mystiq/dex
Archived
4
0
Fork 1
Code Issues Pull requests Packages Projects Releases Wiki Activity
677 commits 27 branches 73 tags 23 MiB
Commit graph

677 commits

This branch
This branch
All branches
Author SHA1 Message Date
Phu Kieu 47897f73fa Validate audience with entityIssuer if present, use redirectURI otherwise 2017-04-06 14:40:56 -07:00
Eric Chiang 40f0265ab4 Merge pull request #885 from Calpicow/saml_issuer_fix 
Add ssoIssuer to fix Response issuer checking
 2017-04-06 11:19:47 -07:00
Phu Kieu 8c0eb67ecd Update documentation 2017-04-06 11:06:30 -07:00
Phu Kieu 217b5ca2c7 Add ssoIssuer to fix Response issuer checking 
Rename issuer to entityIssuer
 2017-04-06 11:05:49 -07:00
Eric Chiang 207d20777b Merge pull request #893 from ericchiang/fix-saml-validation 
connector/saml: fix validation bug with multiple Assertion elements
 2017-04-04 11:18:12 -07:00
Eric Chiang a97cffcd52 connector/saml: refactor tests and add self-signed responses 
Introduces SAML tests which execute full response processing and
compare user attributes. tesdata now includes a full, self-signed
CA and documents signed using xmlsec1.

Adds deprication notices to existing tests, but don't remove them
since they still provide coverage.
 2017-04-04 11:11:35 -07:00
Eric Chiang e0709dc2ac connector/saml: fix validation bug with multiple Assertion elements 
When a SAML response provided multiple Assertion elements, only the
first one is checked for a valid signature. If the Assertion is
verified, the original Assertion is removed and the canonicalized
version is prepended to the Response. However, if there were
multiple assertions, the second assertion could end up first in the
list of Assertions, even if it was unsigned.

For example this:

    <Response>
      <!--
         Response unsigned. According to SAML spec must check
         assertion signature.
      -->
      <Assertion>
        <Signature>
          <!-- Correrctly signed assertion -->
        </Signature>
      </Assertion>

      <Assertion>
        <!-- Unsigned assertion inserted by attacker-->
      </Assertion>
    </Response>

could be verified then re-ordered to the following:

    <Response>
      <!--
         Response unsigned. According to SAML spec must check
         assertion signature.
      -->
      <Assertion>
        <!-- Unsigned assertion inserted by attacker-->
      </Assertion>

      <Assertion>
        <!-- Canonicalized, correrctly signed assertion -->
      </Assertion>
    </Response>

Fix this by removing all unverified child elements of the Response,
not just the original assertion.
 2017-04-04 11:11:35 -07:00
Lucas Servén a7d443ea2b Merge pull request #891 from squat/garbage_log_info 
server/server.go: make successful garbage collection log at info level
 2017-04-04 10:14:43 -07:00
Lucas Serven f3d9bd5008
server/server.go: make successful garbage collection log at info level 2017-04-04 09:47:53 -07:00
rithu leena john f4865a354c Merge pull request #886 from rithujohn191/error-msg-update 
storage/static.go: correct the error message that gets displayed.
 2017-03-29 11:54:00 -07:00
rithu john 5abb4b3df6 storage/static.go: correct the error message that gets displayed. 2017-03-29 11:32:02 -07:00
Eric Chiang 5eb8210eb4 Merge pull request #883 from ericchiang/scopes-docs 
Documentation: document dex scopes, claims, and client features
 2017-03-28 21:26:01 -07:00
Eric Chiang 8902ddc061 Merge pull request #881 from ericchiang/api-test-use-client 
server: use client connected to remove server for gRPC tests
 2017-03-28 21:25:55 -07:00
Eric Chiang 5e34f0d1a6 Documentation: document dex scopes, claims, and client features 2017-03-28 16:53:06 -07:00
Eric Chiang f734b140cd server: use client connected to remove server for gRPC tests 2017-03-28 16:41:39 -07:00
rithu leena john 42c1eed231 Merge pull request #880 from rithujohn191/connector-object 
storage: add connector object to backend storage.
 2017-03-28 14:31:08 -07:00
rithu john bc55b86d0d storage: add connector object to backend storage. 2017-03-28 14:12:38 -07:00
Eric Chiang 6e50c18458 Merge pull request #875 from ericchiang/fix-example-app-custom-ca 
cmd/example-app: fix custom CA behavior
 2017-03-24 13:21:20 -07:00
Eric Chiang 9b0e9ab2ca cmd/example-app: fix custom CA behavior 2017-03-24 11:53:28 -07:00
Eric Chiang 2a6ae0a6ea Merge pull request #870 from Calpicow/fix_assertion_fallback 
Fix assertion fallback
 2017-03-24 11:34:30 -07:00
Phu Kieu 6f9ef961bb Use etreeutils.NSSelectOne to select Assertion element 2017-03-24 11:20:53 -07:00
Phu Kieu 4b457d8c82 vendor: revendor 2017-03-24 11:03:30 -07:00
Phu Kieu b5f70dac36 glide.yaml: update goxmldsig 2017-03-24 11:02:55 -07:00
rithu leena john 5d49e18478 Merge pull request #873 from rithujohn191/client-example 
examples/grpc-client: clean up the example and add tlsClientCA to ConfigMap.
 2017-03-23 17:24:11 -07:00
rithu john 562eae3fc7 examples/grpc-client: clean up the example and add tlsClientCA to ConfigMap. 2017-03-23 16:57:23 -07:00
rithu leena john 6146e23396 Merge pull request #872 from rithujohn191/offline-access-error 
connector: Connectors without a RefreshConnector should not error out
 2017-03-23 16:11:45 -07:00
rithu john 59502850f0 connector: Connectors without a RefreshConnector should not return a refresh token instead of erroring 2017-03-23 14:56:34 -07:00
Eric Chiang b112aa2ecd Merge pull request #869 from ericchiang/saml-response-to 
*: validate InResponseTo SAML response field and make issuer optional
 2017-03-22 13:04:41 -07:00
Eric Chiang 50b223a9db *: validate InResponseTo SAML response field and make issuer optional 2017-03-22 13:02:44 -07:00
Eric Chiang 8b2956ddbc Merge pull request #867 from ericchiang/xml-validation 
glide.yaml: update goxmldsig
 2017-03-21 10:27:04 -07:00
Eric Chiang 910d59865b vendor: revendor 2017-03-21 09:27:22 -07:00
Eric Chiang 5888220965 glide.yaml: update goxmldsig 2017-03-21 09:25:56 -07:00
Eric Chiang 95d237003a Merge pull request #855 from ericchiang/static-storage-fallthrough 
storage: make static storages query real storages for some actions
 2017-03-20 10:42:34 -07:00
Eric Chiang af54f59202 Merge pull request #864 from ericchiang/spelling 
*: fix spelling using github.com/client9/misspell
 2017-03-20 10:20:16 -07:00
Eric Chiang 25fdaa67a7 Merge pull request #860 from ericchiang/oidc-broken-auth-header 
connector/oidc: expose oauth2.RegisterBrokenAuthHeaderProvider
 2017-03-20 09:56:09 -07:00
Eric Chiang 4c39bc20ae storage: make static storages query real storages for some actions 
If dex is configured with static passwords or clients, let the API
still add or modify objects in the backing storage, so long as
their IDs don't conflict with the static ones. List options now
aggregate resources from the static list and backing storage.
 2017-03-20 09:39:38 -07:00
Eric Chiang 33f0199077 *: fix spelling using github.com/client9/misspell 2017-03-20 09:16:56 -07:00
Eric Chiang f503ff7950 *: add documentation for the OpenID Connect provider 2017-03-20 08:47:02 -07:00
Eric Chiang ac032e99f0 connector/oidc: expose oauth2.RegisterBrokenAuthHeaderProvider 2017-03-20 08:47:02 -07:00
rithu leena john 4bf74d8ac3 Merge pull request #862 from rithujohn191/update-api 
api: Update timestamp type for RefreshTokenRef to int64.
 2017-03-17 15:58:09 -07:00
rithu john 921090f05f api: Update timestamp type for RefreshTokenRef to int64. 2017-03-17 15:46:39 -07:00
rithu leena john 84af5273c8 Merge pull request #854 from rithujohn191/conformance-tests 
storage/conformance: update conformance tests with multiple entries per resource
 2017-03-17 10:51:24 -07:00
rithu john 9e88924577 storage/conformance: update conformance tests with multiple entries per resource 2017-03-16 16:35:51 -07:00
rithu leena john 7a798844cc Merge pull request #852 from ericchiang/fix-log-level 
storage/kubernetes: log INFO level if TPR already exists, not ERROR
 2017-03-15 10:50:00 -07:00
Eric Chiang 6cb38604d9 storage/kubernetes: log INFO level if TPR already exists, not ERROR 2017-03-15 10:30:10 -07:00
Eric Chiang d31bb1c8d5 Merge pull request #848 from ericchiang/fix-sql-where-statement 
storage/sql: add missing WHERE statement to refresh token update
 2017-03-13 16:54:58 -07:00
Eric Chiang 0481fccd76 storage/sql: add missing WHERE statement to refresh token update 2017-03-13 15:53:28 -07:00
Eric Chiang d6f4fa5d98 Merge pull request #844 from dmmcquay/master 
update kubernetes example-app explanation
 2017-03-10 09:59:10 -08:00
Derek McQuay 9b052f37c9
clearified redirect-uri and make cmd location 2017-03-09 22:36:37 -08:00
Derek McQuay a6ab82d6c0
update kubernetes example-app explanation 
Clarify some potentially confusing issues with how to run and build the
example-app binary.
 2017-03-09 17:17:07 -08:00