95887ebf40
Merge pull request #1481 from smallstep/remove-user-regex
...
Remove OIDC user regexp check
10 months ago
ff424fa944
Fix tests.
10 months ago
904f416d20
Include authorization principal in provisioner webhooks.
10 months ago
5bfe96d8c7
Send X5C leaf certificate to webhooks
...
This commit adds a new property that will be sent to authorizing and
enriching webhooks when signing certificates using the X5C provisioner.
10 months ago
7fa97bedec
Remove OIDC user regexp check
...
This commit removes the regular expression check on OIDC usernames.
Although it is not recommended to use any character in a username,
it is possible to create and use them. The tool useradd has the flag
--badname and adduser has --allow-badname and --allow-all-names to
create new users with any character.
Moreover, it is possible to create any username with the rest of
provisioners.
Fixes #1436
10 months ago
6985b4be62
Clean up the SCEP authority and provisioner
1 year ago
a1f187e3df
Merge branch 'master' into herman/scep-provisioner-decrypter
1 year ago
180162bd6a
Refactor SCEP provisioner and decrypter
1 year ago
0377fe559b
Add basic version of provisioner specific SCEP decrypter
1 year ago
71fcdf8a0a
Fix linter errors from #1404
1 year ago
1031324273
add AWS public certificates for me-central-1 and ap-southeast-3
...
As per https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-signature.html
1 year ago
8b256f0351
address linter warning for go 1.19
1 year ago
0153ff4377
Remove superfluous `GetChallengePassword`
1 year ago
f9ec62f46c
Merge branch 'master' into herman/improve-scep-marshaling
1 year ago
c73f157ea4
Remove unused error from challenge validation controller creator
1 year ago
e8c1e8719d
Refactor SCEP webhook validation
1 year ago
419478d1e5
Make SCEP webhook validation look better
1 year ago
dfc56f21b8
Merge branch 'master' into herman/acme-da-tpm
1 year ago
ac35f3489c
Remove unused certificate validators and modifiers
...
With the introduction of certificate templates some certificate
validators and modifiers are not used anymore. This commit deletes the
ones that are not used.
1 year ago
09cbe8ba65
fixup! Add identity token for all Azure cloud environments
1 year ago
6297bace1a
Merge branch 'master' into herman/acme-da-tpm
1 year ago
b2c2eec76b
Add identity token for all Azure cloud environments
...
* Azure Public Cloud (default)
* Azure China Cloud
* Azure US Gov Cloud
* Azure German Cloud
1 year ago
59462e826c
Improve testing errors for OIDC `authorizeToken` function
1 year ago
10958a124b
Add email address to error message returned for OIDC validation
1 year ago
f1724ea8c5
Merge branch 'master' into herman/acme-da-tpm
1 year ago
5d87201abc
Ignore principals validations with OIDC
...
This commit will ignore principals validation when an OIDC provisioner
is used. When the principals in the server does not match the principals
given the validation was failing, even if the proper principals were set
by templates or webhooks. With this change OIDC will not validate the
principals and just set the default ones (name, name@example.org ) plus
the ones in the templates.
This commit also includes a change in the templates to allow to pass
a provisioner to the $(step path)/ssh/config template
Related to #807
1 year ago
c365d8580e
Move provisioner marshaling logic to api package
1 year ago
f2e1c56c6c
Improve SCEP provisioner marshaling
1 year ago
85cd9a1277
Fix some ACME DA doc strings (slightly)
2 years ago
b9f238ad4d
Add additional ACME `meta` properties to provisioner configuration
2 years ago
cbc0864370
Remove TODO and clarify ACME revoke authorization method docs
2 years ago
7203739369
Fix err assert linter warnings - upgrade outdated package
2 years ago
2c5e41b093
Fix webhook controller ignoring cert type
2 years ago
7101fbb0ee
Provisioner webhooks ( #1001 )
2 years ago
4c7a2ce3eb
Fix errors.As linter warnings
2 years ago
2d4efc8292
Fix linter warnings
2 years ago
75bb196193
Add concurrency workflow config | fix broken test due to golang ver
2 years ago
7c5e5b2b87
Even more linter fixes
2 years ago
f3d1863ec6
A few more linter errors
2 years ago
1e0ea6f958
more linting fixes
2 years ago
33458c88aa
Standardize linting file and fix or ignore lots of linting errors
2 years ago
f0a24bd8ca
Add acme property to enable challenges
...
Fixes #1027
2 years ago
2de7d3fcf0
Update authority/provisioner/claims.go
...
Co-authored-by: Mariano Cano <mariano@smallstep.com>
2 years ago
ab0d2503ae
Standardize linting file and fix or ignore lots of linting errors
2 years ago
34c6c65671
Pass attestation information to the Sign method
...
Attestation information might be useful in authorizing webhooks
2 years ago
42102d88d5
Fix merge and add unit tests
2 years ago
ee7307bd41
Cherry-pick acme.go from acdfdf3
2 years ago
1e098aef5b
Fixes ACMEAttestationFormat comment
2 years ago
ba42aaf865
Add attestationFormat property in the ACME provisioner
2 years ago
b2119e9f2c
Merge pull request #977 from smallstep/device-attestation
...
Device attestation
2 years ago
fd4e96d1f4
Rename method to IsChallengeEnabled
2 years ago
c77b4ff9c5
Fix linter errors
2 years ago
59c5219a07
Use a type for acme challenges
2 years ago
b89f210469
remove fail-email test and add ok-empty-email test
2 years ago
7a03c43fe2
allow missing Email claim in OIDC tokens, use subject when its missing
2 years ago
df96b126dc
Add AuthorizeChallenge unit tests
2 years ago
bca311b05e
Add acme property to enable challenges
...
Fixes #1027
2 years ago
693dc39481
Merge branch 'master' into device-attestation
2 years ago
23b8f45b37
Address gosec warnings
...
Most if not all false positives
2 years ago
5df1694250
Add endpoint id for the RA certificate
...
In a linked RA mode, send an endpoint id to group the server
certificates.
2 years ago
21427d5d65
Replace instead of prepend provisioner extension
...
With non standard SANs this will generate the SAN and provisioner
extension in the same order.
2 years ago
6b5d3dca95
Add provisioner name to RA info
2 years ago
a1f54921d2
Rename internal field
2 years ago
9408d0f24b
Send RA provisioner information to the CA
2 years ago
fe04f93d7f
all: reformat all go files with the next gofmt (Go 1.19)
...
There are some changes that manually edited, for example using '-' as
default list and grouping imports.
2 years ago
6b3a8f22f3
Add provisioner to SSH renewals
...
This commit allows to report the provisioner to the linkedca when
a SSH certificate is renewed.
2 years ago
3c4d0412ef
Merge pull request #941 from smallstep/ssh-provisioner
...
Report SSH provisioner
2 years ago
a627f21440
Fix AuthorizeSSHSign tests with extra SignOption
2 years ago
e7d7eb1a94
Add provisioner as a signOption for SSH
2 years ago
479eda7339
Improve error message when client renews with expired certificate
...
When a client provides an expired certificate and `AllowAfterExpiry`
is not enabled, the client would get a rather generic error with
instructions to view the CA logs. Viewing the CA logs can be done
when running `step-ca`, but they can't be accessed easily in the
hosted solution.
This commit returns a slightly more informational message to the
client in this specific situation.
2 years ago
5e9bce508d
Unexport GetPolicy()
2 years ago
d82e51b748
Update AllowWildcardNames configuration name
2 years ago
2b7f6931f3
Change Subject Common Name verification
...
Subject Common Names can now also be configured to be allowed or
denied, similar to SANs. When a Subject Common Name is not explicitly
allowed or denied, its type will be determined and its value will be
validated according to the constraints for that type of name (i.e. URI).
2 years ago
6e1f8dd7ab
Refactor policy engines into container
2 years ago
2a7620641f
Fix more PR comments
2 years ago
c40a4d2694
Contain policy engines inside provisioner Controller
2 years ago
72bbe53376
Add additional policy options
2 years ago
7f9034d22a
Add additional policy options
2 years ago
abcad679ff
Merge branch 'master' into herman/allow-deny
2 years ago
d6be9450be
Merge branch 'master' into herman/allow-deny
2 years ago
d3b6bc3c75
Merge branch 'master' into fix/adminra
2 years ago
674dc3c844
Rename unreleased claim to allowRenewalAfterExpiry for consistency.
2 years ago
0bb15e16f9
Fix missing ACME provisioner option
2 years ago
9797b3350e
Merge branch 'master' into herman/allow-deny
2 years ago
8abd568f03
Merge branch 'master' into fix/adminra
2 years ago
b7e11da480
Merge branch 'master' into feat/linkedra
2 years ago
df8ffb35af
Remove unnecessary database in provisioner config.
2 years ago
d8776d8f7f
Add K8sSA SSH user policy back
...
According to the docs, the K8sSA provisioner can be configured
to issue SSH user certs.
2 years ago
571b21abbc
Fix (most) PR comments
2 years ago
628d7448de
Don't return policy in provisioner JSON
2 years ago
2fbdf7d5b0
Merge branch 'master' into herman/allow-deny
2 years ago
00634fb648
api/render, api/log: initial implementation of the packages ( #860 )
...
* api/render: initial implementation of the package
* acme/api: refactored to support api/render
* authority/admin: refactored to support api/render
* ca: refactored to support api/render
* api: refactored to support api/render
* api/render: implemented Error
* api: refactored to support api/render.Error
* acme/api: refactored to support api/render.Error
* authority/admin: refactored to support api/render.Error
* ca: refactored to support api/render.Error
* ca: fixed broken tests
* api/render, api/log: moved error logging to this package
* acme: refactored Error so that it implements render.RenderableError
* authority/admin: refactored Error so that it implements render.RenderableError
* api/render: implemented RenderableError
* api/render: added test coverage for Error
* api/render: implemented statusCodeFromError
* api: refactored RootsPEM to work with render.Error
* acme, authority/admin: fixed pointer receiver name for consistency
* api/render, errs: moved StatusCoder & StackTracer to the render package
2 years ago
6851842841
Fix unit tests.
2 years ago
37207793f9
Pass in the resource name regardless of if its a VM or managed identity
2 years ago
7e47c70af2
Remove redundant parameter type declaration
2 years ago
7b605b2d16
Support Azure tokens from managed identities not associated with a VM
2 years ago
5ab79f53be
Fix linter errors
2 years ago
b49307f326
Fix ACME order tests with mock ACME CA
2 years ago
9e0edc7b50
Add early authority policy evaluation to ACME order API
2 years ago
613c99f00f
Fix linting issues
2 years ago
Mariano Cano
Josh Drake
Mariano Cano
Herman Slatman
Ruslan Nugmanov
max furman
Remi Vichery
Andrew Reed
Raal Goff
Shulhan
Panagiotis Siatras
vijayjt