k-space/dex
Archived
11
0
Fork 0
Code Issues Pull Requests Packages Projects Activity
956 Commits 1 Branch 0 Tags
421c26fdf56f16aae0ca375c3d11edc9ab7eb184
Commit Graph
86 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Stephan Renatus 421c26fdf5 Merge pull request #1481 from LanceH/master 
Added "connector_id" to skip straight to a connector (similar to when len(connector) is 1.
 2019-07-23 11:31:25 +02:00
Stephan Renatus 6379403a68 Merge pull request #1486 from AlbanSeurat/tc/add-verify-password-api 
Add VerifyPassword to API
 2019-07-22 10:29:43 +02:00
Stephan Renatus 92920c86ea Merge pull request #1480 from srenatus/sr/deduplicate-filter-groups 
connectors: refactor filter code into a helper package
 2019-07-08 10:29:01 +02:00
Stephan Renatus 10611f3156 deps: revendor (github.com/stretchr/testify) 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2019-07-03 13:30:59 +02:00
Stephan Renatus 51f50fcad8 connectors: refactor filter code into a helper package 
I hope I didn't miss any :D

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2019-07-03 13:09:40 +02:00
Stephan Renatus 8b4dbb9fe7 Merge pull request #1473 from alindeman/add-user-endpoint 
Add UserInfo endpoint
 2019-07-02 09:26:26 +02:00
Stephan Renatus d6fad19d95 Merge pull request #1459 from flarno11/master 
make userName configurable
 2019-06-04 09:47:19 +02:00
Stephan Renatus c19ada3236 Merge pull request #1460 from tanmaykm/tan/linkedin 
Update LinkedIn connector to use v2 APIs

This updates LinkedIn connector to use the more recent v2 APIs. Necessary because v1 APIs are not able to retrieve email ids any more with the default permissions.

The API URLs are now different. Fetching the email address is now a separate call, made after fetching the profile details. The r_basicprofile permission is not needed any more, and r_liteprofile (which seems to be the one assigned by default) is sufficient.

The relevant API specifications are at:

    https://docs.microsoft.com/en-us/linkedin/shared/integrations/people/profile-api
    https://docs.microsoft.com/en-us/linkedin/shared/integrations/people/primary-contact-api
    https://docs.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/migration-faq#how-do-i-retrieve-the-members-email-address
 2019-06-03 19:35:55 +02:00
Stephan Renatus dfb2dfd333 Merge pull request #1456 from srenatus/sr/post-1448/fix-1455/restore-error-semantics 
connectors/oidc: truely ignore "email_verified" claim if configured that way
 2019-05-28 16:23:00 +02:00
Stephan Renatus 4e8cbf0f61 connectors/oidc: truely ignore "email_verified" claim if configured that way 
Fixes #1455, I hope.

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2019-05-28 16:15:06 +02:00
Stephan Renatus e137db978d Merge pull request #1457 from srenatus/sr/travis/use-go-1.1{1,2}.x 
travis: replace golang 1.10 and 1.11 with 1.12
 2019-05-28 16:14:43 +02:00
Stephan Renatus 11913a28c6 travis: replace golang 1.{10,11}.x with 1.12.x 
This is because I suspect the gofmt rules change between these versions to
make half the travis CI tests fail sometimes?

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2019-05-28 16:07:20 +02:00
Stephan Renatus 49e59fb54f Merge pull request #1448 from cappyzawa/user-id-key 
oidc: Make userID configurable
 2019-05-24 13:32:41 +02:00
Stephan Renatus 429bb9303f Merge pull request #1443 from deric/err 
Print appropriate error
 2019-05-12 07:58:12 +02:00
Stephan Renatus d8f9634afc Merge pull request #1436 from bonifaido/gitlab-groups 
gitlab: support for group whitelist, add tests
 2019-05-08 09:57:51 +02:00
Stephan Renatus ca66289077 Merge pull request #1402 from lstoll/lstoll-mod-fix 
Update modules for go 1.11.4+
 2019-02-11 09:40:22 +01:00
Stephan Renatus 7bd4071b4c Merge pull request #1396 from jtnord/useLoginId-dexidp 
Use github login as the id
 2019-02-05 13:54:49 +01:00
Stephan Renatus 815311fa19 Merge pull request #1397 from ericchiang/health-check-endpoint 
server: update health check endpoint to query storage periodically
 2019-02-04 21:38:58 +01:00
Stephan Renatus be171a2a53 Merge pull request #1395 from hainesc/master 
Display access token in example app
 2019-02-04 14:24:01 +01:00
Stephan Renatus b6f4740a15 Merge pull request #1390 from okamototk/activedirectory 
Add Active Directory and kubelogin integration sample.
 2019-02-03 11:09:33 +01:00
Stephan Renatus df18cb0c22 ldap_test: add filter tests 
The filters for user and group searches hadn't been included in our LDAP
tests. Now they are.

The concrete test cases are somewhat contrived, but that shouldn't
matter too much. Also note that the example queries I've used are not
supported in AD: https://stackoverflow.com/a/10043452

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2019-02-03 11:06:11 +01:00
Stephan Renatus b5826e66f0 Merge pull request #1394 from srenatus/sr/docs/maintainers 
update MAINTAINERS, mirror guidelines into dev doc
 2019-01-31 17:25:27 +01:00
Stephan Renatus 81f155882a Merge pull request #1392 from stevendanna/tls-configuration 
Bump minimum TLS protocol to TLSv1.2
 2019-01-29 12:48:57 +01:00
Stephan Renatus 4abf3b2102 docs: mirror resolution of #1281 in dev doc 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2019-01-29 10:29:12 +01:00
Stephan Renatus 2cfadcd95a MAINTAINERS: add @JoelSpeed 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2019-01-29 10:25:55 +01:00
Stephan Renatus 5ae094206b Merge pull request #1389 from ericchiang/bump-go 
Dockerfile: update Go to 1.11.5
 2019-01-24 08:52:33 +01:00
Stephan Renatus f1581ff873 Merge pull request #1374 from kbalka/keystone-connector 
PR contains connector for openstack keystone.

Features:

    access tokens
    refresh tokens
    groups

Requirements:

    access to openstack keystone instance
    keystone administrative account credentials

Enabling keystone connector specific tests:

    make sure docker is running
    export DEX_TEST_KEYSTONE=1
    make tests
 2019-01-11 15:46:28 +01:00
Stephan Renatus 2d1ac74ec0 Merge pull request #1380 from dkess/emailsuffix 
LDAP connector - add emailSuffix config option
 2019-01-09 08:16:41 +01:00
Stephan Renatus 4329f407dc Merge pull request #1373 from ericchiang/go-1.11.3 
Dockerfile: update to Go 1.11.3
 2018-12-14 08:43:32 +01:00
Stephan Renatus a3cf7b63b7 Merge pull request #1372 from babiel/configurable-auth-request-expiry 
Make expiry of auth requests configurable

This is a band-aid against #1292

I did not change the default from 24h, but I think it should be much lower for safety.
 2018-12-13 14:55:42 +01:00
Stephan Renatus aafbaa36c5 Merge pull request #1357 from srenatus/sr/issue-1354 
postgres: expose database/sql tunables

Fixes #1354.

I've not had a need for MaxIdleConns and ConnMaxLifetime myself, but it felt weird to only expose of the three settings.
 2018-12-06 09:12:42 +01:00
Stephan Renatus f5befb2e2d Merge pull request #1368 from ericchiang/makefile-cleanups 
Makefile: cleanups for newer versions of Go

Go 1.9 removed "./..." matching the vendor directory while Go 1.10 added
build and test caching. This means we no longer need to grep out
vendored matches (except for golint which doesn't implement the same
behavior), and we no longer need to pre-build packages with "go build -i".

https://golang.org/doc/go1.9#vendor-dotdotdot
https://golang.org/doc/go1.10#build
 2018-12-04 08:44:29 +01:00
Stephan Renatus 17ac7c8a86 Merge pull request #1367 from srenatus/sr/cherry-pick-lib/pq-bump 
bump lib/pq

taken from @vito's #1342.
 2018-12-02 10:29:35 +01:00
Stephan Renatus 73fdf4f75b storage/sql/postgres: expose stdlib tunables, set them for tests 
- adapted TestUnmarshalConfig to ensure the fields are read in
- added a test to see that at least MaxOpenConns works:
  - this is only exposed through (*db).Stats() in go 1.11, so this test
    has a build tag
  - the other two configurables can't be read back, so we've got to
    trust that the mechanism works given the one instance that's tested..

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-11-30 09:55:01 +01:00
Stephan Renatus d91f9fbc51 Merge pull request #1366 from dexidp/revert-1342-pr/retry-on-pg-serialization-error 
Revert "retry on serialization errors"

This will come back, as outline here: https://github.com/dexidp/dex/pull/1356#issuecomment-442523779
 2018-11-29 09:09:31 +01:00
Stephan Renatus 8f3cca7ba4 Revert "retry on serialization errors" 2018-11-29 08:24:13 +01:00
Stephan Renatus f3acec0b1b Merge pull request #1275 from ccojocar/client-update-api 
Extend the API with a function which updates the client configuration
 2018-11-27 11:47:16 +01:00
Stephan Renatus 007e4dae3c Merge pull request #1358 from OwenTuz/issue-1132-initial-kubernetes-documentation-improvements 
Kubernetes docs: clarify steps around use/creation of TLS assets.
 2018-11-26 13:54:44 +01:00
Stephan Renatus 5355b81e2a Merge pull request #1359 from OwenTuz/issue-1190-document-capitalisation-of-dn 
LDAP connector - Document that 'DN' must be in capitals
 2018-11-26 13:07:35 +01:00
Stephan Renatus 5f054fcf2e Merge pull request #1342 from concourse/pr/retry-on-pg-serialization-error 
retry on serialization errors
 2018-11-21 10:29:46 +01:00
Stephan Renatus f7f7314fdb Merge pull request #1350 from srenatus/sr/storage/nuke-standup-scripts 
storage: nuke standup scripts, adapt dev-integration-test docs
 2018-11-20 17:13:31 +01:00
Stephan Renatus 6182f213ef storage/conformance: remove old build tags 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-11-20 16:41:13 +01:00
Stephan Renatus 58b546a5be dev-integration-test: add etcd notes 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-11-20 16:41:12 +01:00
Stephan Renatus 0740c2370d storage/etcd: remove standup.sh 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-11-20 16:41:12 +01:00
Stephan Renatus cbcb1f61f3 dev-integration-tests: update database steps (just use docker) 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-11-20 16:41:12 +01:00
Stephan Renatus 1d0568efe9 storage/sql: remove standup.sh 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-11-20 16:41:12 +01:00
Stephan Renatus efb15205e9 Merge pull request #1352 from concourse/pr/support-pq-host-port 
pg: support host:port for backwards-compatibility
 2018-11-20 16:38:56 +01:00
Stephan Renatus d40043808b Merge pull request #1345 from concourse/pr/github-team-name-and-slug 
Add 'both' option to use team name AND slug in TeamNameField

This allows the connector to be configured with both so that both team names and slugs can be returned in the groups. This makes configuring teams in an application a bit more foolproof; we would often have confusion over whether the team name or slug should be given by the user, so it's easier to just allow both, since collisions shouldn't be possible anyway.
 2018-11-20 16:30:54 +01:00
Stephan Renatus b1fd2fa8b1 Merge pull request #1346 from concourse/pr/postgres-unix-sockets 
Use pq connection parameters instead of URLs for postgres connections

This enables the use of socket paths like /var/run/postgresql for the 'host' instead of requiring TCP. Also, we know allow using a non-default port.
 2018-11-20 15:52:40 +01:00
Stephan Renatus 7c8a22443a Merge pull request #1349 from alexmt/1102-config-to-load-all-groups 
Add config to explicitly enable loading all github groups

Follow-up for #1102.
 2018-11-20 15:15:25 +01:00
Stephan Renatus 84ea412ca6 Merge pull request #1351 from CognotektGmbH/gypsydiver/1347-pr-gitlab-groups 
Gitlab connector should not require the api scope.

Fixes #1347.
 2018-11-20 14:49:11 +01:00
Stephan Renatus 42997448a7 Merge pull request #1343 from concourse/pr/remove-mysql-cockroachdb-drivers 
remove incomplete mysql and cockroachdb support
 2018-11-20 10:01:17 +01:00
Stephan Renatus 4738070951 Merge pull request #1338 from srenatus/sr/update-go-ldap 
update go-ldap, improve errors
 2018-11-20 08:02:13 +01:00
Stephan Renatus 2425c6ea63 Merge pull request #1340 from alexmt/1184-github-groups 
Issue #1184 - Github connector now returns a full group list when no org is specified
 2018-11-16 15:48:33 +01:00
Stephan Renatus 13a1679892 Merge pull request #1344 from concourse/pr/fix-conformance-time-comparison 
fix bogus conformance failure due to time zones
 2018-11-16 08:52:40 +01:00
Stephan Renatus 5236b2c819 Merge pull request #1339 from alexmt/1263-connector-error-message 
Issue #1263 - Render error message provided by connector if user authentication failed
 2018-11-15 19:06:30 +01:00
Stephan Renatus c14b2fd5a5 connector/ldap: slightly improve error output 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-11-13 09:40:40 +01:00
Stephan Renatus 3295084236 deps: revendor 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-11-13 07:54:16 +01:00
Stephan Renatus 1723e13fed glide.yaml: bump gopkg.in/ldap.v2 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-11-12 19:37:37 +01:00
Stephan Renatus 65b0c91992 Merge pull request #1245 from scotthew1/mock-connector-refresh 
add Refresh() to mock passwordConnector
 2018-10-25 16:38:08 +02:00
Stephan Renatus f903a2890e Merge pull request #1329 from ericchiang/lint 
*: vendor golint to prevent upstream changes from breaking the build
 2018-10-25 10:56:00 +02:00
Stephan Renatus e1acb6d577 Merge pull request #1307 from edtan/upstream-add-bitbucket-connector 
Add Bitbucket connector
 2018-10-12 09:02:21 +02:00
Stephan Renatus a1b6ba9bba Merge pull request #1311 from dannysauer/speling 
minor spelling correction
 2018-10-10 10:12:58 +02:00
Stephan Renatus b58053eefc Merge pull request #1305 from srenatus/sr/fix-1304 
connector/saml: make unparsable (trailing, non-space/newline) data an error
 2018-09-30 11:20:35 +02:00
Stephan Renatus 26c0206627 connector/saml: make unparsable (trailing, non-space/newline) data an error 
Fixes #1304, if we want to be harsh.

However, I think if it was the user's intention to pass two certs, and
the second one couldn't be read, that shouldn't just disappear. After
all, when attempting to login later, that might fail because the
expected IdP cert data isn't there.

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-09-29 11:09:33 +02:00
Stephan Renatus ff70c0453f Merge pull request #1278 from veily/master 
Support used self-signed certificates LDAP.
 2018-09-22 18:05:26 +02:00
Stephan Renatus 1260c62a80 Merge pull request #1296 from srenatus/sr/nuke-check-go-version 
scripts,Makefile: nuke check-go-version
 2018-09-10 17:55:01 +02:00
Stephan Renatus 86a3346b64 scripts,Makefile: nuke check-go-version 
Fixes #1291

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-09-10 16:34:00 +02:00
Stephan Renatus 666356d22d Merge pull request #1266 from byxorna/gabe/fix-etcd-timeout-bug 
fix timeout bug for etcd3 client connect
 2018-09-10 10:36:38 +02:00
Stephan Renatus 4a6da13097 Merge pull request #1253 from vasartori/master 
Fix #1252
 2018-09-10 08:12:17 +02:00
Stephan Renatus 9cc85c447c examples/k8s: reference quay.io/dexidp 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-09-06 09:10:01 +02:00
Stephan Renatus 1309c1f037 dev-releases.md, Makefile: update release process 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-09-06 09:09:46 +02:00
Stephan Renatus 9f10e5d020 revendor 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-09-05 17:57:08 +02:00
Stephan Renatus 14b89029c9 bill-of-materials: nuke 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-09-05 17:57:08 +02:00
Stephan Renatus b9f6594bf0 *: github.com/coreos/dex -> github.com/dexidp/dex 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-09-05 17:57:08 +02:00
Stephan Renatus 974617a426 Merge pull request #1285 from srenatus/sr/ldap/treat-bind-constraint-violation-as-bad-login 
connectors/ldap: treat 'constraint violation' on bind as bad credentials
 2018-09-05 10:18:51 +02:00
Stephan Renatus 6a2d4ab6b4 connectors/ldap: treat 'constraint violation' on bind as bad credentials 
Some directory servers (I think it's Oracle) return

    Constraint Violation: Exceed password retry limit. Account locked.

when attempting to login too many times. While constraint violation can
mean many things, we're checking this as an error on BIND, so it's
more likely that something like this has happened than any other thing.

Hence, we should treat it as an "incorrect password" situation, not an
internal error.

It would of course be preferrable to surface more information about this
precise error (and similar ones), but I think this is beyond this small
change.

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-09-05 10:03:17 +02:00
Stephan Renatus 4caf82c1e9 Merge pull request #1258 from montaro/fix-odic-doc-broken-link 
Fix a broken link in the oidc readme
 2018-09-03 09:16:19 +02:00
Stephan Renatus cabdcb1eb0 Merge pull request #1259 from montaro/fix-typo-in-README 
fix typo in README
 2018-09-03 09:15:18 +02:00
Stephan Renatus e3e37504ca Merge pull request #1269 from tw3rp/patch-1 
[version_update] Update the version to the latest
 2018-09-03 09:09:05 +02:00
Stephan Renatus 608260d0f1 saml: add tests case covering tampered NameID field (comment) 
As sketched here:

https://developer.okta.com/blog/2018/02/27/a-breakdown-of-the-new-saml-authentication-bypass-vulnerability

Thought it was interesting to see how our SAML connector behaved. And
it seems to be behaving well. :)

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2018-02-28 08:42:17 +01:00
Stephan Renatus f013a44581 handlers/connector_login: check before update (optimization) 
Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2017-12-11 08:32:22 +01:00
Stephan Renatus f18d7afc6f handlers/connector_login: update AuthRequest irregardless of method 
Before, you could not POST your credentials to a password-connector's
endpoint without GETing that endpoint first. While this makes sense for
browser clients; automated interactions with Dex don't need to look at
the password form to fill it in.

A symptom of that missing GET was that the POST succeeded (!) with

    login successful: connector "", username="admin", email="admin@example.com", groups=[]

Note the connector "". A subsequent call to finalizeLogin would then
fail with

    connector with ID "" not found: failed to get connector object from storage: not found

Now, the connector ID of an auth request will be updated for both GETs
and POSTs.

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2017-12-08 11:49:52 +01:00
Stephan Renatus 41f663f70c show "back" link for password connectors 
This way, the user who has selected, say, "Log in with Email" can make up
their mind, and select a different connector instead.

However, if there's only one connector set up, none of this makes sense -- and
the link will thus not be displayed.

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2017-11-13 08:39:59 +01:00
Stephan Renatus b09a13458f password connectors: allow overriding the username attribute (password prompt) 
This allows users of the LDAP connector to give users of Dex' login
prompt an idea of what they should enter for a username.

Before, irregardless of how the LDAP connector was set up, the prompt
was

    Username
    [_________________]

    Password
    [_________________]

Now, this is configurable, and can be used to say "MyCorp SSO Login" if
that's what it is.

If it's not configured, it will default to "Username".

For the passwordDB connector (local users), it is set to "Email
Address", since this is what it uses.

Signed-off-by: Stephan Renatus <srenatus@chef.io>
 2017-11-09 09:30:03 +01:00
Stephan Renatus 18d53e7a28 README: fix links 2016-11-09 09:03:14 +01:00