Commit Graph

463 Commits (23b8f45b37e8541de9d08aeb4e7e17fa260fcf27)

Author SHA1 Message Date
Mariano Cano 23b8f45b37 Address gosec warnings
Most if not all false positives
2 years ago
Mariano Cano 5df1694250 Add endpoint id for the RA certificate
In a linked RA mode, send an endpoint id to group the server
certificates.
2 years ago
Mariano Cano 6b5d3dca95 Add provisioner name to RA info 2 years ago
Mariano Cano a1f54921d2 Rename internal field 2 years ago
Mariano Cano 9408d0f24b Send RA provisioner information to the CA 2 years ago
Shulhan fe04f93d7f
all: reformat all go files with the next gofmt (Go 1.19)
There are some changes that manually edited, for example using '-' as
default list and grouping imports.
2 years ago
Mariano Cano 6b3a8f22f3 Add provisioner to SSH renewals
This commit allows to report the provisioner to the linkedca when
a SSH certificate is renewed.
2 years ago
Mariano Cano 3c4d0412ef
Merge pull request #941 from smallstep/ssh-provisioner
Report SSH provisioner
2 years ago
Mariano Cano a627f21440 Fix AuthorizeSSHSign tests with extra SignOption 2 years ago
Mariano Cano e7d7eb1a94 Add provisioner as a signOption for SSH 2 years ago
Herman Slatman 479eda7339
Improve error message when client renews with expired certificate
When a client provides an expired certificate and `AllowAfterExpiry`
is not enabled, the client would get a rather generic error with
instructions to view the CA logs. Viewing the CA logs can be done
when running `step-ca`, but they can't be accessed easily in the
hosted solution.

This commit returns a slightly more informational message to the
client in this specific situation.
2 years ago
Herman Slatman 5e9bce508d
Unexport GetPolicy() 2 years ago
Herman Slatman d82e51b748
Update AllowWildcardNames configuration name 2 years ago
Herman Slatman 2b7f6931f3
Change Subject Common Name verification
Subject Common Names can now also be configured to be allowed or
denied, similar to SANs. When a Subject Common Name is not explicitly
allowed or denied, its type will be determined and its value will be
validated according to the constraints for that type of name (i.e. URI).
2 years ago
Herman Slatman 6e1f8dd7ab
Refactor policy engines into container 2 years ago
Herman Slatman 2a7620641f
Fix more PR comments 2 years ago
Herman Slatman c40a4d2694
Contain policy engines inside provisioner Controller 2 years ago
Herman Slatman 72bbe53376
Add additional policy options 2 years ago
Herman Slatman 7f9034d22a
Add additional policy options 2 years ago
Herman Slatman abcad679ff
Merge branch 'master' into herman/allow-deny 2 years ago
Herman Slatman d6be9450be
Merge branch 'master' into herman/allow-deny 2 years ago
Mariano Cano d3b6bc3c75 Merge branch 'master' into fix/adminra 2 years ago
Mariano Cano 674dc3c844 Rename unreleased claim to allowRenewalAfterExpiry for consistency. 2 years ago
Herman Slatman 0bb15e16f9
Fix missing ACME provisioner option 2 years ago
Herman Slatman 9797b3350e
Merge branch 'master' into herman/allow-deny 2 years ago
Mariano Cano 8abd568f03 Merge branch 'master' into fix/adminra 2 years ago
Mariano Cano b7e11da480 Merge branch 'master' into feat/linkedra 2 years ago
Mariano Cano df8ffb35af Remove unnecessary database in provisioner config. 2 years ago
Herman Slatman d8776d8f7f
Add K8sSA SSH user policy back
According to the docs, the K8sSA provisioner can be configured
to issue SSH user certs.
2 years ago
Herman Slatman 571b21abbc
Fix (most) PR comments 2 years ago
Herman Slatman 628d7448de
Don't return policy in provisioner JSON 2 years ago
Herman Slatman 2fbdf7d5b0
Merge branch 'master' into herman/allow-deny 2 years ago
Panagiotis Siatras 00634fb648
api/render, api/log: initial implementation of the packages (#860)
* api/render: initial implementation of the package

* acme/api: refactored to support api/render

* authority/admin: refactored to support api/render

* ca: refactored to support api/render

* api: refactored to support api/render

* api/render: implemented Error

* api: refactored to support api/render.Error

* acme/api: refactored to support api/render.Error

* authority/admin: refactored to support api/render.Error

* ca: refactored to support api/render.Error

* ca: fixed broken tests

* api/render, api/log: moved error logging to this package

* acme: refactored Error so that it implements render.RenderableError

* authority/admin: refactored Error so that it implements render.RenderableError

* api/render: implemented RenderableError

* api/render: added test coverage for Error

* api/render: implemented statusCodeFromError

* api: refactored RootsPEM to work with render.Error

* acme, authority/admin: fixed pointer receiver name for consistency

* api/render, errs: moved StatusCoder & StackTracer to the render package
2 years ago
Mariano Cano 6851842841 Fix unit tests. 2 years ago
vijayjt 37207793f9 Pass in the resource name regardless of if its a VM or managed identity 2 years ago
vijayjt 7e47c70af2 Remove redundant parameter type declaration 2 years ago
vijayjt 7b605b2d16 Support Azure tokens from managed identities not associated with a VM 2 years ago
Mariano Cano 5ab79f53be Fix linter errors 2 years ago
Herman Slatman b49307f326
Fix ACME order tests with mock ACME CA 2 years ago
Herman Slatman 9e0edc7b50
Add early authority policy evaluation to ACME order API 2 years ago
Herman Slatman 613c99f00f
Fix linting issues 2 years ago
Herman Slatman dc23fd23bf
Merge branch 'master' into herman/allow-deny-next 2 years ago
Mariano Cano 082734474b
Merge pull request #845 from vijayjt/azure-user-mi-token
WIP: Support Azure tokens generated by managed identities
2 years ago
Mariano Cano b401376829 Add current provisioner to AuthorizeSign SignOptions.
The original provisioner cannot be retrieved from a certificate
if a linked ra is used.
2 years ago
vijayjt 24a963766e Pass in the resource name regardless of if its a VM or managed identity 2 years ago
Mariano Cano ad8a813abe Fix linter errors 2 years ago
Mariano Cano 6d532045dc Fix validity check for sshpop provisioner. 2 years ago
Mariano Cano c903f00cd4 Rename claim to allowRenewAfterExpiry. 2 years ago
Mariano Cano 4690fa64ed Add public methods to retrieve the provisioner extensions. 2 years ago
Mariano Cano 616490a9c6 Refactor renew after expiry token authorization
This changes adds a new authority method that authorizes the
renew after expiry tokens.
2 years ago