mirror/dex - dex - xhrpb gitea

Commit Graph

Author	SHA1	Message	Date
Eric Chiang	6475ce1f62	connector/oidc: remove test that talks to the internet	9 years ago
Pavel Borzenkov	3b5df52c0f	connector/linkedin: implement RefreshConnector interface Do Refresh() by querying user's profile data. Since LinkedIn doesn't provide refresh tokens at all, and the access tokens have 60 days expiration, refresh tokens issued by Dex will fail to update after 60 days. Signed-off-by: Pavel Borzenkov <pavel.borzenkov@gmail.com>	9 years ago
Pavel Borzenkov	ab06119431	connector: implement LinkedIn connector connector/linkedin implements authorization strategy via LinkedIn's OAuth2 endpoint + profile API. It doesn't implement RefreshConnector as LinkedIn doesn't provide any refresh token at all (https://developer.linkedin.com/docs/oauth2, Step 5 — Refresh your Access Tokens) and recommends ordinary AuthCode exchange flow when token refresh is required. Signed-off-by: Pavel Borzenkov <pavel.borzenkov@gmail.com>	9 years ago
Eric Chiang	d099145921	authproxy: update docs and set a userID	9 years ago
Michael Stapelberg	a41d93db4a	Implement the “authproxy” connector (for Apache2 mod_auth etc.)	9 years ago
Eric Chiang	fcf00019de	connector/ldap: add test for InsecureSkipVerify option	9 years ago
Lars Sjöström	4605fdd551	connector/gitlab: Fix regexp in Link parser	9 years ago
Eric Chiang	980400db0b	Makefile: error out if go files aren't correctly formatted Noticed in #1058 that our gofmt make target isn't actually erroring if someone commits misformatted code.	9 years ago
Eric Stroczynski	ce9ac761a6	connector/github: abstract scope check and group getter	9 years ago
Chien Huey	99370b5880	Updated comment to include reference to GitHub Enterprise not supporting verified emails	9 years ago
Eric Stroczynski	e92f38f38f	connector/github: error if no groups scope without orgs We should always check if a user is in any orgs or teams specified in config, and whether the groups scope is also included in client requests. If not, return an error, because dex wouldn't have required permissions to do the request anyway (need read:org).	9 years ago
Chien Huey	98f6a217d3	When connecting to GitHub Enterprise, force email verified field to true	9 years ago
Eric Stroczynski	5894d017d5	connector/github: debug->info logging, more informative userInOrg msg	9 years ago
Eric Stroczynski	484327fd5f	connector/github: only user users' login name in API reqs	9 years ago
Eric Stroczynski	ca75470ae3	connector/gitlab: correct scope strings, better default	9 years ago
Eric Chiang	aad328bb35	*: add log events for login, LDAP queries, and SAML responses	9 years ago
Eric Stroczynski	26527011ab	connector/github: enable private, primary emails; refactor API calls Documentation: removed private emails caveats section	9 years ago
Eric Stroczynski	9d154802a2	connector/github: multiple orgs, query by teams Documentation: examples of GitHub `orgs` field with multiple orgs and org with teams; note legacy behavior	9 years ago
Eric Stroczynski	4a88d0641a	: update {S->s}irupsen/logrus	9 years ago
rithu john	5e0bf8b65f	connector/oidc: fix hosted domain support.	9 years ago
Ben Navetta	cbb007663f	add documentation and tests	9 years ago
Ben Navetta	4194530cf3	initial hostedDomain support	9 years ago
rithu john	682d78f527	connector: improve error message for callback URL mismatch	9 years ago
rithu john	0dd024d669	connector/ldap: correct a comment.	9 years ago
rithu john	6e3e174100	connector/ldap: check for blank passwords and return error.	9 years ago
zhuguihua	4e99ec3eeb	Fix two typos Signed-off-by: zhuguihua <zhuguihua@cmss.chinamobile.com> Change storace to storage in cmd/dex/config.go, change userSearch to groupSearch in connector/ldap/ldap.go	9 years ago
Eric Chiang	74f5eaf47e	connector/ldap: support the StartTLS flow for secure connections When connecting to an LDAP server, there are three ways to connect: 1. Insecurely through port 389 (LDAP). 2. Securely through port 696 (LDAPS). 3. Insecurely through port 389 then negotiate TLS (StartTLS). This PR adds support for the 3rd flow, letting dex connect to the standard LDAP port then negotiating TLS through the LDAP protocol itself. See a writeup here: http://www.openldap.org/faq/data/cache/185.html	9 years ago
Eric Chiang	00b5c99ffc	connector/saml/testdata: fix bad status test case Notice this when inspecting the code coverage results. For some reason this test wasn't triggering the bad status code path, maybe due to signature validation. Removing the comment fixed the code coverage.	9 years ago
rithu john	76b9eb1db9	connector/github: add support for github enterprise.	9 years ago
Eric Chiang	97813ff4fc	connector/ldap: fix case where groups are listed on the user entity Support schemas that determine membership by having fields on the user entity, instead of listing users on a groups entity. E.g. the following schema is now supported when it wasn't previously: cn=eric,cn=user,dn=exapmle,dn=com objectClass=myPerson cn: eric uid: eric email: eric@example.com memberOf: foo memberOf: bar cn=foo,cn=group,dn=exapmle,dn=com objectClass=myGroup cn: foo cn=bar,cn=group,dn=exapmle,dn=com objectClass=myGroup cn: bar	9 years ago
Eric Chiang	0ac11d93e6	connector/ldap/testdata: add LDAP schema files	9 years ago
Eric Chiang	4a93b55c8b	connector/ldap: add LDAP integration tests	9 years ago
Eric Chiang	362e0798a4	connector/saml: clean up SAML verification logic and comments	9 years ago
Phu Kieu	bd754e2b2d	Fix entityIssuer -> ssoIssuer typo	9 years ago
Phu Kieu	47897f73fa	Validate audience with entityIssuer if present, use redirectURI otherwise	9 years ago
Phu Kieu	217b5ca2c7	Add ssoIssuer to fix Response issuer checking Rename issuer to entityIssuer	9 years ago
Eric Chiang	a97cffcd52	connector/saml: refactor tests and add self-signed responses Introduces SAML tests which execute full response processing and compare user attributes. tesdata now includes a full, self-signed CA and documents signed using xmlsec1. Adds deprication notices to existing tests, but don't remove them since they still provide coverage.	9 years ago
Eric Chiang	e0709dc2ac	connector/saml: fix validation bug with multiple Assertion elements When a SAML response provided multiple Assertion elements, only the first one is checked for a valid signature. If the Assertion is verified, the original Assertion is removed and the canonicalized version is prepended to the Response. However, if there were multiple assertions, the second assertion could end up first in the list of Assertions, even if it was unsigned. For example this: <Response> <!-- Response unsigned. According to SAML spec must check assertion signature. --> <Assertion> <Signature> <!-- Correrctly signed assertion --> </Signature> </Assertion> <Assertion> <!-- Unsigned assertion inserted by attacker--> </Assertion> </Response> could be verified then re-ordered to the following: <Response> <!-- Response unsigned. According to SAML spec must check assertion signature. --> <Assertion> <!-- Unsigned assertion inserted by attacker--> </Assertion> <Assertion> <!-- Canonicalized, correrctly signed assertion --> </Assertion> </Response> Fix this by removing all unverified child elements of the Response, not just the original assertion.	9 years ago
Phu Kieu	6f9ef961bb	Use etreeutils.NSSelectOne to select Assertion element	9 years ago
rithu john	59502850f0	connector: Connectors without a RefreshConnector should not return a refresh token instead of erroring	9 years ago
Eric Chiang	50b223a9db	*: validate InResponseTo SAML response field and make issuer optional	9 years ago
Eric Chiang	33f0199077	*: fix spelling using github.com/client9/misspell	9 years ago
Eric Chiang	ac032e99f0	connector/oidc: expose oauth2.RegisterBrokenAuthHeaderProvider	9 years ago
Eric Chiang	777eeafabc	*: update go-oidc and use standard library's context package	9 years ago
Ali Javadi	e623ad4d35	connector: add GitLab connector	9 years ago
Ali Javadi	98bfa4fbb1	Fixes #706	9 years ago
Holger Koser	e46f2ebe40	Improve SAML Signature and Response Validation * Improve Order of Namespace Declarations and Attributes in Canonical XML. This is related to an issue in goxmldsig for which I created an [pull request](https://github.com/russellhaering/goxmldsig/pull/17). * Do not compress the AuthnRequest if `HTTP-POST` binding is used. * SAML Response is valid if the Message and/or the Assertion is signed. * Add `AssertionConsumerServiceURL` to `AuthnRequest` * Validate Status on the Response * Validate Conditions on the Assertion * Validation SubjectConfirmation on the Subject	9 years ago
Eric Chiang	31dfb54b6f	connector: add a SAML connector	9 years ago
rithu john	6a728f107e	connector/ldap: enable groupSearch to be empty	9 years ago
rithu john	9949a1313c	server: modify error messages to use logrus.	9 years ago

1 2

82 Commits (b746ab4975262bbba6cf5d4792b82875f2bee916)