81 Commits (7101fbb0ee939d24756695508845e78e41a1cb59)

Author	SHA1	Message	Date
Andrew Reed	7101fbb0ee	Provisioner webhooks (#1001)	2 years ago
max furman	ab0d2503ae	Standardize linting file and fix or ignore lots of linting errors	2 years ago
Raal Goff	7a03c43fe2	allow missing Email claim in OIDC tokens, use subject when its missing	2 years ago
Mariano Cano	23b8f45b37	Address gosec warnings ... Most if not all false positives	2 years ago
Mariano Cano	e7d7eb1a94	Add provisioner as a signOption for SSH	2 years ago
Herman Slatman	5e9bce508d	Unexport GetPolicy()	2 years ago
Herman Slatman	c40a4d2694	Contain policy engines inside provisioner Controller	2 years ago
Herman Slatman	9797b3350e	Merge branch 'master' into herman/allow-deny	2 years ago
Herman Slatman	571b21abbc	Fix (most) PR comments	2 years ago
Herman Slatman	dc23fd23bf	Merge branch 'master' into herman/allow-deny-next	2 years ago
Mariano Cano	b401376829	Add current provisioner to AuthorizeSign SignOptions. ... The original provisioner cannot be retrieved from a certificate if a linked ra is used.	2 years ago
Mariano Cano	259e95947c	Add support for the provisioner controller ... The claimer, audiences and custom callback methods are now managed by the provisioner controller in an uniform way.	2 years ago
Herman Slatman	7c541888ad	Refactor configuration of allow/deny on authority level	2 years ago
Herman Slatman	88c7b63c9d	Split SSH user and cert policy configuration and execution	2 years ago
Herman Slatman	512b8d6730	Refactor instantiation of policy engines ... Instead of using the `base` struct, the x509 and SSH policy engines are now added to each provisioner directly.	2 years ago
Herman Slatman	9539729bd9	Add initial implementation of x509 and SSH allow/deny policy engine	2 years ago
max furman	933b40a02a	Introduce gocritic linter and address warnings	3 years ago
Mariano Cano	a50654b468	Check for admins in both emails and groups.	3 years ago
max furman	9fdef64709	Admin level API for provisioner mgmt v1	3 years ago
max furman	638766c615	wip	3 years ago
Cristian Le	c2d30f7260	gofmt everything	3 years ago
Cristian Le	1d2445e1d8	Removed the variadic username ... Could be useful later on, but for the current PR changes should be minimized	3 years ago
Cristian Le	decf0fc8ce	Revert using preferred_username ... It might present a security issue if the users can change this value for themselves. Needs further investigation	3 years ago
Mariano Cano	08e5ec6ad1	Fix IsAdminGroup comment.	3 years ago
Mariano Cano	aafac179a5	Add test for oidc with preferred usernames.	3 years ago
Cristian Le	48666792c7	Draft: adding usernames to GetIdentityFunc	3 years ago
Cristian Le	79eec83f3e	Rename and reformat to PreferredUsername	3 years ago
Cristian Le	09a21fef26	Implement #550 ... - Read `preferred_username` from token - Add `preferred_username` to the default Usernames - Check the `admin` array for admin groups that the user might belong to	3 years ago
Mariano Cano	4c8bf87dc1	Use new admin template for K8ssa and admin-OIDC provisioners. ... This change replaces the .Insecure.CR template to one that sets all the SANs, but uses key usages and extended key usages for regular TLS certificates.	4 years ago
Mariano Cano	ba918100d0	Use go.step.sm/crypto/jose ... Replace use of github.com/smallstep/cli/crypto with the new package go.step.sm/crypto/jose.	4 years ago
Mariano Cano	e83e47a91e	Use sshutil and randutil from go.step.sm/crypto.	4 years ago
Mariano Cano	f437b86a7b	Merge branch 'cert-templates' into ssh-cert-templates	4 years ago
Mariano Cano	c8d225a763	Use x509util from go.step.sm/crypto/x509util	4 years ago
Mariano Cano	b66bdfabcd	Enforce an OIDC users to send all template variables.	4 years ago
Mariano Cano	aa657cdb4b	Use SSHOptions inside provisioner options.	4 years ago
Mariano Cano	02379d494b	Add support for extensions and critical options on the identity ... function.	4 years ago
Mariano Cano	ad28f0f59a	Move variable where it is used.	4 years ago
Mariano Cano	715eb4eacc	Add initial support for ssh templates on OIDC.	4 years ago
Mariano Cano	3e80f41c19	Change provisioner options to have X509 as a field.	4 years ago
Mariano Cano	6c64fb3ed2	Rename provisioner options structs: ... * provisioner.ProvisionerOptions => provisioner.Options * provisioner.Options => provisioner.SignOptions * provisioner.SSHOptions => provisioner.SingSSHOptions	4 years ago
Mariano Cano	02c4f9817d	Set full token payload instead of only the known properties.	4 years ago
Mariano Cano	0c8376a7f6	Fix existing unit tests.	4 years ago
Mariano Cano	71be83b25e	Add iss#sub uri in OIDC certificates. ... Admin will use the CR template if none is provided.	4 years ago
Mariano Cano	e6fed5e0aa	Minor fixes and comments.	4 years ago
Mariano Cano	206bc6757a	Add initial support for templates in the OIDC provisioner.	4 years ago
Carl Tashian	912e298043	Whitelist -> Allowlist per https://tools.ietf.org/id/draft-knodel-terminology-01.html	4 years ago
Mariano Cano	4e9bff0986	Add support for OIDC multitoken tenants for azure.	4 years ago
Mariano Cano	c49a9d5e33	Add context parameter to all SSH methods.	4 years ago
max furman	1cb8bb3ae1	Simplify statuscoder error generators.	4 years ago
max furman	dccbdf3a90	Introduce generalized statusCoder errors and loads of ssh unit tests. ... * StatusCoder api errors that have friendly user messages. * Unit tests for SSH sign/renew/rekey/revoke across all provisioners.	4 years ago