27 Commits (7101fbb0ee939d24756695508845e78e41a1cb59)

Author	SHA1	Message	Date
Andrew Reed	7101fbb0ee	Provisioner webhooks (#1001)	2 years ago
Mariano Cano	e7d7eb1a94	Add provisioner as a signOption for SSH	2 years ago
Herman Slatman	5e9bce508d	Unexport GetPolicy()	2 years ago
Herman Slatman	c40a4d2694	Contain policy engines inside provisioner Controller	2 years ago
Herman Slatman	9797b3350e	Merge branch 'master' into herman/allow-deny	2 years ago
Herman Slatman	571b21abbc	Fix (most) PR comments	2 years ago
Herman Slatman	dc23fd23bf	Merge branch 'master' into herman/allow-deny-next	2 years ago
Mariano Cano	b401376829	Add current provisioner to AuthorizeSign SignOptions. ... The original provisioner cannot be retrieved from a certificate if a linked ra is used.	2 years ago
Mariano Cano	8ef8f4f665	Use the provisioner controller in Nebula renewals	2 years ago
Mariano Cano	259e95947c	Add support for the provisioner controller ... The claimer, audiences and custom callback methods are now managed by the provisioner controller in an uniform way.	2 years ago
Herman Slatman	7c541888ad	Refactor configuration of allow/deny on authority level	2 years ago
Herman Slatman	c3c6f3da72	Merge branch 'master' into herman/allow-deny	2 years ago
Mariano Cano	abe951d416	Fix name of the variable in comment.	2 years ago
Mariano Cano	a0cf808393	Make the X5C leaf certificate available to the templates. ... X509 and SSH templates of the X5C provisioner will have now access to the leaf certificate used to sign the token using the template variable .AuthorizationCrt Fixes #433	2 years ago
Herman Slatman	88c7b63c9d	Split SSH user and cert policy configuration and execution	2 years ago
Herman Slatman	9617edf0c2	Improve internationalized domain name handling ... This PR improves internationalized domain name handling according to rules of IDNA and based on the description in RFC 5280, section 7: https://datatracker.ietf.org/doc/html/rfc5280#section-7. Support for internationalized URI(s), so-called IRIs, still needs to be done.	2 years ago
Herman Slatman	512b8d6730	Refactor instantiation of policy engines ... Instead of using the `base` struct, the x509 and SSH policy engines are now added to each provisioner directly.	2 years ago
Herman Slatman	91d51c2b88	Add allow/deny to Nebula provisioner	2 years ago
Mariano Cano	0920224816	Fix error message.	2 years ago
Mariano Cano	449a9fdfd6	Address review comments.	2 years ago
Mariano Cano	b424aa3dc1	Add nebula header and use der version of certificate.	2 years ago
Mariano Cano	f49a4b326f	Add missing comments.	2 years ago
Mariano Cano	6600f1253e	Fix error messages after review.	2 years ago
Mariano Cano	76794ce613	Use default SANs without sans in the token. ... Fix step claim condition in SSH	2 years ago
Mariano Cano	9ec0276887	Update certificate set with new api.	2 years ago
Mariano Cano	cb72796a2d	Fix decoding of certificate.	2 years ago
Mariano Cano	32390a2964	Add initial implementation of a nebula provisioner. ... A nebula provisioner will generate a X509 or SSH certificate with the identities in the nebula certificate embedded in the token. The token is signed with the private key of the nebula certificate.	2 years ago