CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,096 Commits 7 Branches 2 Tags
46d7613e2ddadb60ce0b3f084e6865207e768830
Commit Graph
117 Commits
Author SHA1 Message Date
Todd Knight 072b950540 Filter inactive and private oidc auth methods from unauthenticated list requests (#1110) 2021-04-13 16:42:25 -07:00
Jeff Mitchell f05f37d0fa Fix panic in non-generated API calls when printing as JSON (#1095) 
Fixes #992
 2021-04-09 13:09:51 -04:00
JimTodd KnightJeff MitchellMichael Gaffney
 		dd0f34bc35 Add new OIDC auth method. (#1090) 
Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com>
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
 2021-04-08 20:54:32 -04:00
Todd Knight 48ef25433f Fix creation of initial Scope roles (#996) 
* Fix the creation of initial roles and users so the admin has permission to list/read resources.

* Adding known permission issue to CHANGELOG.md.
 2021-03-16 08:42:08 -07:00
Jeff Mitchell 9649a19d23 Update CLI error codes to be consistent with connect (#976) 2021-03-04 20:05:17 -05:00
Jeff Mitchell 519efa6dd1 Add -filter to CLI listing and website docs (#967) 
* Add -filter to CLI listing.

This doesn't include docs/Changelog yet, that will come shortly.

* Add changelog

* Add website docs and fix a curl output bug
 2021-03-01 09:23:17 -08:00
Jeff Mitchell 4738ceee5d Add TLS certificate and worker tag reloading on SIGHUP (ICU-1142) (ICU-1143) (#959) 2021-02-25 17:57:10 -05:00
Jeff Mitchell 72aa110f72 CLI JSON updates (#962) 
See Changelog for details.
 2021-02-25 12:43:17 -05:00
Jeff Mitchell 1ce09069a5 Move worker selection above session creation (#929) 
This prevents a session being created when no workers are available to
handle it.
 2021-02-12 11:05:33 -05:00
Jeff Mitchell e9da3a871d Switch on CORS by default if not specified (#928) 2021-02-11 20:10:48 -05:00
Jeff Mitchell 22462cdd84 Add read:self and cancel:self to sessions; add dev unpriv user (#923) 
* Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed.

* Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing.

* Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.
 2021-02-11 13:14:18 -05:00
Jeff MitchellandJeff Malnick d279a906ce Allow public_cluster_addr to use an env var or file (#907) 
Co-authored-by: Jeff Malnick <malnick@gmail.com>
 2021-02-10 20:22:02 -05:00
Todd Knight 568594d1b3 Release the shared lock using a non cancelled context (#918) 2021-02-05 12:58:54 -07:00
Louis RuchandJeff Mitchell 628a02ad15 Scope role grants (#913) 
* Add scope read grant to default roles

* Update CHANGELOG.md

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2021-02-05 09:41:48 -08:00
Todd Knight 1f9fcad1cd Adding Migrate Command (#872) 2021-01-25 14:43:50 -07:00
Jeff Mitchell 6b58a3317d Add recursive listing to roles (#881) 
This also lays the framework for adding recursive listing to the rest of the resources.
 2021-01-23 13:39:04 -05:00
Todd Knight ec6151d174 Organize DB Schema Migration Code and DB Init Checks (#842) 
Create Schema Manager and propagate contexts into the DB calls downstream.
Add checks at controller startup and database init for correct schema version and schema migration dirty bit being set.
 2021-01-19 10:40:41 -07:00
Michael GaffneyandJeff Mitchell 94cb79bbdd See how Boundary would look with gofumpt applied (#853) 
* See how Boundary would look with https://github.com/mvdan/gofumpt applied

Results of running `gofumpt -w -s .`

* Update tools file and Makefile for gofumpt

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2021-01-07 10:02:32 -05:00
Jeff Mitchell 5b5602969f Update go-keyring to use forked version (#846) 
This may help with #830.
 2021-01-04 21:05:42 -05:00
Jeff Mitchell 9a84e50493 Minor linting 2020-12-09 17:05:16 -05:00
Todd Knight aa4157639c Change Format of API Error (#784) 
This is a wire breaking change for json errors since we have removed and renamed a few fields, and changed part of the structure of the returned json error.

* Remove redundant fields in Status, details.error_id, details.TraceId and details.request_id from API errors.

* Added wrapped errors and "ops" field to indicate the internal operation of the errors returned by the API.

* Added error cli error reporting of Op and wrapped errors.
 2020-12-07 14:25:16 -07:00
Jeff Malnick af2d9dfe90 fix: do not print info in output that could be JSON or YAML format (#799) 
* fix: print err msg for no credentials found to stderr
 2020-11-20 09:27:44 -08:00
Jeff Mitchell e2e4631929 Add ability to set public cluster address (#761) 2020-10-30 16:54:53 -04:00
Jeff Mitchell f063b8601c Fix IPv4-only check when no port is specified (#752) 
We have behavior that causes "0.0.0.0" to only listen on IPv4, however,
it also assumed there was a port suffixed. This changes it so that it
also works with a port-less address.
 2020-10-27 10:43:50 -04:00
Jeff Mitchell 813d21565f Allow authorize-session to be invoked with target name (#737) 2020-10-22 08:40:00 -04:00
Jeff Mitchell 09b865ab28 Add pass cred storage support (#731) 
* Add `pass` cred storage support

Make it the default on non-Windows/macOS

Document the token storage behavior
 2020-10-21 09:00:17 -04:00
Jeff Mitchell 1f48d97327 Support for Unix domain socket listeners (#705) 
The client already supports protocol-agnostic transport so handles
unix:/// schemes.
 2020-10-16 13:45:47 -04:00
Jeff Mitchell f454fa9ef2 Don't return error code 1 if saving the value to the keyring (#668) 2020-10-13 17:13:31 -04:00
Jeff Mitchell ef16b6177c Update configuration docs (#661) 
* Update configuration docs

* Fix public addr example
 2020-10-13 12:21:09 -07:00
Jeff Mitchell 868a65ac3d Don't show "Version v" on startup if empty (#653) 
We'll still show the SHA in this case
 2020-10-13 10:47:14 -04:00
Jeff Mitchell bd271b707d Add version command (#604) 2020-10-09 19:35:04 -04:00
Jeff Mitchell 4833fbba23 Simplify worker->controller connection (#601) 
Go's TLS stack doesn't need a separate CA cert and in fact for sessions
we don't use this. So simplify the worker connection to remove an
unnecessary extra key generation.
 2020-10-09 16:49:36 -04:00
Todd Knight 6c6fb7a4d0 Format errors better for CLI (#552) 
* Start making errors easier to read for Table based CLI UI.

* Add TODO about reporting "update_mask" related errors.
 2020-10-06 14:08:49 -07:00
Jeff Mitchell f8a2100603 Add various env vars to CLI (#528) 
* Add auth method ID env var

* Add env var for host catalogs
 2020-10-02 19:20:30 -04:00
Jeff Mitchell fa700dc002 Add account ID templating (#518) 
* Remove default role and create via the same mechanism as other initial resources
 2020-10-01 10:51:54 -04:00
Jeff Mitchell d851ab07d8 Add ability to pull user/account/auth-method ID from stored token (#517) 2020-10-01 01:52:08 -04:00
Jeff Mitchell 6ddfe407a3 Update allowed formats of ACL strings (#508) 2020-10-01 01:49:20 -04:00
Jeff Mitchell c1a1f8bb1b Separate out docker dep into package (#482) 
This also then removes support for docker-based containing starting (for
now) from platforms other than windows/darwin/linux as there are build
issues on several.
 2020-09-28 16:05:15 -04:00
Jim fde96924af refactor user account repo function names (#476) 2020-09-28 15:39:10 -04:00
Jeff Mitchell cf3fa4522d Swap base58 libraries (#472) 
* Swap base58 libraries

This doesn't reduce binary size but it removes a metric ton of
dependencies.
 2020-09-26 14:01:49 -04:00
Jeff Mitchell bec3d702fb Add -database-url to dev mode (#459) 
Create default dev mode login name of "admin" and password of "password"
 2020-09-25 17:36:47 -04:00
Jeff Mitchell 220ca253be Add boundary config get-token (#455) 2020-09-25 17:06:53 -04:00
Jim 21ca0b6388 SetAssociatedAccounts, DisassociateAccounts, AssociateAccounts with support for multiple accounts. (#439) 2020-09-25 13:35:32 -04:00
Jeff Mitchell 61a0ae02c1 Bring go-alpnmux in house for now 2020-09-25 10:17:12 -04:00
Jeff Mitchell 94f9d952be Add connect -exec and ssh subcommand support (#434) 2020-09-24 17:29:12 -04:00
Jeff Mitchell 41a3c66ea1 Add names to init output (#428) 2020-09-24 12:54:40 -04:00
Jeff Mitchell 7fcbffbe88 Remove not-set value. (#427) 
I don't think the conditions exist here that necessitated it being
introduced into Vault, but I do sometimes see a baffling condition where
the address coming from the flag is empty. I don't think we need this so
take it out.
 2020-09-24 12:19:00 -04:00
Jeff Mitchell 31fe9292b3 Instantiate default resources (#425) 2020-09-24 03:31:26 -04:00
Jeff Mitchell 03436a73de Update CLI output functions to show scope info and cleanup (#416) 2020-09-23 03:01:39 -04:00
Jeff Mitchell 38ce9d9eac Combine controller and worker commands (#415) 2020-09-23 01:23:10 -04:00