mirror/dex - dex - xhrpb gitea

Commit Graph

Author	SHA1	Message	Date
Pavel Borzenkov	ab06119431	connector: implement LinkedIn connector connector/linkedin implements authorization strategy via LinkedIn's OAuth2 endpoint + profile API. It doesn't implement RefreshConnector as LinkedIn doesn't provide any refresh token at all (https://developer.linkedin.com/docs/oauth2, Step 5 — Refresh your Access Tokens) and recommends ordinary AuthCode exchange flow when token refresh is required. Signed-off-by: Pavel Borzenkov <pavel.borzenkov@gmail.com>	9 years ago
Michael Stapelberg	4931f30a80	authproxy.md: strip X-Remote-User follow-up for https://github.com/coreos/dex/pull/1100	9 years ago
Michael Stapelberg	a41d93db4a	Implement the “authproxy” connector (for Apache2 mod_auth etc.)	9 years ago
Damian Pacierpnik	e3c9b49299	Cross clients improvement - requesting client ID always added to the audience claim	9 years ago
Eric Chiang	f234e3707e	server: fix panic caused by deleting refresh token twice through api	9 years ago
Eric Stroczynski	2b354c8fdb	server: set sane bcrypt cost upper bound	9 years ago
Eric Chiang	aad328bb35	*: add log events for login, LDAP queries, and SAML responses	9 years ago
Eric Stroczynski	4bcb0aaae9	server: log bcrypt cost if > 12, error on runtime > 10s The bcrypt hashing algorithm runtime grows exponentially with cost, and might cause a timeout if the cost is too high. Notifying the user of high cost and of long running calculations will help with tuning and debugging.	9 years ago
Eric Stroczynski	4a88d0641a	: update {S->s}irupsen/logrus	9 years ago
rithu john	753526a506	server/rotation.go: Fix key rotation with multiple dex instances.	9 years ago
Eric Chiang	fcb9c5a1c4	server: fix localhost redirect validation for public clients	9 years ago
rithu john	aefdd6e004	server/api: return empty list of refresh tokens if user does not have any	9 years ago
rithu john	8c9c2518f5	server: account for dynamically changing connector object in storage.	9 years ago
Eric Chiang	ba1660ae1f	*: revendor and regenerate protobuf files	9 years ago
rithu john	dd1e901dd9	server/rotation.go: avoid displaying the "keys already rotated" error	9 years ago
Eric Chiang	5f377f07d4	*: promote SAML to stable This means we no longer refer to it as "experimental" and wont make breaking changes.	9 years ago
Lucas Serven	f3d9bd5008	server/server.go: make successful garbage collection log at info level	9 years ago
Eric Chiang	f734b140cd	server: use client connected to remove server for gRPC tests	9 years ago
rithu john	59502850f0	connector: Connectors without a RefreshConnector should not return a refresh token instead of erroring	9 years ago
Eric Chiang	50b223a9db	*: validate InResponseTo SAML response field and make issuer optional	9 years ago
Eric Chiang	33f0199077	*: fix spelling using github.com/client9/misspell	9 years ago
rithu john	921090f05f	api: Update timestamp type for RefreshTokenRef to int64.	9 years ago
Eric Chiang	777eeafabc	*: update go-oidc and use standard library's context package	9 years ago
Eric Chiang	2c4752d5d4	server: fix expiry detection for verification keys	9 years ago
rithu john	3df1db1864	storage: Surface "already exists" errors.	9 years ago
rithu john	1ec19d4fbf	api: adding a gRPC call for revoking refresh tokens.	9 years ago
rithu john	d201e49248	api: adding a gRPC call for listing refresh tokens.	9 years ago
rithu john	d928ac0677	storage: Add OfflineSession object to backend storage.	9 years ago
Eric Chiang	80038847de	server: clean up test comments and code flow	9 years ago
Eric Chiang	72a431dd4b	{web,server}: use html/template and reduce use of auth request ID Switch from using "text/template" to "html/template", which provides basic XSS preventions. We haven't identified any particular place where unsanitized user data is rendered to the frontend. This is just a preventative step. At the same time, make more templates take pure URL instead of forming an URL themselves using an "authReqID" argument. This will help us stop using the auth req ID in certain places, preventing garbage collection from killing login flows that wait too long at the login screen. Also increase the login session window (time between initial redirect and the user logging in) from 30 minutes to 24 hours, and display a more helpful error message when the session expires. How to test: 1. Spin up dex and example with examples/config-dev.yaml. 2. Login through both the password prompt and the direct redirect. 3. Edit examples/config-dev.yaml removing the "connectors" section. 4. Ensure you can still login with a password. (email/password is "admin@example.com" and "password")	9 years ago
Eric Chiang	8541184afb	server: support POSTing to authorization endpoint Fixes #791	9 years ago
Simon HEGE	415a68f977	Allow CORS on keys and token endpoints	9 years ago
Eric Chiang	1eda382789	server: add at_hash claim support The "at_hash" claim, which provides hash verification for the "access_token," is a required claim for implicit and hybrid flow requests. Previously we did not include it (against spec). This PR implements the "at_hash" logic and adds the claim to all responses. As a cleanup, it also moves some JOSE signing logic out of the storage package and into the server package. For details see: https://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken	9 years ago
Eric Chiang	f4bbab5056	server/internal: generate protobuf types	9 years ago
Eric Chiang	f778b2d33b	server: update refresh tokens instead of deleting and creating another The server implements a strategy called "Refresh Token Rotation" to ensure refresh tokens can only be claimed once. ref: https://tools.ietf.org/html/rfc6819#section-5.2.2.3 Previously "refresh_token" values in token responses where just the ID of the internal refresh object. To implement rotation, when a client redeemed a refresh token, the object would be deleted, a new one created, and the new ID returned as the new "refresh_token". However, this means there was no consistent ID for refresh tokens internally, making things like foreign keys very hard to implement. This is problematic for revocation features like showing all the refresh tokens a user or client has out. This PR updates the "refresh_token" to be an encoded protobuf message, which holds the internal ID and a nonce. When a refresh token is used, the nonce is updated to prevent reuse, but the ID remains the same. Additionally it adds the timestamp of each token's last use.	9 years ago
Eric Chiang	f926d74157	server: fixes for the implicit and hybrid flow Accept the following response_type for the implicit flow: id_token token id_token And the following for hybrid flow code id_token code token code token id_token This corrects the previous behavior of the implicit flow, which only accepted "token" (now correctly rejected).	9 years ago
Eric Chiang	0f4a1f69c5	*: wire up SAML POST binding	9 years ago
Simon HEGE	b4c47910e4	Allow CORS on discovery endpoint	9 years ago
rithu john	75aa1c67ce	server: add error HTML templates with error description.	9 years ago
Eric Chiang	fe196864c0	*: fix comment typos found with github.com/client9/misspell	9 years ago
rithu john	9949a1313c	server: modify error messages to use logrus.	9 years ago
rithu john	2e22a948cf	cmd/dex: add logging config and serve logger for different modules.	9 years ago
Eric Chiang	391dc51c13	*: add theme based frontend configuration This PR reworks the web layout so static files can be provided and a "themes" directory to allow a certain degree of control over logos, styles, etc. This PR does NOT add general support for frontend customization, only enough to allow us to start exploring theming internally. The dex binary also must now be run from the root directory since templates are no longer "compiled into" the binary. The docker image has been updated with frontend assets.	9 years ago
Eric Chiang	522749b5d8	*: switch oidc client to github.com/coreos/go-oidc This saves us from having to import two different versions of square/go-jose.	9 years ago
Eric Chiang	55e97d90a6	*: add tests for the RefreshConnector	9 years ago
Eric Chiang	952e0f81f5	connector: add RefreshConnector interface	9 years ago
Eric Chiang	5c602d36d9	server: fix expiry test flake Ensure compared times are within a second of one another instead of rounding, which can flake if the two times are different enough to do round to different values. Tested using the golang.org/x/tools/cmd/stress tool. The following set of commands fail without this patch: $ go get golang.org/x/tools/cmd/stress $ go test -o server.test github.com/coreos/dex/server $ stress ./server.test -test.run=TestOAuth2CodeFlow 219 runs so far, 0 failures 425 runs so far, 0 failures 618 runs so far, 0 failures 802 runs so far, 0 failures ^C Closes #699	9 years ago
Phu Kieu	35180a72f1	Enable groups scope	9 years ago
rithu john	ee9738d663	api: adding a gRPC call for listing passwords.	9 years ago
rithu john	de4e23a27b	api: add gRPC definition for version endpoint.	9 years ago

1 2

98 Commits (b746ab4975262bbba6cf5d4792b82875f2bee916)