max furman
9fdef64709
Admin level API for provisioner mgmt v1
2021-07-02 19:05:17 -07:00
max furman
638766c615
wip
2021-05-19 18:23:20 -07:00
Cristian Le
c2d30f7260
gofmt everything
2021-05-05 10:29:47 +09:00
Cristian Le
1d2445e1d8
Removed the variadic username
...
Could be useful later on, but for the current PR changes should be minimized
2021-05-05 10:12:38 +09:00
Cristian Le
decf0fc8ce
Revert using preferred_username
...
It might present a security issue if the users can change this value for themselves. Needs further investigation
2021-05-05 08:15:26 +09:00
Mariano Cano
08e5ec6ad1
Fix IsAdminGroup comment.
2021-05-05 08:15:26 +09:00
Mariano Cano
aafac179a5
Add test for oidc with preferred usernames.
2021-05-05 08:15:26 +09:00
Cristian Le
48666792c7
Draft: adding usernames to GetIdentityFunc
2021-05-05 08:15:26 +09:00
Cristian Le
79eec83f3e
Rename and reformat to PreferredUsername
2021-05-05 08:15:26 +09:00
Cristian Le
09a21fef26
Implement #550
...
- Read `preferred_username` from token
- Add `preferred_username` to the default Usernames
- Check the `admin` array for admin groups that the user might belong to
2021-05-05 08:15:26 +09:00
Mariano Cano
4c8bf87dc1
Use new admin template for K8ssa and admin-OIDC provisioners.
...
This change replaces the .Insecure.CR template to one that sets
all the SANs, but uses key usages and extended key usages for
regular TLS certificates.
2020-09-21 12:49:16 -07:00
Mariano Cano
ba918100d0
Use go.step.sm/crypto/jose
...
Replace use of github.com/smallstep/cli/crypto with the new package
go.step.sm/crypto/jose.
2020-08-24 14:44:11 -07:00
Mariano Cano
e83e47a91e
Use sshutil and randutil from go.step.sm/crypto.
2020-08-10 11:26:51 -07:00
Mariano Cano
f437b86a7b
Merge branch 'cert-templates' into ssh-cert-templates
2020-08-05 18:43:07 -07:00
Mariano Cano
c8d225a763
Use x509util from go.step.sm/crypto/x509util
2020-08-05 16:02:46 -07:00
Mariano Cano
b66bdfabcd
Enforce an OIDC users to send all template variables.
2020-08-03 15:28:48 -07:00
Mariano Cano
aa657cdb4b
Use SSHOptions inside provisioner options.
2020-07-30 18:44:52 -07:00
Mariano Cano
02379d494b
Add support for extensions and critical options on the identity
...
function.
2020-07-30 17:45:03 -07:00
Mariano Cano
ad28f0f59a
Move variable where it is used.
2020-07-30 17:45:03 -07:00
Mariano Cano
715eb4eacc
Add initial support for ssh templates on OIDC.
2020-07-30 17:45:03 -07:00
Mariano Cano
3e80f41c19
Change provisioner options to have X509 as a field.
2020-07-30 17:44:22 -07:00
Mariano Cano
6c64fb3ed2
Rename provisioner options structs:
...
* provisioner.ProvisionerOptions => provisioner.Options
* provisioner.Options => provisioner.SignOptions
* provisioner.SSHOptions => provisioner.SingSSHOptions
2020-07-22 18:24:45 -07:00
Mariano Cano
02c4f9817d
Set full token payload instead of only the known properties.
2020-07-21 14:21:54 -07:00
Mariano Cano
0c8376a7f6
Fix existing unit tests.
2020-07-21 14:21:54 -07:00
Mariano Cano
71be83b25e
Add iss#sub uri in OIDC certificates.
...
Admin will use the CR template if none is provided.
2020-07-21 14:18:06 -07:00
Mariano Cano
e6fed5e0aa
Minor fixes and comments.
2020-07-21 14:18:05 -07:00
Mariano Cano
206bc6757a
Add initial support for templates in the OIDC provisioner.
2020-07-21 14:18:05 -07:00
Carl Tashian
912e298043
Whitelist -> Allowlist per https://tools.ietf.org/id/draft-knodel-terminology-01.html
2020-07-20 15:42:47 -07:00
Mariano Cano
4e9bff0986
Add support for OIDC multitoken tenants for azure.
2020-04-24 14:36:32 -07:00
Mariano Cano
c49a9d5e33
Add context parameter to all SSH methods.
2020-03-10 19:01:45 -07:00
max furman
1cb8bb3ae1
Simplify statuscoder error generators.
2020-01-28 13:29:40 -08:00
max furman
dccbdf3a90
Introduce generalized statusCoder errors and loads of ssh unit tests.
...
* StatusCoder api errors that have friendly user messages.
* Unit tests for SSH sign/renew/rekey/revoke across all provisioners.
2020-01-28 13:29:40 -08:00
Mariano Cano
84ff172093
Add support for backdate to SSH certificates.
2020-01-28 13:29:39 -08:00
max furman
414a94b210
Instrument getIdentity func for OIDC ssh provisioner
2020-01-28 13:28:16 -08:00
max furman
54e3cf7322
Add multiuse capability to k8ssa provisioners
2020-01-28 13:28:16 -08:00
max furman
29853ae016
sshpop provisioner + ssh renew | revoke | rekey first pass
2020-01-28 13:28:16 -08:00
max furman
d368791606
Add x5c provisioner capabilities
2019-10-14 14:51:37 -07:00
Mariano Cano
6c4abfabbb
Make /.well-known/openid-configuration optional
2019-09-18 15:54:10 -07:00
Mariano Cano
3527ee6940
Add support for listenAddress parameter if OIDC provisioners.
...
Fixes smallstep/cli#150
2019-09-18 15:25:28 -07:00
Mariano Cano
396b4222aa
Implement validator for ssh keys.
...
Fixes #100
2019-09-10 17:04:13 -07:00
Mariano Cano
10e7b81b9f
Merge branch 'master' into ssh-ca
2019-09-05 23:06:01 +02:00
max furman
2b41faa9cf
Enforce >= 2048 bit rsa keys at the provisioner layer
...
* Fixes #94
* In the future this should be configurable by provisioner
2019-08-27 14:44:59 -07:00
Mariano Cano
57a529cc1a
Allow to enable the SSH CA per provisioner
2019-08-05 11:40:27 -07:00
Mariano Cano
a8f4ad1b8e
Set default SSH options if no user options are given.
2019-07-31 17:03:33 -07:00
Mariano Cano
41b97372e6
Rename function to SanitizeSSHUserPrincipal
2019-07-29 16:38:57 -07:00
Mariano Cano
53f62f871c
Set not extensions to host certificates.
2019-07-29 16:36:46 -07:00
Mariano Cano
48c98dea2a
Make SanitizeSSHPrincipal a public function.
2019-07-29 16:21:22 -07:00
Mariano Cano
f01286bb48
Add support for SSH certificates to OIDC.
...
Update the interface for all the provisioners.
2019-07-29 15:54:07 -07:00
Matteo Saloni
1919cfdff3
Add option for checking group membership declared in JWT token
2019-06-25 10:50:55 +02:00
max furman
ab4d569f36
Add /revoke API with interface db backend
2019-04-10 13:50:35 -07:00