mirror/dex - dex - xhrpb gitea

Commit Graph

Author	SHA1	Message	Date
rithu leena john	b119ffddcb	Merge pull request #801 from rithujohn191/token-revocation api: adding a gRPC call for listing refresh tokens.	9 years ago
rithu john	d201e49248	api: adding a gRPC call for listing refresh tokens.	9 years ago
rithu leena john	53e383670a	Merge pull request #793 from rithujohn191/token-revocation storage: Add OfflineSession object to backend storage.	9 years ago
rithu john	d928ac0677	storage: Add OfflineSession object to backend storage.	9 years ago
rithu leena john	49f446c1a7	Merge pull request #800 from ericchiang/server-test-comments server: clean up test comments and code flow	9 years ago
Eric Chiang	80038847de	server: clean up test comments and code flow	9 years ago
Eric Chiang	dd415f5e2f	Merge pull request #799 from ericchiang/thirdpartyresources Documentation: warn admins not to edit dex ThirdPartyResources manually	9 years ago
rithu leena john	167d7be281	Merge pull request #790 from givia/github-teams-pagination Fixes #706	9 years ago
Eric Chiang	adf3703962	Documentation: warn admins not to edit dex ThirdPartyResources manually	9 years ago
Eric Chiang	7f860e09b5	Merge pull request #796 from ericchiang/html-template {web,server}: use html/template and reduce use of auth request ID	9 years ago
Eric Chiang	72a431dd4b	{web,server}: use html/template and reduce use of auth request ID Switch from using "text/template" to "html/template", which provides basic XSS preventions. We haven't identified any particular place where unsanitized user data is rendered to the frontend. This is just a preventative step. At the same time, make more templates take pure URL instead of forming an URL themselves using an "authReqID" argument. This will help us stop using the auth req ID in certain places, preventing garbage collection from killing login flows that wait too long at the login screen. Also increase the login session window (time between initial redirect and the user logging in) from 30 minutes to 24 hours, and display a more helpful error message when the session expires. How to test: 1. Spin up dex and example with examples/config-dev.yaml. 2. Login through both the password prompt and the direct redirect. 3. Edit examples/config-dev.yaml removing the "connectors" section. 4. Ensure you can still login with a password. (email/password is "admin@example.com" and "password")	9 years ago
rithu leena john	12f969364e	Merge pull request #794 from rithujohn191/saml-doc Documentation: Minor changes to SAML connector doc.	9 years ago
rithu john	fecd596ae2	Documentation: Minor changes to SAML connector doc.	9 years ago
rithu leena john	42d0728048	Merge pull request #785 from holgerkoser/master Improve SAML Signature and Response Validation	9 years ago
rithu leena john	27224cdc98	Merge pull request #788 from givia/gitlab-connector connector: add GitLab connecor	9 years ago
Ali Javadi	e623ad4d35	connector: add GitLab connector	9 years ago
Eric Chiang	0dcf1bcf79	Merge pull request #792 from ericchiang/auth-endpoint-post server: support POSTing to authorization endpoint	9 years ago
Eric Chiang	8541184afb	server: support POSTing to authorization endpoint Fixes #791	9 years ago
rithu leena john	36883d0bbf	Merge pull request #789 from rithujohn191/token-revocation-proposal Documentation/proposals: Add a proposal for refresh token revocation.	9 years ago
rithu john	d114b8ffc7	Documentation/proposals: Add a proposal for refresh token revocation.	9 years ago
Ali Javadi	98bfa4fbb1	Fixes #706	9 years ago
Holger Koser	27a1e9f1bd	vendor: revendor	9 years ago
Holger Koser	e46f2ebe40	Improve SAML Signature and Response Validation * Improve Order of Namespace Declarations and Attributes in Canonical XML. This is related to an issue in goxmldsig for which I created an [pull request](https://github.com/russellhaering/goxmldsig/pull/17). * Do not compress the AuthnRequest if `HTTP-POST` binding is used. * SAML Response is valid if the Message and/or the Assertion is signed. * Add `AssertionConsumerServiceURL` to `AuthnRequest` * Validate Status on the Response * Validate Conditions on the Assertion * Validation SubjectConfirmation on the Subject	9 years ago
rithu leena john	48fcf66a35	Merge pull request #783 from rithujohn191/config-validation cmd/dex: make connector name field mandatory in dex configuration.	9 years ago
rithu john	31e8009441	cmd/dex: make connector name field mandatory in dex configuration.	9 years ago
Eric Chiang	613d160ad9	Merge pull request #782 from marians/patch-1 Docs: Added a name to the LDAP connector	9 years ago
Eric Chiang	d3f4ae2ab7	Merge pull request #781 from ajohnstone/patch-1 Update kubernetes.md - correct typo	9 years ago
Marian Steinbach	38a2e41e0a	Added a name to the connector Without a name, the example app's login form will only show `Log in with` as a button label.	9 years ago
Andrew Johnstone	b10c0a1c87	Update kubernetes.md	9 years ago
rithu leena john	a3ef8d26bc	Merge pull request #777 from rithujohn191/update-release-doc Documentation: add docs on patch release process.	9 years ago
rithu john	265cfacd17	Documentation: add docs on patch release process.	9 years ago
rithu leena john	fe93f60af4	Merge pull request #775 from xeonx/master Allow CORS on keys and token endpoints	9 years ago
Simon HEGE	415a68f977	Allow CORS on keys and token endpoints	9 years ago
Eric Chiang	ca7d2b8f9e	Merge pull request #772 from ericchiang/at_hash-support server: add at_hash claim support	9 years ago
Eric Chiang	1eda382789	server: add at_hash claim support The "at_hash" claim, which provides hash verification for the "access_token," is a required claim for implicit and hybrid flow requests. Previously we did not include it (against spec). This PR implements the "at_hash" logic and adds the claim to all responses. As a cleanup, it also moves some JOSE signing logic out of the storage package and into the server package. For details see: https://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken	9 years ago
Eric Chiang	79c21f9b0c	Merge pull request #773 from y2kenny/patch-1 Removed extra o typo	9 years ago
y2kenny	4d4cb99459	Removed extra o typo	9 years ago
Eric Chiang	3c247db00a	Merge pull request #757 from ericchiang/constant-refresh-tokens *: update refresh tokens instead of deleting and creating another	9 years ago
Eric Chiang	ed20fee2b9	cmd/example-app: fix refreshing	9 years ago
Eric Chiang	f4bbab5056	server/internal: generate protobuf types	9 years ago
Eric Chiang	f778b2d33b	server: update refresh tokens instead of deleting and creating another The server implements a strategy called "Refresh Token Rotation" to ensure refresh tokens can only be claimed once. ref: https://tools.ietf.org/html/rfc6819#section-5.2.2.3 Previously "refresh_token" values in token responses where just the ID of the internal refresh object. To implement rotation, when a client redeemed a refresh token, the object would be deleted, a new one created, and the new ID returned as the new "refresh_token". However, this means there was no consistent ID for refresh tokens internally, making things like foreign keys very hard to implement. This is problematic for revocation features like showing all the refresh tokens a user or client has out. This PR updates the "refresh_token" to be an encoded protobuf message, which holds the internal ID and a nonce. When a refresh token is used, the nonce is updated to prevent reuse, but the ID remains the same. Additionally it adds the timestamp of each token's last use.	9 years ago
Eric Chiang	312ca7491e	storage: add extra fields to refresh token and update method	9 years ago
Eric Chiang	c66cce8b40	Merge pull request #766 from ericchiang/implicit-flow server: fixes for the implicit and hybrid flow	9 years ago
Eric Chiang	f926d74157	server: fixes for the implicit and hybrid flow Accept the following response_type for the implicit flow: id_token token id_token And the following for hybrid flow code id_token code token code token id_token This corrects the previous behavior of the implicit flow, which only accepted "token" (now correctly rejected).	9 years ago
Eric Chiang	7f72ea786d	Merge pull request #752 from ericchiang/saml Add an experimental SAML connector	9 years ago
Eric Chiang	7ea2d24011	vendor: revendor	9 years ago
Eric Chiang	78665074ed	cmd/example-app: add option to not request a refresh token	9 years ago
Eric Chiang	0f4a1f69c5	*: wire up SAML POST binding	9 years ago
Eric Chiang	31dfb54b6f	connector: add a SAML connector	9 years ago
Eric Chiang	15fadeaf86	Merge pull request #767 from rithujohn191/fix-refresh storage: Add ConnectorData to storage RefreshToken.	9 years ago

1 2 3 4 5 ...

394 Commits (b119ffddcb08936d36fd208b026e27fb2b9e5ad0) All Branches Search

394 Commits (b119ffddcb08936d36fd208b026e27fb2b9e5ad0)

All Branches