Herman Slatman
9d3b78ae49
Add `excludeIntermediate` to SCEP provisioner
1 year ago
Remi Vichery
82b8e16d7f
Add all AWS identity document certificates
...
* move to use embed instead of a multi-line string
* add test to ensure all certificates are valid
* add test to ensure validity (no expired certificate)
1 year ago
Herman Slatman
645b6ffc18
Ensure no prompt is fired for loading provisioner decrypter
1 year ago
Herman Slatman
e2e9bf5494
Clarify some SCEP properties
1 year ago
Herman Slatman
c0a1837cd9
Verify full decrypter/signer configuration at usage time
...
When changing the SCEP configuration it is possible that one
or both of the decrypter configurations required are not available
or have been provided in a way that's not usable for actual SCEP
requests.
Instead of failing hard when provisioners are loaded,
which could result in the CA not starting properly, this type of
problematic configuration errors will now be handled at usage
time instead.
1 year ago
Herman Slatman
569a1be12c
Merge branch 'master' into herman/scep-provisioner-decrypter
1 year ago
Mariano Cano
cce7d9e839
Address comments from code review
1 year ago
Mariano Cano
c7c7decd5e
Add support for the disableSmallstepExtensions claim
...
This commit adds a new claim to exclude the Smallstep provisioner
extension from the generated certificates.
Fixes #620
1 year ago
Herman Slatman
1ce80cf740
Merge branch 'master' into herman/scep-provisioner-decrypter
1 year ago
Herman Slatman
567fc25404
Use the RSA decryption configuration for signing responses too
1 year ago
Mariano Cano
7061147885
Use step.Abs to load the certificate templates
...
step.Abs has been removed from crypto and they need to be set when those
methods are used
1 year ago
Mariano Cano
95887ebf40
Merge pull request #1481 from smallstep/remove-user-regex
...
Remove OIDC user regexp check
1 year ago
Josh Drake
ff424fa944
Fix tests.
1 year ago
Josh Drake
904f416d20
Include authorization principal in provisioner webhooks.
1 year ago
Mariano Cano
5bfe96d8c7
Send X5C leaf certificate to webhooks
...
This commit adds a new property that will be sent to authorizing and
enriching webhooks when signing certificates using the X5C provisioner.
1 year ago
Mariano Cano
7fa97bedec
Remove OIDC user regexp check
...
This commit removes the regular expression check on OIDC usernames.
Although it is not recommended to use any character in a username,
it is possible to create and use them. The tool useradd has the flag
--badname and adduser has --allow-badname and --allow-all-names to
create new users with any character.
Moreover, it is possible to create any username with the rest of
provisioners.
Fixes #1436
1 year ago
Herman Slatman
6985b4be62
Clean up the SCEP authority and provisioner
1 year ago
Herman Slatman
a1f187e3df
Merge branch 'master' into herman/scep-provisioner-decrypter
1 year ago
Herman Slatman
180162bd6a
Refactor SCEP provisioner and decrypter
1 year ago
Herman Slatman
0377fe559b
Add basic version of provisioner specific SCEP decrypter
1 year ago
Mariano Cano
71fcdf8a0a
Fix linter errors from #1404
1 year ago
Ruslan Nugmanov
1031324273
add AWS public certificates for me-central-1 and ap-southeast-3
...
As per https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-signature.html
1 year ago
max furman
8b256f0351
address linter warning for go 1.19
1 year ago
Herman Slatman
0153ff4377
Remove superfluous `GetChallengePassword`
1 year ago
Herman Slatman
f9ec62f46c
Merge branch 'master' into herman/improve-scep-marshaling
1 year ago
Herman Slatman
c73f157ea4
Remove unused error from challenge validation controller creator
1 year ago
Herman Slatman
e8c1e8719d
Refactor SCEP webhook validation
1 year ago
Herman Slatman
419478d1e5
Make SCEP webhook validation look better
1 year ago
Herman Slatman
dfc56f21b8
Merge branch 'master' into herman/acme-da-tpm
2 years ago
Mariano Cano
ac35f3489c
Remove unused certificate validators and modifiers
...
With the introduction of certificate templates some certificate
validators and modifiers are not used anymore. This commit deletes the
ones that are not used.
2 years ago
Remi Vichery
09cbe8ba65
fixup! Add identity token for all Azure cloud environments
2 years ago
Herman Slatman
6297bace1a
Merge branch 'master' into herman/acme-da-tpm
2 years ago
Remi Vichery
b2c2eec76b
Add identity token for all Azure cloud environments
...
* Azure Public Cloud (default)
* Azure China Cloud
* Azure US Gov Cloud
* Azure German Cloud
2 years ago
Herman Slatman
59462e826c
Improve testing errors for OIDC `authorizeToken` function
2 years ago
Herman Slatman
10958a124b
Add email address to error message returned for OIDC validation
2 years ago
Herman Slatman
f1724ea8c5
Merge branch 'master' into herman/acme-da-tpm
2 years ago
Mariano Cano
5d87201abc
Ignore principals validations with OIDC
...
This commit will ignore principals validation when an OIDC provisioner
is used. When the principals in the server does not match the principals
given the validation was failing, even if the proper principals were set
by templates or webhooks. With this change OIDC will not validate the
principals and just set the default ones (name, name@example.org ) plus
the ones in the templates.
This commit also includes a change in the templates to allow to pass
a provisioner to the $(step path)/ssh/config template
Related to #807
2 years ago
Herman Slatman
c365d8580e
Move provisioner marshaling logic to api package
2 years ago
Herman Slatman
f2e1c56c6c
Improve SCEP provisioner marshaling
2 years ago
Herman Slatman
85cd9a1277
Fix some ACME DA doc strings (slightly)
2 years ago
Herman Slatman
b9f238ad4d
Add additional ACME `meta` properties to provisioner configuration
2 years ago
Herman Slatman
cbc0864370
Remove TODO and clarify ACME revoke authorization method docs
2 years ago
max furman
7203739369
Fix err assert linter warnings - upgrade outdated package
2 years ago
Andrew Reed
2c5e41b093
Fix webhook controller ignoring cert type
2 years ago
Andrew Reed
7101fbb0ee
Provisioner webhooks ( #1001 )
2 years ago
max furman
4c7a2ce3eb
Fix errors.As linter warnings
2 years ago
max furman
2d4efc8292
Fix linter warnings
2 years ago
max furman
75bb196193
Add concurrency workflow config | fix broken test due to golang ver
2 years ago
max furman
7c5e5b2b87
Even more linter fixes
2 years ago
max furman
f3d1863ec6
A few more linter errors
2 years ago
max furman
1e0ea6f958
more linting fixes
2 years ago
max furman
33458c88aa
Standardize linting file and fix or ignore lots of linting errors
2 years ago
Mariano Cano
f0a24bd8ca
Add acme property to enable challenges
...
Fixes #1027
2 years ago
Max
2de7d3fcf0
Update authority/provisioner/claims.go
...
Co-authored-by: Mariano Cano <mariano@smallstep.com>
2 years ago
max furman
ab0d2503ae
Standardize linting file and fix or ignore lots of linting errors
2 years ago
Mariano Cano
34c6c65671
Pass attestation information to the Sign method
...
Attestation information might be useful in authorizing webhooks
2 years ago
Mariano Cano
42102d88d5
Fix merge and add unit tests
2 years ago
Mariano Cano
ee7307bd41
Cherry-pick acme.go from acdfdf3
2 years ago
Mariano Cano
1e098aef5b
Fixes ACMEAttestationFormat comment
2 years ago
Mariano Cano
ba42aaf865
Add attestationFormat property in the ACME provisioner
2 years ago
Mariano Cano
b2119e9f2c
Merge pull request #977 from smallstep/device-attestation
...
Device attestation
2 years ago
Mariano Cano
fd4e96d1f4
Rename method to IsChallengeEnabled
2 years ago
Mariano Cano
c77b4ff9c5
Fix linter errors
2 years ago
Mariano Cano
59c5219a07
Use a type for acme challenges
2 years ago
Raal Goff
b89f210469
remove fail-email test and add ok-empty-email test
2 years ago
Raal Goff
7a03c43fe2
allow missing Email claim in OIDC tokens, use subject when its missing
2 years ago
Mariano Cano
df96b126dc
Add AuthorizeChallenge unit tests
2 years ago
Mariano Cano
bca311b05e
Add acme property to enable challenges
...
Fixes #1027
2 years ago
Mariano Cano
693dc39481
Merge branch 'master' into device-attestation
2 years ago
Mariano Cano
23b8f45b37
Address gosec warnings
...
Most if not all false positives
2 years ago
Mariano Cano
5df1694250
Add endpoint id for the RA certificate
...
In a linked RA mode, send an endpoint id to group the server
certificates.
2 years ago
Mariano Cano
21427d5d65
Replace instead of prepend provisioner extension
...
With non standard SANs this will generate the SAN and provisioner
extension in the same order.
2 years ago
Mariano Cano
6b5d3dca95
Add provisioner name to RA info
2 years ago
Mariano Cano
a1f54921d2
Rename internal field
2 years ago
Mariano Cano
9408d0f24b
Send RA provisioner information to the CA
2 years ago
Shulhan
fe04f93d7f
all: reformat all go files with the next gofmt (Go 1.19)
...
There are some changes that manually edited, for example using '-' as
default list and grouping imports.
2 years ago
Mariano Cano
6b3a8f22f3
Add provisioner to SSH renewals
...
This commit allows to report the provisioner to the linkedca when
a SSH certificate is renewed.
2 years ago
Mariano Cano
3c4d0412ef
Merge pull request #941 from smallstep/ssh-provisioner
...
Report SSH provisioner
2 years ago
Mariano Cano
a627f21440
Fix AuthorizeSSHSign tests with extra SignOption
2 years ago
Mariano Cano
e7d7eb1a94
Add provisioner as a signOption for SSH
2 years ago
Herman Slatman
479eda7339
Improve error message when client renews with expired certificate
...
When a client provides an expired certificate and `AllowAfterExpiry`
is not enabled, the client would get a rather generic error with
instructions to view the CA logs. Viewing the CA logs can be done
when running `step-ca`, but they can't be accessed easily in the
hosted solution.
This commit returns a slightly more informational message to the
client in this specific situation.
2 years ago
Herman Slatman
5e9bce508d
Unexport GetPolicy()
2 years ago
Herman Slatman
d82e51b748
Update AllowWildcardNames configuration name
3 years ago
Herman Slatman
2b7f6931f3
Change Subject Common Name verification
...
Subject Common Names can now also be configured to be allowed or
denied, similar to SANs. When a Subject Common Name is not explicitly
allowed or denied, its type will be determined and its value will be
validated according to the constraints for that type of name (i.e. URI).
3 years ago
Herman Slatman
6e1f8dd7ab
Refactor policy engines into container
3 years ago
Herman Slatman
2a7620641f
Fix more PR comments
3 years ago
Herman Slatman
c40a4d2694
Contain policy engines inside provisioner Controller
3 years ago
Herman Slatman
72bbe53376
Add additional policy options
3 years ago
Herman Slatman
7f9034d22a
Add additional policy options
3 years ago
Herman Slatman
abcad679ff
Merge branch 'master' into herman/allow-deny
3 years ago
Herman Slatman
d6be9450be
Merge branch 'master' into herman/allow-deny
3 years ago
Mariano Cano
d3b6bc3c75
Merge branch 'master' into fix/adminra
3 years ago
Mariano Cano
674dc3c844
Rename unreleased claim to allowRenewalAfterExpiry for consistency.
3 years ago
Herman Slatman
0bb15e16f9
Fix missing ACME provisioner option
3 years ago
Herman Slatman
9797b3350e
Merge branch 'master' into herman/allow-deny
3 years ago
Mariano Cano
8abd568f03
Merge branch 'master' into fix/adminra
3 years ago
Mariano Cano
b7e11da480
Merge branch 'master' into feat/linkedra
3 years ago
Mariano Cano
df8ffb35af
Remove unnecessary database in provisioner config.
3 years ago
Herman Slatman
d8776d8f7f
Add K8sSA SSH user policy back
...
According to the docs, the K8sSA provisioner can be configured
to issue SSH user certs.
3 years ago
Herman Slatman
571b21abbc
Fix (most) PR comments
3 years ago