7df3ad05ed
Merge pull request #1797 from smallstep/mariano/init-scep
...
Allow custom SCEP key manager
1 month ago
4202d6673c
Remove debug statement
1 month ago
db92404342
chore: fix function names in comment
...
Signed-off-by: verytrap <wangqiuyue@outlook.com>
1 month ago
725a913f66
Allow custom SCEP key manager
...
This commit allows to inject a custom key manger for SCEP.
1 month ago
10f6a901ec
Let the CA determine the RA lifetime
...
When the RA mode with StepCAS is used, let the CA decide which lifetime
the RA should get instead of requiring always 24h.
This commit also fixes linter warnings.
Related to #1094
2 months ago
b8510dd5b2
Make the `requestid` an exported middleware
2 months ago
d392c169fc
Improve functional coverage of request ID integration test
2 months ago
7e5f10927f
Decouple request ID middleware from logging middleware
3 months ago
c16a0b70ee
Remove `smallstep/assert` and `pkg/errors` from webhook tests
3 months ago
9689508709
Add tests for webhook request IDs
3 months ago
2a8b80a3e1
Merge branch 'master' into herman/webhook-request-id
3 months ago
ee44ac104d
fixup! Add AWS ca-west-1 identity document certificate
3 months ago
283d46d9a7
Add AWS ca-west-1 identity document certificate
3 months ago
b20af51f32
Upgrade go.step.sm/crypto to use go-jose/v3
5 months ago
f082cbc421
Denormalize provisioner name in SCEP webhook
6 months ago
9ebc8779f5
Normalize SCEP provisioner name in webhook body
6 months ago
e815864ed8
Add verification of `provisionerName` in test
6 months ago
de45d66cdb
Add `provisionerName` to webhook request body
6 months ago
49045a1150
Change CommonName validator in JWK
...
This commit changes the common name validator in the JWK provisioner to
accept either the token subject or any of the sans in the token.
7 months ago
9f84f7ce35
Allow for identity certificate signing (in sshSign) by skipping validators ( #1572 )
...
- skip urisValidator for identity certificate signing. Implemented
by building the validator with the context in a hacky way.
7 months ago
52baf52f84
Change scep password type to string
...
This commit changes the type of the decrypter key password to string to
be consistent with other passwords in the ca.json
8 months ago
4554f86f16
Make SCEP decrypter properties use `omitempty`
8 months ago
ffe079f31b
Merge branch 'master' into herman/scep-provisioner-decrypter
8 months ago
31da66c124
Fix webhooks signature
...
This commit fixes the way webhooks signatures are created. Before this
change, the signature of an empty body was prepended by the body itself.
8 months ago
3f3b67e05c
Merge branch 'herman/scep-provisioner-decrypter' into herman/scep-notifying-webhook
8 months ago
ba72710e2d
Address code review remarks
8 months ago
5f8e0de1c3
Fix duplicate import in SCEP provisioner
8 months ago
3ade92f8d5
Support both a decrypter key URI as well as PEM
8 months ago
b6c95d7be2
Add additional properties to SCEP notify webhook request body
8 months ago
63257e0576
Add full certificate DER bytes to success notification webhook
8 months ago
52bc96760b
Add SCEP certificate issuance notification webhook
8 months ago
4e06bdbc51
Add `SignWithContext` method to authority and mocks
8 months ago
b2301ea127
Remove the webhook `Do` method
8 months ago
f3229d3e3c
Propagate (original) request ID to webhook requests
...
Technically the webhook request is a new request, so maybe the
`X-Request-ID` should not be set to the value of the original
request? But then the original request ID should be propageted
in the webhook request body, or using a different header.
The way the request ID is used in this functionality is actually
more like a tracing ID, so that may be an option too.
8 months ago
33e661ce7d
Add a dummy CSR to SCEP request body tests
8 months ago
36f1dd70bf
Add CSR to `SCEPCHALLENGE` webhook request body
8 months ago
98d015b5c3
Fix linting issues
8 months ago
d9f56cdbdc
Merge branch 'master' into herman/scep-provisioner-decrypter
8 months ago
9d3b78ae49
Add `excludeIntermediate` to SCEP provisioner
8 months ago
82b8e16d7f
Add all AWS identity document certificates
...
* move to use embed instead of a multi-line string
* add test to ensure all certificates are valid
* add test to ensure validity (no expired certificate)
9 months ago
645b6ffc18
Ensure no prompt is fired for loading provisioner decrypter
9 months ago
e2e9bf5494
Clarify some SCEP properties
10 months ago
c0a1837cd9
Verify full decrypter/signer configuration at usage time
...
When changing the SCEP configuration it is possible that one
or both of the decrypter configurations required are not available
or have been provided in a way that's not usable for actual SCEP
requests.
Instead of failing hard when provisioners are loaded,
which could result in the CA not starting properly, this type of
problematic configuration errors will now be handled at usage
time instead.
10 months ago
569a1be12c
Merge branch 'master' into herman/scep-provisioner-decrypter
10 months ago
cce7d9e839
Address comments from code review
10 months ago
c7c7decd5e
Add support for the disableSmallstepExtensions claim
...
This commit adds a new claim to exclude the Smallstep provisioner
extension from the generated certificates.
Fixes #620
10 months ago
1ce80cf740
Merge branch 'master' into herman/scep-provisioner-decrypter
10 months ago
567fc25404
Use the RSA decryption configuration for signing responses too
10 months ago
7061147885
Use step.Abs to load the certificate templates
...
step.Abs has been removed from crypto and they need to be set when those
methods are used
10 months ago
95887ebf40
Merge pull request #1481 from smallstep/remove-user-regex
...
Remove OIDC user regexp check
10 months ago
Mariano Cano
Mariano Cano
verytrap
Herman Slatman
Remi Vichery
Max