59 Commits (ab0d2503aeeec4468baf4dd0fdae3028c73a50c6)

Author	SHA1	Message	Date
max furman	ab0d2503ae	Standardize linting file and fix or ignore lots of linting errors	2 years ago
Mariano Cano	34c6c65671	Pass attestation information to the Sign method ... Attestation information might be useful in authorizing webhooks	2 years ago
Mariano Cano	21427d5d65	Replace instead of prepend provisioner extension ... With non standard SANs this will generate the SAN and provisioner extension in the same order.	2 years ago
Herman Slatman	6e1f8dd7ab	Refactor policy engines into container	2 years ago
Herman Slatman	571b21abbc	Fix (most) PR comments	2 years ago
Herman Slatman	613c99f00f	Fix linting issues	2 years ago
Herman Slatman	dc23fd23bf	Merge branch 'master' into herman/allow-deny-next	2 years ago
Mariano Cano	4690fa64ed	Add public methods to retrieve the provisioner extensions.	2 years ago
Herman Slatman	7c541888ad	Refactor configuration of allow/deny on authority level	2 years ago
Herman Slatman	88c7b63c9d	Split SSH user and cert policy configuration and execution	2 years ago
Herman Slatman	066bf32086	Fix part of PR comments	2 years ago
Herman Slatman	6440870a80	Clean up, improve test cases and coverage	2 years ago
Herman Slatman	1e808b61e5	Merge logic for X509 and SSH policy	2 years ago
Herman Slatman	9539729bd9	Add initial implementation of x509 and SSH allow/deny policy engine	2 years ago
Mariano Cano	c3f98fd04d	Change some bad requests to forbidded. ... Change in the sign options bad requests to forbidded if is the provisioner the one adding a restriction, e.g. list of dns names, validity, ...	3 years ago
Mariano Cano	507a272b4d	Return always http errors in sign options.	3 years ago
Mariano Cano	b6ebd118fc	Update temporal solution for sending message to users	3 years ago
Mariano Cano	acd0bac025	Remove extra and in comment.	3 years ago
Mariano Cano	1aadd63cef	Use always badRequest on duration errors.	3 years ago
Mariano Cano	41fec1577d	Report duration errors directly to the cli.	3 years ago
Herman Slatman	d0a9cbc797	Change fmt to errors package for formatting errors	3 years ago
Herman Slatman	ff1b46c95d	Add configuration option for specifying the minimum public key length ... Instead of using the defaultPublicKeyValidator a new validator called publicKeyMinimumLengthValidator has been implemented that uses a configurable minimum length for public keys in CSRs. It's also an option to alter the defaultPublicKeyValidator to also take a parameter, but that would touch quite some lines of code. This might be a viable option after merging SCEP support.	3 years ago
max furman	16665c97f0	Allow empty SAN in CSR for validation ... ... - The default template will always use the SANs from the token. - If there are any SANs they must be validated against the token.	3 years ago
max furman	46fc922afd	Remove unused code; fix usage wrong word; add gap time for unit test	4 years ago
Mariano Cano	c8d225a763	Use x509util from go.step.sm/crypto/x509util	4 years ago
Mariano Cano	6c64fb3ed2	Rename provisioner options structs: ... * provisioner.ProvisionerOptions => provisioner.Options * provisioner.Options => provisioner.SignOptions * provisioner.SSHOptions => provisioner.SingSSHOptions	4 years ago
Mariano Cano	0c8376a7f6	Fix existing unit tests.	4 years ago
Mariano Cano	4795e371bd	Add back the support for ca.json DN template.	4 years ago
Mariano Cano	95c3a41bf0	Rename UserData to TemplateData and fix unmarshaling.	4 years ago
Mariano Cano	9032018cf2	Convert x509util.WithOptions to new modifiers.	4 years ago
max furman	accf1be7e9	wip	4 years ago
max furman	71d87b4e61	wip	4 years ago
max furman	d25e7f64c2	wip	4 years ago
max furman	3636ba3228	wip	4 years ago
max furman	1951669e13	wip	4 years ago
max furman	7d5cf34ce5	Update profileLimitDuration validator ... ... - respect notBefore of the provisioner - modify/fix the reported errors	4 years ago
Oleksandr Kovalchuk	322200b7db	Implement modifier to set CommonName ... Implement modifier which sets CommonName to the certificate if CommonName is empty and forceCN is set in the config. Replace previous implementation introduced in 0218018cee with new modifier. Closes https://github.com/smallstep/certificates/issues/259 Ref: https://github.com/smallstep/certificates/pull/260#issuecomment-628961322	4 years ago
Mariano Cano	13507efb35	Remove the requirement for CSR to have a common name. ... Fixes #226	4 years ago
Mariano Cano	bfe1f4952d	Rename interface to CertificateEnforcer and add tests.	4 years ago
Mariano Cano	64f26c0f40	Enforce a duration for identity certificates.	4 years ago
max furman	397a181d10	Add backdate validation to sshCertValidityValidator.	4 years ago
max furman	dccbdf3a90	Introduce generalized statusCoder errors and loads of ssh unit tests. ... * StatusCoder api errors that have friendly user messages. * Unit tests for SSH sign/renew/rekey/revoke across all provisioners.	4 years ago
Mariano Cano	93b65bee7c	Add unit test for profileDefaultDuration.	4 years ago
Mariano Cano	84ff172093	Add support for backdate to SSH certificates.	4 years ago
Mariano Cano	5565d61bf3	Add fault tolerance against clock skew accross system on TLS certificates.	4 years ago
max furman	d368791606	Add x5c provisioner capabilities	5 years ago
max furman	2b41faa9cf	Enforce >= 2048 bit rsa keys at the provisioner layer ... * Fixes #94 * In the future this should be configurable by provisioner	5 years ago
max furman	635c59ed24	Accept emails SANs	5 years ago
Mariano Cano	900ab9cc12	Allow custom common names in cloud identity provisioners.	5 years ago
Mariano Cano	00fed1c538	Add initial version of time duration support in sign requests.	5 years ago