Commit graph

811 commits

Author SHA1 Message Date
Eric Chiang
ca7d2b8f9e Merge pull request #772 from ericchiang/at_hash-support
server: add at_hash claim support
2017-01-13 10:15:21 -08:00
Eric Chiang
1eda382789 server: add at_hash claim support
The "at_hash" claim, which provides hash verification for the
"access_token," is a required claim for implicit and hybrid flow
requests. Previously we did not include it (against spec). This
PR implements the "at_hash" logic and adds the claim to all
responses.

As a cleanup, it also moves some JOSE signing logic out of the
storage package and into the server package.

For details see:

https://openid.net/specs/openid-connect-core-1_0.html#ImplicitIDToken
2017-01-13 10:05:24 -08:00
Eric Chiang
79c21f9b0c Merge pull request #773 from y2kenny/patch-1
Removed extra o typo
2017-01-11 13:10:57 -08:00
y2kenny
4d4cb99459 Removed extra o typo 2017-01-11 15:47:55 -05:00
Eric Chiang
3c247db00a Merge pull request #757 from ericchiang/constant-refresh-tokens
*: update refresh tokens instead of deleting and creating another
2017-01-11 12:09:39 -08:00
Eric Chiang
ed20fee2b9 cmd/example-app: fix refreshing 2017-01-11 12:07:48 -08:00
Eric Chiang
f4bbab5056 server/internal: generate protobuf types 2017-01-11 12:07:48 -08:00
Eric Chiang
f778b2d33b server: update refresh tokens instead of deleting and creating another
The server implements a strategy called "Refresh Token Rotation" to
ensure refresh tokens can only be claimed once.

ref: https://tools.ietf.org/html/rfc6819#section-5.2.2.3

Previously "refresh_token" values in token responses where just the
ID of the internal refresh object. To implement rotation, when a
client redeemed a refresh token, the object would be deleted, a new
one created, and the new ID returned as the new "refresh_token".

However, this means there was no consistent ID for refresh tokens
internally, making things like foreign keys very hard to implement.
This is problematic for revocation features like showing all the
refresh tokens a user or client has out.

This PR updates the "refresh_token" to be an encoded protobuf
message, which holds the internal ID and a nonce. When a refresh
token is used, the nonce is updated to prevent reuse, but the ID
remains the same. Additionally it adds the timestamp of each
token's last use.
2017-01-11 12:07:48 -08:00
Eric Chiang
312ca7491e storage: add extra fields to refresh token and update method 2017-01-11 12:07:48 -08:00
Eric Chiang
c66cce8b40 Merge pull request #766 from ericchiang/implicit-flow
server: fixes for the implicit and hybrid flow
2017-01-10 16:50:29 -08:00
Eric Chiang
f926d74157 server: fixes for the implicit and hybrid flow
Accept the following response_type for the implicit flow:

    id_token
    token id_token

And the following for hybrid flow

    code id_token
    code token
    code token id_token

This corrects the previous behavior of the implicit flow, which
only accepted "token" (now correctly rejected).
2017-01-10 16:20:17 -08:00
Eric Chiang
7f72ea786d Merge pull request #752 from ericchiang/saml
Add an experimental SAML connector
2017-01-09 18:33:00 -08:00
Eric Chiang
7ea2d24011 vendor: revendor 2017-01-09 18:30:58 -08:00
Eric Chiang
78665074ed cmd/example-app: add option to not request a refresh token 2017-01-09 18:30:58 -08:00
Eric Chiang
0f4a1f69c5 *: wire up SAML POST binding 2017-01-09 18:30:58 -08:00
Eric Chiang
31dfb54b6f connector: add a SAML connector 2017-01-09 18:30:58 -08:00
Eric Chiang
15fadeaf86 Merge pull request #767 from rithujohn191/fix-refresh
storage: Add ConnectorData to storage RefreshToken.
2017-01-09 15:16:18 -08:00
rithu john
2c03693972 storage: Add ConnectorData to storage RefreshToken. 2017-01-09 15:01:29 -08:00
Eric Chiang
ec9d1607b2 Merge pull request #760 from xeonx/master
Allow CORS on discovery endpoint
2017-01-08 11:17:38 -08:00
Simon HEGE
6cbf7125e0 vendor: revendor 2017-01-08 19:28:18 +01:00
Simon HEGE
b4c47910e4 Allow CORS on discovery endpoint 2017-01-08 19:22:39 +01:00
rithu leena john
4ddc5eb061 Merge pull request #765 from rithujohn191/bump-oidc
Bump go-oidc package
2017-01-06 16:06:44 -08:00
rithu john
05cef99a31 vendor: revendor 2017-01-06 15:39:36 -08:00
rithu john
984b2934fe *: update vendored go-oidc 2017-01-06 15:36:56 -08:00
rithu leena john
fb5199c958 Merge pull request #759 from rithujohn191/ldap-grpsearch
connector/ldap: enable groupSearch to be empty
2016-12-28 14:20:37 -08:00
rithu john
6a728f107e connector/ldap: enable groupSearch to be empty 2016-12-27 11:07:03 -08:00
rithu leena john
3e2d857928 Merge pull request #756 from ericchiang/revendor
*: add 'make revendor' and tests to catch incorrect glide usage
2016-12-22 12:05:57 -08:00
Eric Chiang
1451213dd7 vendor: revendor 2016-12-22 11:52:37 -08:00
Eric Chiang
d87a4c35b9 *: add 'make revendor' and tests to catch incorrect glide usage
Introducing glide-vc caused us to unknowingly removed our Go
protobuf compiler (since it's a main). Add flags to glide-vc usage
to remedy this.

Since we now require several glide and glide-vc flags, add a Makfile
target and tests to catch when PRs don't use the correct flags.
2016-12-22 11:52:24 -08:00
Eric Chiang
54afc8f1d2 Merge pull request #754 from szuecs/bugfix/wrong-shell
build fails
2016-12-22 09:08:01 -08:00
Sandor Szuecs
626f205f8f sh has no arrays 2016-12-22 14:29:04 +01:00
Eric Chiang
3c9ab50ddf Merge pull request #751 from h0me/patch-1
replace bcrypt hash with a working one
2016-12-20 11:05:02 -08:00
h0me
9bf491befc replace bcrypt hash with a working one
replace bcrypt hash with an appropriate value for the string "password"
2016-12-20 15:21:05 +01:00
rithu leena john
03033e5e44 Merge pull request #750 from rithujohn191/use-utc
server: use UTC timestamps in dex.
2016-12-16 16:44:00 -08:00
rithu john
135b71727d server: use UTC timestamps in dex. 2016-12-16 16:13:51 -08:00
Eric Chiang
c58dd948c7 Merge pull request #749 from ericchiang/postgres-timezones
storage: fix postgres timezone handling
2016-12-16 15:36:12 -08:00
Eric Chiang
c7aa1548e6 Merge pull request #742 from rithujohn191/dex-frontend-cleanup
server: add error HTML templates with error description.
2016-12-16 11:51:01 -08:00
Eric Chiang
fd20b213bb storage: fix postgres timezone handling
Dex's Postgres client currently uses the `timestamp` datatype for
storing times. This lops of timezones with no conversion, causing
times to lose locality information.

We could convert all times to UTC before storing them, but this is
a backward incompatible change for upgrades, since the new version
of dex would still be reading times from the database with no
locality.

Because of this intrinsic issue that current Postgres users don't
save any timezone data, we chose to treat any existing installation
as corrupted and change the datatype used for times to `timestamptz`.
This is a breaking change, but it seems hard to offer an
alternative that's both correct and backward compatible.

Additionally, an internal flag has been added to SQL flavors,
`supportsTimezones`. This allows us to handle SQLite3, which doesn't
support timezones, while still storing timezones in other flavors.
Flavors that don't support timezones are explicitly converted to
UTC.
2016-12-16 11:46:49 -08:00
rithu john
75aa1c67ce server: add error HTML templates with error description. 2016-12-16 10:42:54 -08:00
Eric Chiang
89cbf8d243 Merge pull request #748 from ericchiang/better-config-feedback
cmd/dex: provide better feedback when parsing config
2016-12-15 13:52:14 -08:00
Eric Chiang
4d54038256 examples: add logger fields 2016-12-15 13:47:37 -08:00
Eric Chiang
50086e6863 cmd/dex: provide better feedback when parsing config 2016-12-15 13:47:25 -08:00
rithu leena john
dd3133072c Merge pull request #741 from rithujohn191/logging-correction
cmd/dex: modify error messages to info messages.
2016-12-13 14:31:25 -08:00
rithu john
8b7f810bb8 cmd/dex: modify error messages to info messages. 2016-12-13 14:26:08 -08:00
Eric Chiang
91cc94dd8f Merge pull request #740 from ericchiang/fix-comment-typos
*: fix comment typos and add go report card icon
2016-12-13 13:17:50 -08:00
Eric Chiang
aa6c0c6ed7 Merge pull request #739 from ericchiang/check-go-version
*: check go version before building
2016-12-13 13:17:41 -08:00
Eric Chiang
998350db74 *: add go report card to README 2016-12-13 12:24:27 -08:00
Eric Chiang
fe196864c0 *: fix comment typos found with github.com/client9/misspell 2016-12-13 12:23:16 -08:00
rithu leena john
71a1d8d42f Merge pull request #723 from rithujohn191/support-leveled-logging
cmd/dex: add logging config and launch logger for server module.
2016-12-13 12:22:04 -08:00
Eric Chiang
18bbd94fba *: check go version before building
Add a script to check the Go version before building dex. This
gives a nice error message rather than just failing to compile.

With changes:

    $ go version
    go version go1.6.4 linux/amd64
    $ make
    ERROR: dex requires Go version 1.7+. Please update your Go installation: https://golang.org/dl/
    Makefile:93: recipe for target 'check-go-version' failed
    make: *** [check-go-version] Error 2

Checks only added for building the actual binary, not tests, since
this is aimed at users just starting off with the project.
2016-12-13 12:03:27 -08:00