c7c7decd5e
Add support for the disableSmallstepExtensions claim
...
This commit adds a new claim to exclude the Smallstep provisioner
extension from the generated certificates.
Fixes #620
10 months ago
8b256f0351
address linter warning for go 1.19
1 year ago
10958a124b
Add email address to error message returned for OIDC validation
1 year ago
5d87201abc
Ignore principals validations with OIDC
...
This commit will ignore principals validation when an OIDC provisioner
is used. When the principals in the server does not match the principals
given the validation was failing, even if the proper principals were set
by templates or webhooks. With this change OIDC will not validate the
principals and just set the default ones (name, name@example.org ) plus
the ones in the templates.
This commit also includes a change in the templates to allow to pass
a provisioner to the $(step path)/ssh/config template
Related to #807
1 year ago
7101fbb0ee
Provisioner webhooks ( #1001 )
2 years ago
ab0d2503ae
Standardize linting file and fix or ignore lots of linting errors
2 years ago
7a03c43fe2
allow missing Email claim in OIDC tokens, use subject when its missing
2 years ago
23b8f45b37
Address gosec warnings
...
Most if not all false positives
2 years ago
e7d7eb1a94
Add provisioner as a signOption for SSH
2 years ago
5e9bce508d
Unexport GetPolicy()
2 years ago
c40a4d2694
Contain policy engines inside provisioner Controller
2 years ago
9797b3350e
Merge branch 'master' into herman/allow-deny
2 years ago
571b21abbc
Fix (most) PR comments
2 years ago
dc23fd23bf
Merge branch 'master' into herman/allow-deny-next
2 years ago
b401376829
Add current provisioner to AuthorizeSign SignOptions.
...
The original provisioner cannot be retrieved from a certificate
if a linked ra is used.
2 years ago
259e95947c
Add support for the provisioner controller
...
The claimer, audiences and custom callback methods are now managed
by the provisioner controller in an uniform way.
2 years ago
7c541888ad
Refactor configuration of allow/deny on authority level
2 years ago
88c7b63c9d
Split SSH user and cert policy configuration and execution
2 years ago
512b8d6730
Refactor instantiation of policy engines
...
Instead of using the `base` struct, the x509 and SSH policy
engines are now added to each provisioner directly.
2 years ago
9539729bd9
Add initial implementation of x509 and SSH allow/deny policy engine
2 years ago
933b40a02a
Introduce gocritic linter and address warnings
3 years ago
a50654b468
Check for admins in both emails and groups.
3 years ago
9fdef64709
Admin level API for provisioner mgmt v1
3 years ago
638766c615
wip
3 years ago
c2d30f7260
gofmt everything
3 years ago
1d2445e1d8
Removed the variadic username
...
Could be useful later on, but for the current PR changes should be minimized
3 years ago
decf0fc8ce
Revert using preferred_username
...
It might present a security issue if the users can change this value for themselves. Needs further investigation
3 years ago
08e5ec6ad1
Fix IsAdminGroup comment.
3 years ago
aafac179a5
Add test for oidc with preferred usernames.
3 years ago
48666792c7
Draft: adding usernames to GetIdentityFunc
3 years ago
79eec83f3e
Rename and reformat to PreferredUsername
3 years ago
09a21fef26
Implement #550
...
- Read `preferred_username` from token
- Add `preferred_username` to the default Usernames
- Check the `admin` array for admin groups that the user might belong to
3 years ago
4c8bf87dc1
Use new admin template for K8ssa and admin-OIDC provisioners.
...
This change replaces the .Insecure.CR template to one that sets
all the SANs, but uses key usages and extended key usages for
regular TLS certificates.
4 years ago
ba918100d0
Use go.step.sm/crypto/jose
...
Replace use of github.com/smallstep/cli/crypto with the new package
go.step.sm/crypto/jose.
4 years ago
e83e47a91e
Use sshutil and randutil from go.step.sm/crypto.
4 years ago
f437b86a7b
Merge branch 'cert-templates' into ssh-cert-templates
4 years ago
c8d225a763
Use x509util from go.step.sm/crypto/x509util
4 years ago
b66bdfabcd
Enforce an OIDC users to send all template variables.
4 years ago
aa657cdb4b
Use SSHOptions inside provisioner options.
4 years ago
02379d494b
Add support for extensions and critical options on the identity
...
function.
4 years ago
ad28f0f59a
Move variable where it is used.
4 years ago
715eb4eacc
Add initial support for ssh templates on OIDC.
4 years ago
3e80f41c19
Change provisioner options to have X509 as a field.
4 years ago
6c64fb3ed2
Rename provisioner options structs:
...
* provisioner.ProvisionerOptions => provisioner.Options
* provisioner.Options => provisioner.SignOptions
* provisioner.SSHOptions => provisioner.SingSSHOptions
4 years ago
02c4f9817d
Set full token payload instead of only the known properties.
4 years ago
0c8376a7f6
Fix existing unit tests.
4 years ago
71be83b25e
Add iss#sub uri in OIDC certificates.
...
Admin will use the CR template if none is provided.
4 years ago
e6fed5e0aa
Minor fixes and comments.
4 years ago
206bc6757a
Add initial support for templates in the OIDC provisioner.
4 years ago
912e298043
Whitelist -> Allowlist per https://tools.ietf.org/id/draft-knodel-terminology-01.html
4 years ago
Mariano Cano
max furman
Herman Slatman
Andrew Reed
Raal Goff
Cristian Le
Mariano Cano
Carl Tashian