display the same text box as if the user had entered the wrong password. NOTE: An invalid username now returns much quicker than an invalid password. Consider adding an arbitrary sleep in the future if we care about masking which was invalid.	10 years ago
Eric Chiang	96440e4cc5	*: fix linting	10 years ago
Eric Chiang	4296604f11	{cmd,server}: move garbage collection logic to server	10 years ago
Eric Chiang	2834da443f	server: allow extra spaces in scopes go-oidc sends an extra space before the list of scopes. This is bad but we have to support it, so we'll be more lenient and ignore duplicated whitespace.	10 years ago
Eric Chiang	ac6e419d48	server: add tests for refreshing with explicit scopes	10 years ago
Eric Chiang	6dbb5c4de6	server: fix cross client scope prefix	10 years ago
Eric Chiang	cdf0b91690	server: add an option to enable emails and passwords from the database	10 years ago
Eric Chiang	608d8ba984	*: switch dex to the ported templates	10 years ago
Eric Chiang	02dd18483d	server: add integration test for the implicit flow	10 years ago
Eric Chiang	4fe7260bb3	server: run server tests at a non-root URL As we've seen on master it's very easy mistakenly make changes that assume root URL paths. Run server integration tests at a non-root issuer URL to prevent this.	10 years ago
Eric Chiang	bfe560ee21	rename	10 years ago
Eric Chiang	4cbe9bbc82	server: cache signing keys	10 years ago
Eric Chiang	cab271f304	initial commit	10 years ago

44 Commits (2f8d1f8e42eebe6b4a4b421cc97053dcdb6b7b4c)