Herman Slatman
|
ca8855767d
|
Fix and add more tests to Wire order identifier validation
|
2024-01-11 11:47:06 +01:00 |
|
Herman Slatman
|
70a2f431fa
|
Address review remarks
|
2024-01-11 11:06:39 +01:00 |
|
Herman Slatman
|
f1c54d6852
|
Merge pull request #1665 from smallstep/herman/fix-error-msg-csr-validation
Change error message for CSR validation
|
2024-01-11 09:51:02 +01:00 |
|
Herman Slatman
|
de25740567
|
Change name of test for Wire Order
|
2024-01-10 21:16:04 +01:00 |
|
Herman Slatman
|
c7892e9cd3
|
Remove the rusty-jwt-cli configuration
|
2024-01-10 20:51:19 +01:00 |
|
Herman Slatman
|
a423151207
|
Merge branch 'wire-acme-extensions' into herman/remove-rusty-cli
|
2024-01-10 20:48:55 +01:00 |
|
Herman Slatman
|
ffd887f8cc
|
Fix tests for ACME Wire provisioner
|
2024-01-10 20:23:01 +01:00 |
|
Herman Slatman
|
8997ce1a1e
|
Disable wire-dpop-01 and wire-oidc-01 by default
|
2024-01-10 20:06:02 +01:00 |
|
Herman Slatman
|
bf8c17e3ec
|
Remove the Wire oidc and dpop from attestation formats
|
2024-01-10 19:12:22 +01:00 |
|
Herman Slatman
|
033aef9f9d
|
Merge branch 'wire-acme-extensions' into herman/remove-rusty-cli
|
2024-01-10 18:57:51 +01:00 |
|
Herman Slatman
|
6a98fea1f3
|
Fix linter issues
|
2024-01-10 18:36:24 +01:00 |
|
Herman Slatman
|
8faf26c593
|
Change KeyAuth back to old behavior (for now)
|
2024-01-10 18:32:18 +01:00 |
|
beltram
|
bf5f1201ea
|
fix: keyauth was not bound to the id token
|
2024-01-10 17:15:54 +01:00 |
|
Herman Slatman
|
e2a2e00526
|
Make template use DeviceId for now
|
2024-01-10 17:15:03 +01:00 |
|
Herman Slatman
|
29fa6621b1
|
Remove the Wire CLI invocatation
|
2024-01-10 15:12:28 +01:00 |
|
Herman Slatman
|
7a464cdb17
|
Use require to check for errors in Wire integration test
|
2024-01-09 21:52:00 +01:00 |
|
Herman Slatman
|
776a839a42
|
Fix linter issues and improve error handling
|
2024-01-09 21:31:19 +01:00 |
|
Herman Slatman
|
f5a2f436df
|
Fix missing DPoP and OIDC tokens for Wire integration test
|
2024-01-09 18:24:37 +01:00 |
|
Herman Slatman
|
eb9893bd21
|
Refactor logic for processing WireID identifiers in Order
Processing `WireID` identifiers, the Wire subject, and the Wire
DPoP and OIDC tokens is now conditional.
|
2024-01-09 18:22:21 +01:00 |
|
Herman Slatman
|
40668ae09e
|
Refactor WireID target processing a bit
|
2024-01-09 16:52:09 +01:00 |
|
Herman Slatman
|
01169b2483
|
Make the Target optional in Challenge object
This is a non-standard property in the ACME challenge response, so
we shouldn't return it if it's not set. Also made it an optional
field in the DB.
|
2024-01-09 16:43:18 +01:00 |
|
Herman Slatman
|
85309bb8ec
|
Fix the integration test
|
2024-01-09 00:33:01 +01:00 |
|
Herman Slatman
|
fdea5e7db3
|
Fix tests for new ACME orders with Wire IDs
|
2024-01-08 23:16:31 +01:00 |
|
Herman Slatman
|
c1a7acc306
|
Make it compile with Go 1.20 again
|
2024-01-08 22:21:27 +01:00 |
|
beltram
|
84e9682476
|
feat: change the separator between user-id & device-id in a client-id. Use '!' instead of ':'
|
2024-01-08 22:12:13 +01:00 |
|
beltram
|
90b5347887
|
feat: try using the new ClientId & Handle format (i.e. plain URIs)
|
2024-01-08 22:11:37 +01:00 |
|
beltram
|
39bf889925
|
feat: remove query parameters from OIDC issuerUrl so that it allows us to use it to carry the OAuth ClientId in the Challenge.target field without at the same time undermining the idToken verification which relies on a issuer (iss) claim without this query parameter
|
2024-01-08 22:10:49 +01:00 |
|
beltram
|
d6ceebba94
|
feat: update the protocol by including team & handle in the client dpop token, verifying the handle in the dpop challenge
|
2024-01-08 22:09:51 +01:00 |
|
beltram
|
6ffd913e28
|
feat: remove custom hardcoded OIDC challenge for Google
|
2024-01-08 22:08:37 +01:00 |
|
beltram
|
2be77385f6
|
fix: same issue as with oidc challenge
|
2024-01-08 22:07:59 +01:00 |
|
beltram
|
ff07fdc0fd
|
fix: oups
|
2024-01-08 22:07:43 +01:00 |
|
beltram
|
13df461e97
|
fix: could not reuse a signing key otherwise it would create in accounts & orders and fail the OIDC challenge. The OIDC challenge was not retryable
|
2024-01-08 22:07:29 +01:00 |
|
beltram
|
83f76433a8
|
b64 encode the kid since apparently it wasn't
|
2024-01-08 22:06:52 +01:00 |
|
beltram
|
8fd0192da3
|
print kid for debugging
|
2024-01-08 22:06:42 +01:00 |
|
beltram
|
4d028f7813
|
client jwk was there the whole time
|
2024-01-08 22:05:58 +01:00 |
|
beltram
|
ed2bce9a3c
|
fix: access token verification in DPoP challenge. Was previously verifying 'cnf.kid' against backend key whereas it must be against client's key
|
2024-01-08 22:05:29 +01:00 |
|
beltram
|
5fdf036a4d
|
fix: invalid OID for display name in CSR
|
2024-01-08 22:03:03 +01:00 |
|
beltram
|
9d5c974f44
|
fix: PR review
|
2024-01-08 22:02:48 +01:00 |
|
beltram
|
1b32957ff6
|
fix: verify custom display_name extension is present
|
2024-01-08 22:02:16 +01:00 |
|
Herman Slatman
|
ab9e1ddb28
|
Make MockDB implement acme.DB interface again
|
2024-01-08 22:00:50 +01:00 |
|
beltram
|
7b5740153d
|
support for oidc id token
|
2024-01-08 22:00:29 +01:00 |
|
beltram
|
f5b346ee36
|
i'm tired
|
2024-01-08 21:53:08 +01:00 |
|
beltram
|
03dbd91418
|
fix dpop token json serialization to db
|
2024-01-08 21:52:28 +01:00 |
|
beltram
|
613e6cae6e
|
wip
|
2024-01-08 21:50:49 +01:00 |
|
Herman Slatman
|
0b68e1bbcf
|
Add GetAllOrdersByAccountID to MockDB
|
2024-01-08 21:44:10 +01:00 |
|
beltram
|
8888262e45
|
cheat by allowing also looking up for ready orders
|
2024-01-08 21:43:43 +01:00 |
|
beltram
|
0bc530c98e
|
log more things
|
2024-01-08 21:36:50 +01:00 |
|
beltram
|
2e128056dc
|
have updateOrder also update the update joint table [order by account]
|
2024-01-08 21:35:54 +01:00 |
|
Herman Slatman
|
1a711e1b91
|
Add new Wire DB methods to acme.DB interface
|
2024-01-08 21:34:01 +01:00 |
|
beltram
|
abe86002ee
|
try by storing everything in db
|
2024-01-08 21:33:53 +01:00 |
|