k-space/dex
Archived
10
0
Fork 0
Code Issues Pull Requests Packages Projects Activity
1,121 Commits 1 Branch 0 Tags 18 MiB
f98332595e
Commit Graph

1121 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Eric Chiang
e0709dc2ac connector/saml: fix validation bug with multiple Assertion elements 
When a SAML response provided multiple Assertion elements, only the
first one is checked for a valid signature. If the Assertion is
verified, the original Assertion is removed and the canonicalized
version is prepended to the Response. However, if there were
multiple assertions, the second assertion could end up first in the
list of Assertions, even if it was unsigned.

For example this:

    <Response>
      <!--
         Response unsigned. According to SAML spec must check
         assertion signature.
      -->
      <Assertion>
        <Signature>
          <!-- Correrctly signed assertion -->
        </Signature>
      </Assertion>

      <Assertion>
        <!-- Unsigned assertion inserted by attacker-->
      </Assertion>
    </Response>

could be verified then re-ordered to the following:

    <Response>
      <!--
         Response unsigned. According to SAML spec must check
         assertion signature.
      -->
      <Assertion>
        <!-- Unsigned assertion inserted by attacker-->
      </Assertion>

      <Assertion>
        <!-- Canonicalized, correrctly signed assertion -->
      </Assertion>
    </Response>

Fix this by removing all unverified child elements of the Response,
not just the original assertion.
 2017-04-04 11:11:35 -07:00
Lucas Servén
a7d443ea2b Merge pull request #891 from squat/garbage_log_info 
server/server.go: make successful garbage collection log at info level
 2017-04-04 10:14:43 -07:00
Lucas Serven
f3d9bd5008
server/server.go: make successful garbage collection log at info level 2017-04-04 09:47:53 -07:00
rithu leena john
f4865a354c Merge pull request #886 from rithujohn191/error-msg-update 
storage/static.go: correct the error message that gets displayed.
 2017-03-29 11:54:00 -07:00
rithu john
5abb4b3df6 storage/static.go: correct the error message that gets displayed. 2017-03-29 11:32:02 -07:00
Eric Chiang
5eb8210eb4 Merge pull request #883 from ericchiang/scopes-docs 
Documentation: document dex scopes, claims, and client features
 2017-03-28 21:26:01 -07:00
Eric Chiang
8902ddc061 Merge pull request #881 from ericchiang/api-test-use-client 
server: use client connected to remove server for gRPC tests
 2017-03-28 21:25:55 -07:00
Eric Chiang
5e34f0d1a6 Documentation: document dex scopes, claims, and client features 2017-03-28 16:53:06 -07:00
Eric Chiang
f734b140cd server: use client connected to remove server for gRPC tests 2017-03-28 16:41:39 -07:00
rithu leena john
42c1eed231 Merge pull request #880 from rithujohn191/connector-object 
storage: add connector object to backend storage.
 2017-03-28 14:31:08 -07:00
rithu john
bc55b86d0d storage: add connector object to backend storage. 2017-03-28 14:12:38 -07:00
Eric Chiang
6e50c18458 Merge pull request #875 from ericchiang/fix-example-app-custom-ca 
cmd/example-app: fix custom CA behavior
 2017-03-24 13:21:20 -07:00
Eric Chiang
9b0e9ab2ca cmd/example-app: fix custom CA behavior 2017-03-24 11:53:28 -07:00
Eric Chiang
2a6ae0a6ea Merge pull request #870 from Calpicow/fix_assertion_fallback 
Fix assertion fallback
 2017-03-24 11:34:30 -07:00
Phu Kieu
6f9ef961bb Use etreeutils.NSSelectOne to select Assertion element 2017-03-24 11:20:53 -07:00
Phu Kieu
4b457d8c82 vendor: revendor 2017-03-24 11:03:30 -07:00
Phu Kieu
b5f70dac36 glide.yaml: update goxmldsig 2017-03-24 11:02:55 -07:00
rithu leena john
5d49e18478 Merge pull request #873 from rithujohn191/client-example 
examples/grpc-client: clean up the example and add tlsClientCA to ConfigMap.
 2017-03-23 17:24:11 -07:00
rithu john
562eae3fc7 examples/grpc-client: clean up the example and add tlsClientCA to ConfigMap. 2017-03-23 16:57:23 -07:00
rithu leena john
6146e23396 Merge pull request #872 from rithujohn191/offline-access-error 
connector: Connectors without a RefreshConnector should not error out
 2017-03-23 16:11:45 -07:00
rithu john
59502850f0 connector: Connectors without a RefreshConnector should not return a refresh token instead of erroring 2017-03-23 14:56:34 -07:00
Eric Chiang
b112aa2ecd Merge pull request #869 from ericchiang/saml-response-to 
*: validate InResponseTo SAML response field and make issuer optional
 2017-03-22 13:04:41 -07:00
Eric Chiang
50b223a9db *: validate InResponseTo SAML response field and make issuer optional 2017-03-22 13:02:44 -07:00
Eric Chiang
8b2956ddbc Merge pull request #867 from ericchiang/xml-validation 
glide.yaml: update goxmldsig
 2017-03-21 10:27:04 -07:00
Eric Chiang
910d59865b vendor: revendor 2017-03-21 09:27:22 -07:00
Eric Chiang
5888220965 glide.yaml: update goxmldsig 2017-03-21 09:25:56 -07:00
Eric Chiang
95d237003a Merge pull request #855 from ericchiang/static-storage-fallthrough 
storage: make static storages query real storages for some actions
 2017-03-20 10:42:34 -07:00
Eric Chiang
af54f59202 Merge pull request #864 from ericchiang/spelling 
*: fix spelling using github.com/client9/misspell
 2017-03-20 10:20:16 -07:00
Eric Chiang
25fdaa67a7 Merge pull request #860 from ericchiang/oidc-broken-auth-header 
connector/oidc: expose oauth2.RegisterBrokenAuthHeaderProvider
 2017-03-20 09:56:09 -07:00
Eric Chiang
4c39bc20ae storage: make static storages query real storages for some actions 
If dex is configured with static passwords or clients, let the API
still add or modify objects in the backing storage, so long as
their IDs don't conflict with the static ones. List options now
aggregate resources from the static list and backing storage.
 2017-03-20 09:39:38 -07:00
Eric Chiang
33f0199077 *: fix spelling using github.com/client9/misspell 2017-03-20 09:16:56 -07:00
Eric Chiang
f503ff7950 *: add documentation for the OpenID Connect provider 2017-03-20 08:47:02 -07:00
Eric Chiang
ac032e99f0 connector/oidc: expose oauth2.RegisterBrokenAuthHeaderProvider 2017-03-20 08:47:02 -07:00
rithu leena john
4bf74d8ac3 Merge pull request #862 from rithujohn191/update-api 
api: Update timestamp type for RefreshTokenRef to int64.
 2017-03-17 15:58:09 -07:00
rithu john
921090f05f api: Update timestamp type for RefreshTokenRef to int64. 2017-03-17 15:46:39 -07:00
rithu leena john
84af5273c8 Merge pull request #854 from rithujohn191/conformance-tests 
storage/conformance: update conformance tests with multiple entries per resource
 2017-03-17 10:51:24 -07:00
rithu john
9e88924577 storage/conformance: update conformance tests with multiple entries per resource 2017-03-16 16:35:51 -07:00
rithu leena john
7a798844cc Merge pull request #852 from ericchiang/fix-log-level 
storage/kubernetes: log INFO level if TPR already exists, not ERROR
 2017-03-15 10:50:00 -07:00
Eric Chiang
6cb38604d9 storage/kubernetes: log INFO level if TPR already exists, not ERROR 2017-03-15 10:30:10 -07:00
Eric Chiang
d31bb1c8d5 Merge pull request #848 from ericchiang/fix-sql-where-statement 
storage/sql: add missing WHERE statement to refresh token update
 2017-03-13 16:54:58 -07:00
Eric Chiang
0481fccd76 storage/sql: add missing WHERE statement to refresh token update 2017-03-13 15:53:28 -07:00
Eric Chiang
d6f4fa5d98 Merge pull request #844 from dmmcquay/master 
update kubernetes example-app explanation
 2017-03-10 09:59:10 -08:00
Derek McQuay
9b052f37c9
clearified redirect-uri and make cmd location 2017-03-09 22:36:37 -08:00
Derek McQuay
a6ab82d6c0
update kubernetes example-app explanation 
Clarify some potentially confusing issues with how to run and build the
example-app binary.
 2017-03-09 17:17:07 -08:00
Eric Chiang
90e9225e05 Merge pull request #842 from ericchiang/go-1-8 
*: only use docker when releasing, update to Go 1.8, remove aci scripts
 2017-03-09 11:04:18 -08:00
Eric Chiang
ee27a4f9f4 *: only use docker when releasing, update to Go 1.8, remove aci scripts 
This change modifies our release process to only require Docker
when building a release and updates our released binary to use Go
1.8. It also removes our .aci scripts, which we've not been
regularly building.

A nice consequence is that OSX users can now build a release image.
 2017-03-09 10:46:09 -08:00
Eric Chiang
95d54956e9 Merge pull request #840 from ericchiang/oidc-bump 
*: update go-oidc and use standard library's context package
 2017-03-08 11:46:40 -08:00
Eric Chiang
e5f60fe9dd vendor: revendor 2017-03-08 10:33:36 -08:00
Eric Chiang
777eeafabc *: update go-oidc and use standard library's context package 2017-03-08 10:33:19 -08:00
rithu leena john
6dd415997a Merge pull request #835 from rithujohn191/fix-client-example 
examples/grpc-client: minor corrections in the dex client example.
 2017-03-07 13:35:44 -08:00