trustchain-oc1-orchestral/authentik
Archived
10
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity
5791 commits 95 branches 330 tags 336 MiB
Commit graph

1394 commits

Author SHA1 Message Date
Jens Langhammer ff64814f40 web/admin: improve UI for notification toggle 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-22 14:17:56 +02:00
Jens Langhammer 66bfa6879d outposts/proxy: add X-Auth-Groups header to pass groups 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-22 10:47:58 +02:00
Jens Langhammer c05240afbf lib: fix outpost fake-ip not working, add tests 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-22 10:10:25 +02:00
Jens Langhammer 7370dd5f3f outposts: ensure outpost SAs always have permissions to fake IP 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-22 10:02:20 +02:00
Jens Langhammer 896e5adce2 sources/ldap: fix lint 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-22 00:40:55 +02:00
Jens Langhammer a3abbcec6a sources/ldap: improve error handling for property mappings 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-21 23:49:09 +02:00
Jens Langhammer 70e000d327 providers/saml: improve error handling for property mappings 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-21 23:14:03 +02:00
Jens Langhammer a7467e6740 providers/oauth2: handler PropertyMapping exceptions and create event 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-21 22:51:39 +02:00
Jens Langhammer b3da94bbb8 core: broaden error catching for propertymappings 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-21 22:50:39 +02:00
Jens Langhammer 39ad9d7c9d release: 2021.7.1-rc1 2021-07-21 10:44:40 +02:00
Jens Langhammer ba9a4efc9b providers/oauth2: fix nonce field not being optional 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-21 00:34:01 +02:00
Jens Langhammer 902378af53 providers/oauth2: fix redirect_uris not having blank set 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-21 00:22:09 +02:00
Jens Langhammer 2352a7f4d6 providers/oauth2: nonce is only required for implicit flows, don't check or fallback for other flows 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-21 00:21:08 +02:00
Jens Langhammer a2c587be43 outposts: don't authenticate as service user for flows to set remote-ip 
set outpost token as additional header and check that token (user) if they can override remote-ip

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-19 13:17:13 +02:00
Jens Langhammer 538a466090 root: fix middleware exception for outpost 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-18 22:10:50 +02:00
Jens Langhammer 322a343c81 root: fix log level not being set to DEBUG for tests 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-18 21:45:08 +02:00
Jens Langhammer b3159a74e5 Merge branch 'master' into inbuilt-proxy 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

# Conflicts:
#	Dockerfile
#	internal/outpost/ak/api.go
#	internal/outpost/ak/api_uag.go
#	internal/outpost/ak/global.go
#	internal/outpost/ldap/api_tls.go
#	internal/outpost/ldap/instance_bind.go
#	internal/outpost/ldap/utils.go
#	internal/outpost/proxy/api_bundle.go
#	outpost/go.mod
#	outpost/go.sum
#	outpost/pkg/ak/cert.go
 2021-07-17 12:49:38 +02:00
Starz0r ae77c872a0
root: celery requires additional parameters when tls is enabled (#1148) 2021-07-16 08:51:09 +02:00
Starz0r a5bb583268
root: optional TLS support on redis connections (#1147) 
* root: optional TLS support on redis connections

* root: don't use f-strings when not interpolating variables

* root: use f-string in redis protocol prefix interpolation

* root: glaring typo

* formatting

* small formatting change I missed

* root: swap around default redis protocol prefixes
 2021-07-15 11:48:52 +02:00
Jens Langhammer 212ff11b6d api: fix Capabilities check for s3 backup 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-15 09:58:07 +02:00
Jens Langhammer aa701c5725 core: don't delete expired tokens, rotate their key 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-14 21:47:32 +02:00
Jens Langhammer 6f98833150 core: allow users to create non-expiring tokens when flag is set 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-14 21:15:14 +02:00
Jens Langhammer 7c2decf5ec providers/ldap: squash migrations 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-14 09:22:25 +02:00
Lukas Söder 7f39399c32
providers/ldap: Added auto-generated uidNumber and guidNumber generated attributes for use with SSSD and similar software. (#1138) 
* Added auto-generated uidNumber and guidNumber generated attributes for
use with SSSD and similar software.

The starting number for uid/gid can be configured iva environtment
variables and is by default 2000 which should work fine for most instances unless there are more than
999 local accounts on the server/computer.

The uidNumber is just the users Pk + the starting number.
The guidNumber is calculated by the last couple of bytes in the uuid of
the group + the starting number, this should have a low enough chance
for collisions that it's going to be fine for most use cases.

I have not added any interface stuff for configuring the environment variables as I couldn't really find my way around all the places I'd have to edit to add it and the default values should in my opinion be fine for 99% use cases.

* Add a 'fake' primary group for each user

* First attempt att adding config to interface

* Updated API to support new fields

* Refactor code, update documentation and remove obsolete comment

Simplify `GetRIDForGroup`, was a bit overcomplicated before.

Add an additional class/struct `LDAPGroup` which is the new argument
for `pi.GroupEntry` and util functions to create `LDAPGroup` from api.Group and api.User

Add proper support in the interface for changing gidNumber and uidNumber starting points

* make lint-fix for the migration files
 2021-07-14 09:17:01 +02:00
Jens Langhammer 84e9748340 policies/reputation: handle cache error 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-13 18:47:32 +02:00
Jens L 7dfc621ae4
LDAP Provider: TLS support (#1137) 2021-07-13 18:24:18 +02:00
Jens Langhammer 2036827f04 api: add sentry tunnel 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-13 10:58:14 +02:00
Starz0r 5cfbb0993a
Allow for Configurable Redis Port (#1124) 
* root: make redis port configurable

* root: parse redis port from config as an integer

* code formatting

* lifecycle: truncate line under 100 chars

* lifecycle: incorrect indenting on newline
 2021-07-12 11:01:41 +02:00
Jens Langhammer 02f87032cc Merge branch 'master' into inbuilt-proxy 2021-07-11 12:41:16 +02:00
Jens Langhammer 3c0cc27ea1 events: fix error when slack notification request failed without a response 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-09 19:52:19 +02:00
Jens Langhammer ec254d5927 flows: allow variable substitution in flow titles 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-09 19:46:39 +02:00
Jens Langhammer 92ba77e9e5 core: fix error when setting icon/background to url longer than 100 chars 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-09 19:31:32 +02:00
Jens Langhammer 90fe1c2ce8 providers/oauth2: allow blank redirect_uris to allow any redirect_uri 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-08 19:28:35 +02:00
Jens Langhammer 40428f5a82 providers/saml: fix parsing of POST bindings 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-06 16:54:58 +02:00
Jens Langhammer 007838fcf2 root: subclass SessionMiddleware to set Secure and SameSite flag depending on context 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-06 14:48:36 +02:00
Jens Langhammer 7c51afa36c root: set samesite to None for SAML POST flows 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-06 12:39:51 +02:00
Jens Langhammer 948db46406 Merge branch 'master' into inbuilt-proxy 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

# Conflicts:
#	internal/constants/constants.go
#	outpost/pkg/version.go
 2021-07-05 19:11:26 +02:00
Jens Langhammer adc4cd9c0d release: 2021.6.4 2021-07-05 16:59:29 +02:00
Jens Langhammer df92111296 outposts: update outpost permissions on m2m change 
closes #1105

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-04 19:37:12 +02:00
Jens Langhammer 5afe88a605 outposts: fix empty message when docker outpost controller has changed nothing 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-04 13:48:43 +02:00
Jens Langhammer 320dab3425 core: only show Reset password link when recovery flow is configured 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-04 12:59:41 +02:00
Jens Langhammer 5fd408ca82 outposts: fix docker controller not checking ports correctly 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-04 12:32:55 +02:00
Jens Langhammer becb9e34b5 outposts: fix docker controller not checking env correctly 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 22:17:29 +02:00
Jens Langhammer 4917ab9985 outposts: fix container not being started after creation 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 21:59:47 +02:00
Jens Langhammer bd92505bc2 core: add notice about duplicate keys 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 21:52:28 +02:00
Jens Langhammer bf0141acc6 crypto: fix linting 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 19:57:25 +02:00
Jens Langhammer 0c8d513567 stages/user_write: add wrapper for post to user_write 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 19:25:37 +02:00
Jens Langhammer d07704fdf1 crypto: show both sha1 and sha256 fingerprints 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 19:25:27 +02:00
Jens Langhammer 086a8753c0 flows: handle old cached flow plans better 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 19:22:09 +02:00
Jens Langhammer 2c9b596f01 web/admin: run explicit update after loading instance 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 16:41:42 +02:00
Jens Langhammer 7257108091 sources/oauth: create configuration error event when profile can't be parsed as json 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 16:11:49 +02:00
Jens Langhammer 77a507d2f8 providers/oauth2: add revoked field, create suspicious event when previous token is used 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 15:59:01 +02:00
Jens Langhammer 3e60e956f4 providers/oauth2: fix CORS headers not being set for unsuccessful requests 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 15:49:00 +02:00
Jens Langhammer 84ec70c2a2 providers/oauth2: use self.expires for exp field instead of calculating it again 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-03 15:32:58 +02:00
Jens Langhammer 3dc9e247d5 Merge branch 'master' into inbuilt-proxy 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

# Conflicts:
#	internal/constants/constants.go
#	outpost/pkg/version.go
 2021-07-02 16:23:30 +02:00
Jens Langhammer 3e26170f4b providers/oauth2: deepmerge claims 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-07-01 17:33:46 +02:00
dependabot[bot] d102c59654
build(deps-dev): bump pylint from 2.8.3 to 2.9.0 (#1095) 
* build(deps-dev): bump pylint from 2.8.3 to 2.9.0

Bumps [pylint](https://github.com/PyCQA/pylint) from 2.8.3 to 2.9.0.
- [Release notes](https://github.com/PyCQA/pylint/releases)
- [Changelog](https://github.com/PyCQA/pylint/blob/master/ChangeLog)
- [Commits](https://github.com/PyCQA/pylint/compare/v2.8.3...v2.9.0)

---
updated-dependencies:
- dependency-name: pylint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* *: update source for new pylint version

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-30 10:37:28 +02:00
Jens Langhammer 2a0bd50e23 outposts: fix linting 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-29 17:08:12 +02:00
Jens Langhammer ce49d7ea5b outposts: make managed outposts 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-29 16:20:44 +02:00
Jens Langhammer 8429dd19b2 Merge branch 'master' into inbuilt-proxy 2021-06-29 16:20:24 +02:00
Jens Langhammer 680b182d95 release: 2021.6.3 2021-06-29 16:19:07 +02:00
Jens Langhammer 621843c60c flows: fix migration dependency issue 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-28 23:55:07 +02:00
Jens Langhammer c19da839b1 stages/user_write: add create_users_as_inactive flag 
close #1086

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-28 23:24:54 +02:00
Jens Langhammer fea1f3be6f stages/prompt: ensure hidden and static fields keep the value they had set 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-28 22:29:36 +02:00
Jens Langhammer 6f5ec7838f events: fix linting 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-28 20:57:28 +02:00
Jens Langhammer 5d3931c128 events: ignore notification non-existent in transport 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-28 20:15:00 +02:00
Jens Langhammer 262a8b5ae8 api: use partition instead of split for token 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-28 20:13:08 +02:00
Jens Langhammer 2b1356bb91 flows: add invalid_response_action to configure how the FlowExecutor should handle invalid responses 
closes #1079

Default value of `retry` behaves like previous version.

`restart` and `restart_with_context` restart the flow upon an invalid response. `restart_with_context` keeps the same context of the Flow, allowing users to bind policies that maybe aren't valid on the first execution, but are after a retry, like a reputation policy with a deny stage.

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-28 00:22:09 +02:00
Jens Langhammer ba9edd6c44 flows: handle possible errors with FlowPlans received from cache 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-27 22:03:48 +02:00
Jens Langhammer 3b2b3262d7 flows: add FlowStageBinding to flow plan instead of just stage 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-27 18:47:04 +02:00
Jens Langhammer 5431e7fe9d tenants: fix tests 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-27 15:12:47 +02:00
Jens Langhammer 7d9c74ce04 tenants: include all default flows in current_tenant 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-26 23:47:49 +02:00
Jens Langhammer 60c3cf890a events: add ability to create events via API 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-26 23:37:03 +02:00
Jens Langhammer 0403f6d373 web/admin: add flow export button on flow view page 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-26 22:03:19 +02:00
Jens Langhammer 9bd613a31d stages/authenticator_duo: fix component not being set in API 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-26 20:49:58 +02:00
Jens Langhammer 3fe0483dbf core: fix flow background not correctly loading on initial draw 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-26 20:29:45 +02:00
Jens Langhammer b8bdf7a035 outposts: fix outpost being re-created when in host mode 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-25 15:15:18 +02:00
Jens Langhammer a3ff7cea23 providers/oauth2: fix usage of timedelta.seconds 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-25 11:55:00 +02:00
Jens Langhammer bb776c2710 outposts: check docker container ports match 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-25 11:54:35 +02:00
Jens Langhammer 6930c84425 events: only create SYSTEM_EXCEPTION event when error would've been sent to sentry 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-24 13:01:41 +02:00
Jens Langhammer 1554dc9feb outposts: make outpost managed 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-23 21:26:24 +02:00
Jens Langhammer 2b98637ca5 lib: fix regex_match result being inverted, add tests 
closes #1073

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-23 20:06:43 +02:00
Jens Langhammer d1198fc6c1 sources/ldap: improve error handling when checking for password complexity on non-ad setups 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

#1067
 2021-06-23 00:24:05 +02:00
Jens Langhammer 31a58e2c25 release: 2021.6.2 2021-06-22 23:35:10 +02:00
Jens Langhammer b69248dd55 stages/authenticator_validate: fix error when using not_configured_action=configure 
closes #1048

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-22 20:08:58 +02:00
Jens Langhammer 5ff5edf769 outposts: improve logging 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-22 18:51:02 +02:00
Jens Langhammer 939889e0ec tenants: fix footer_links for moved config 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-22 15:48:17 +02:00
Jens Langhammer 19ae6585dc lib: add tests for config loader 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-22 13:12:07 +02:00
Jens Langhammer c6ede78fba core: add support for custom urls for avatars 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-22 12:25:24 +02:00
Jens Langhammer 9b5e3921cb providers/saml: better handle decoding errors 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 22:48:34 +02:00
Jens Langhammer f6026fdb13 root: allow loading local /static files without debug flag 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 21:21:35 +02:00
Jens Langhammer a4856969f4 outposts: fix port and inner_port being mixed on docker controller 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 19:19:06 +02:00
Jens Langhammer 2aa7266688 crypto: fix linting 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 16:24:03 +02:00
Jens Langhammer c0c246edab crypto: catch error when loading private key 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 15:57:48 +02:00
Jens Langhammer 831b32c279 core: fix PropertyMapping's globals not matching Expression policy 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 15:54:43 +02:00
Jens Langhammer 70ccc63702 core: remove default flow background from default css, set static in base_full and dynamically in if/flow 
closes #1056

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 10:37:34 +02:00
Jens Langhammer de954250e5 root: make general cache timeouts configurable 
closes #974

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 10:18:49 +02:00
Jens Langhammer f268bd4c69 policies: make policy result cache timeout configurable 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 10:17:58 +02:00
Jens Langhammer 57a48b6350 flows: make flow plan cache timeout configurable 
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 10:17:11 +02:00
Jens Langhammer 9aac114115 root: save temporary database dump in /tmp 
closes #1055

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
 2021-06-21 09:58:19 +02:00