Commit graph

66 commits

Author SHA1 Message Date
Eric Chiang
b10645f58d *: add client registration endpoint to admin API 2016-04-05 11:37:26 -07:00
Eric Chiang
6120f7ac05 *: add isAdmin option to client repo when creating a client 2016-04-05 11:29:58 -07:00
Rubén Soleto Buenvarón
821b242c83 Fix response_type missing param
This commit fix problem with response_type param, which is required according to OIDC spec, when it is missing.
 At now, when connector_id url query param is not set, connector view use response_type that client request instead of default "code".

Fixes #370
2016-03-17 08:00:49 +01:00
Eric Chiang
1dd831700d Merge pull request #348 from ericchiang/db_health
server: add db heatlh checker to server checkers
2016-03-14 13:17:19 -07:00
Eric Chiang
c3aa6a1ee3 server: correctly decode oauth2 basic auth credentials
Fixes #336
2016-03-02 21:31:54 -08:00
Eric Chiang
c92aae647c Merge pull request #331 from Tecsisa/184-resend-email-invitation
add support for resend an invite email
2016-03-02 16:53:17 -08:00
Eric Chiang
60b843e78b Merge pull request #339 from ericchiang/case_insensitive_emails
db: email comparison should be case insensitive
2016-03-02 16:51:47 -08:00
Eric Chiang
01a24542e9 *: fix tests that care about email case sensitivity 2016-03-01 14:09:10 -08:00
Eric Chiang
3f4a42eefd *: remove unused code
This change has no functional changes, it only removes dead code.
2016-02-29 11:29:36 -08:00
Eric Chiang
067ccee145 server: add db heatlh checker to server checkers 2016-02-29 11:27:17 -08:00
Rubén Soleto Buenvarón
8156870862 add support for resend an invite email
This change solves the User's API problem when you want to create an user that its email hasn't been verified yet but it exist.
At now, you can resend invitation email using endpoint /users/{id}/resend-invitation

Fixes #184
2016-02-26 09:55:28 +01:00
Eric Chiang
07af73f367 *: don't allow sqlite3 if --no-db flag not specified 2016-02-12 13:19:05 -08:00
Eric Chiang
3b125d6073 *: fix --no-db client decoding 2016-02-12 13:19:05 -08:00
Eric Chiang
dcf5835189 *: remove in memory connector config repo 2016-02-12 13:19:05 -08:00
Eric Chiang
b572b8dd6c *: remove in memory client repo
The DB implementation expects secrets to be base64 encoded blobs.
Because of this a bunch of tests broke moving to sqlite.

A lot of this commit is fixing those tests.
2016-02-12 13:19:05 -08:00
Eric Chiang
72d1ecab64 *: remove in memory password info repo 2016-02-12 13:19:05 -08:00
Eric Chiang
2726f4dcdf *: remove in memory user repo 2016-02-12 13:19:05 -08:00
Eric Chiang
95560404a3 *: remove in memory refresh repo 2016-02-12 13:19:05 -08:00
Eric Chiang
7bac93aa20 *: remove in memory session repos
Move manager to it's own package so it can import db. Move all
references to the in memory session repos to use sqlite3.
2016-02-12 13:19:05 -08:00
Eric Chiang
af790e46bb Merge pull request #267 from ericchiang/metadata
add dynamic client registration
2016-02-01 16:25:57 -08:00
Eric Chiang
04cd1851aa server: add dynamic client registration 2016-02-01 16:06:46 -08:00
Frode Nordahl
5d284e08ae Change status code used for redirects from StatusTemporaryRedirect (307) to StatusFound (302)
HTTP code 307 aka. StatusTemporaryRedirect is used throughout the
project. However, the endpoints redirected to explicitly expects
the client to make a GET request.

If a HTTP client issues a POST request to a server and receives a
HTTP 307 redirect, it forwards the POST request to the new URL.

When using 302 the HTTP client will issue a GET request.

Fixes #287
2016-01-23 22:33:53 +01:00
bobbyrullo
789d9a68cc Merge pull request #282 from ericchiang/fix_token_test
server: fix reset password test
2016-01-20 14:35:46 -08:00
Eric Chiang
4da143ca2d server: fix reset password test
TestResetPasswordHandler depended on makeToken begin called twice
during the initialization of a single test case and later assuming
the result would match. Because the token has a timestamp accurate
to the second, occasionally the timestamps would be slightly off
within a single test case and cause the test to fail.

Adding a sleep statement to makeToken would cause the test to fail
reliably.

Define a single token for each test case outside of the struct
initializer so test cases compare the same token.

Closes #274

Additionally remove logging statements that dump entire HTML pages.
2016-01-19 19:45:16 -08:00
Eric Chiang
6b4aa88306 Merge pull request #280 from ericchiang/user_api
*: move user API auth to middleware and fix return status
2016-01-19 15:52:11 -08:00
Eric Chiang
0ada4c8010 *: move user API auth to middleware and fix return status
Move client authentication into its own middleware and provide
differentiation between HTTP requests that do not provide
credentials (401) and requests that authenticate as a non-admin
user (403).

Closes #152
2016-01-19 13:49:01 -08:00
Eric Chiang
ec3bc7f258 *: allow dexctl set-connector-configs to read from stdin
Closes #276
2016-01-19 08:59:34 -08:00
Eric Chiang
5e44b6bc27 *: update all to accommodate changes to go-oidc
Update dex to comply with the changes to fieldnames and types of
the client and provider metadata structs in coreos/go-oidc.
2016-01-12 17:16:28 -08:00
bobbyrullo
71f5021678 Merge pull request #246 from bobbyrullo/maybe
server: better UX when remote ID already exists
2015-12-23 18:17:54 -08:00
Bobby Rullo
dc828825e6 server: better UX when remote ID already exists
Instead of cryptic message with nowhere to, give them the choice to
login with that account or register.
2015-12-23 17:11:03 -08:00
Eric Chiang
ad6e331860 server: fix flow when user logs in through wrong connector
This cleans up the code that deals with a user attempting to login
through a different connector than they registered with. The only
functional change is that `newLoginURLFromSession` is now called
with register = false when a user has an existing account.
2015-12-22 13:20:40 -08:00
Eric Chiang
99e1163972 server: fix tests
In #210 a field name in the provider config was corrected. However
the old, and incorrect, value was hard coded in the tests. This
change updates the test case to hold the correct field name.

There are no other references to the old name in dex or its
vendored packages.
2015-12-16 18:20:14 -08:00
Eric Chiang
f63ec158a5 Merge pull request #197 from ericchiang/oauth2_connector
connector: github and bitbucket oauth2 connectors added
2015-12-10 08:56:09 -08:00
Eric Chiang
f2c3dbc5e6 static, server: add styles for github and bitbucket connectors
Add icons and styles for github and bitbucket buttons.
2015-12-08 10:20:13 -08:00
Eric Chiang
f43655a8c3 user/manager: connector must exists when creating remote identity
Add ConnectorConfigRepo to UserManager. When trying to create a
RemoteIdentity, validate that the connector ID exists.

Fixes #198
2015-12-07 17:34:08 -08:00
Eric Chiang
d518447282 user: move user manager to it's own package
This commit moves the user.Manage to its own package (user/manager)
so it can import the connector package in a later commit.

For clarity, it renames "Manager" to "UserManager" using gorname.

This commit has no functional changes.
2015-12-07 15:34:14 -08:00
Eric Chiang
8be9396811 registration: trim spaces and sanity check user email from form
When a user attempts to register an email, trim prefixed and
trailing spaces, then perform a basic sanity check to ensure it's
of form "test@example.com".

Fixes #163
2015-12-01 10:20:00 -08:00
Joe Bowers
a9ab63893d Merge pull request #179 from coreos/new-invitation-endpoint
New invitation endpoint
2015-11-18 14:25:09 -08:00
Joe Bowers
0c854a21d6 server: endpoint and system for sending invitations to dex
An invitation allows users to both verify their email address and set
a new password.
2015-11-18 14:24:19 -08:00
Marcus Stong
7d0ecf9532 server: add scope to newLoginURLFromSession
need to make sure the scope is present otherwise will be considered an invalid request

fixes #135
2015-11-18 14:16:35 -05:00
Joe Bowers
792b72ef54 server: spelling of error message 2015-11-11 10:04:54 -08:00
Joe Bowers
ca9227fc19 various: spelling, logging, and commentary cleanup 2015-11-11 10:04:54 -08:00
Bobby Rullo
d1e292eb94 server: pass issuer name to emailer
Issuer name can be used in Emailer
2015-10-30 15:00:40 -07:00
Bobby Rullo
2ef1b4beff user: introduce "invite" emails
Invite emails are essentially just reset password emails with a
different template (though this can and probably will change (slightly)
in the near future)
2015-10-30 14:41:00 -07:00
George Tankersley
07a4d4441e pkg/crypto: replace old crypto with new crypto 2015-10-29 13:45:25 -07:00
Joe Bowers
85113748a8 server: unify password reset and email verification code and behavior
This patch proposes behavioral changes. In particular, referring
systems will need to provide client ids under all circumstances.
2015-10-16 14:47:58 -07:00
bobbyrullo
8360f18fea Merge pull request #147 from gyuho/use_stdpkg_basicauth
server: use standard lib http.Request.BasicAuth
2015-10-13 11:37:31 -07:00
Yifan Gu
7282dd5187 refreshtoken: return base64 encoded token for in-memory backend.
Previously if we use the in-memory backend, it will return a raw
binary token for refresh token. This fixes the case.
2015-10-12 14:51:52 -07:00
Gyu-Ho Lee
f06073fbcd server: use standard lib http.Request.BasicAuth
Go 1.4+ has https://golang.org/pkg/net/http/#Request.BasicAuth
method for http.Request and it was requested by CoreOS(kelsey) [1]
with the same functionalities. If dex's Go development is being done
in Go 1.4 or later, we should use the standard library.

Thanks!

---
[1] https://codereview.appspot.com/76540043/
2015-10-06 05:00:33 -07:00
Bobby Rullo
55040c55fa server, integration, cmd: Protect Admin API
Admin API now requires a 128 byte base64 encoded secret to be passed in
Authorization header, closing up a potential security hole for those
who expose this service.
2015-10-01 13:15:45 -07:00