Commit Graph
284 Commits
Author SHA1 Message Date
Louis RuchandMichael Gaffney 649ed32504 Scheduler updates (#1311)
* Scheduler updates

* Add convenience methods to db/timestamp.Timestamp

* Remove recursive loop

Co-authored-by: Michael Gaffney <mike@gaffney.cc>
2021-06-11 11:36:14 -07:00
Jeff Mitchell 054c0aa538 Update password generated account IDs (#1290) 2021-06-08 12:31:58 -04:00
Jeff Mitchell d6ef2732e7 Merge remote-tracking branch 'origin/main' into ICU-1573 2021-06-07 15:21:30 -04:00
Jim 465c8c9036 stop panicing because the issuer port is invalid. (#1282) 2021-06-05 13:17:46 -04:00
Jeff Mitchell 9ecc384007 Add managed group support to role principals (#1270) 2021-06-04 10:44:57 -04:00
Jeff Mitchell ad93315b59 Add predictable account IDs in dev mode (#1271) 2021-06-04 10:35:51 -04:00
Jeff Mitchell 9208d10936 Merge branch 'main' into ICU-1573 2021-06-02 14:09:02 -04:00
Jeff Mitchell 306d4fb4d3 Add API/CLI for managed groups (#1265) 2021-06-02 14:05:10 -04:00
Jeff Mitchell 179a49657e Managed Groups service (#1262) 2021-06-02 14:01:37 -04:00
Todd Knight 4bd480c183 Fix field error message field name. (#1266) 2021-06-02 07:39:45 -07:00
Jim 6cfc1a7753 use a slice for claim maps so the order is deterministic (#1263) 2021-06-02 07:09:41 -04:00
Jeff Mitchell 7da892a054 Managed Groups OIDC Repo (#1254) 2021-06-01 15:12:34 -04:00
Jeff Mitchell 15bd1a5245 Add initial SQL for managed groups (#1253) 2021-05-26 20:43:36 -04:00
Jeff Mitchell a0c1f69ae2 Already-canceled sessions return 200 (#1243)
If a session is already canceled or terminated, attempting to cancel it
will return the current session state and a 200, instead of an error.
2021-05-20 21:07:22 -04:00
Michael Gaffney 21033a6174 Refactor: multiple rename to fix the spelling of subtype (#1227)
The definition of 'subtype' is 'a secondary or subordinate type'. The
'T' should not be capitalized (unless it is referring to a type of
submarine, which its not).
2021-05-17 15:36:45 -04:00
Jeff Mitchell 7ee8ddba6a True up some spelling 2021-05-14 16:26:25 -04:00
Jeff Mitchell b54be8ee9a Add missing API-level state checks during session cancel (#1223)
* Add missing API-level state checks during session cancel

This validates it's not already canceled or in terminated state.
2021-05-14 15:57:30 -04:00
Jeff Mitchell 6f34da8923 Add cleanup of dead connections no longer reported by a worker (#1220) 2021-05-14 13:23:12 -04:00
Louis Ruch feb5d7385d Louis job scheduler (#1197)
* Adds job repo
* Adds scheduler
* Adds plugin table which is a place holder for future expansion of the scheduler. Currently all jobs that are created are linked to the pi_system plugin which are jobs that are held in a local registeredJobs map populated at controller startup.
2021-05-06 14:54:10 -07:00
Jeff Mitchell 22d5c88a0b Add Output Fields support (#1192) 2021-05-04 20:57:35 -04:00
Jim 2437cdcc8d OIDC: add support for account claim maps (#1186) 2021-05-04 08:41:04 -04:00
s-christoff 9ceeb3bd65 Add -container-image flag (#1112) 2021-05-03 13:11:28 -05:00
Jim 8d317023f8 OIDC: make callback URL paths deterministic. (#1188) 2021-05-02 15:25:29 -04:00
Todd Knight 61e236f76d OIDC Callback Error Redirect (#1174) 2021-04-29 14:47:13 -07:00
Jim 25e657fa51 Ongoing OIDC: support to request additional OIDC scopes from the IdP (#1175) 2021-04-28 06:53:13 -04:00
Jeff Mitchell 4690225c1e Update delete action behavior and JSON format output (#1155)
This PR changes delete behavior:

* On success, a 204 is returned rather than a 200 with an empty JSON object
* The CLI now passes through the 404 error if encountered instead of swallowing it

It also updates formatting for JSON to use the response body, which means that the item (or items) in the JSON format are actually the format across the wire, instead of being reinterpreted by unmarshaling into the Go SDK and then remarshaling.
2021-04-26 20:38:55 -04:00
Jeff Mitchell e6af51943d Add read:self and delete:self to auth tokens and add logout command (#1162) 2021-04-23 13:45:08 -04:00
Jeff Mitchell 727d1c7085 Add "no-op" action and use it as default for scope permissions (#1138)
Because of listing visibility, if no actions are assigned to a user for
an individual resource, it's excluded from the list. This is fine and
good. However, when we made a change in 0.2.0 to restrict the
information returned from listing for the anonymous user for scopes and
auth methods, it exposed the fact that because of the way this
visibility works we had to add `read` to scopes by default -- thereby
rather defeating the purpose of restricting what goes back to `u_anon`
requests.

The purpose of "no-op" is to never be used for real actions within the
API, but as something that can be granted to specifically enable
visibility for the targeted user. This makes the controls over list
visibility much more granular.
2021-04-23 10:13:37 -04:00
Jim 75108cbc8b Ongoing OIDC: return the primary account info along with the user. (#1145) 2021-04-20 20:33:56 -04:00
Jeff MitchellandSam Salisbury a90a64d787 Use Go 1.16 native embedding and remove go-bindata (#1151)
Co-authored-by: Sam Salisbury <samsalisbury@gmail.com>
2021-04-20 10:45:05 -04:00
Lars Lehtonen b02c050304 internal/servers/controller/handlers/users: fix dropped test error (#1130) 2021-04-19 16:06:17 -04:00
s-christoff 0f424f6f7f Refactor internal/servers/controller/handlers errors v2 (#1099) 2021-04-16 12:06:03 -05:00
Jeff Mitchell 7062bc70f0 Fix bug causing CORS to accept all origins by default (#1134) 2021-04-15 13:33:52 -04:00
Jeff Mitchell afe828c118 Update returned information in list responses for anon user (#1127) 2021-04-14 17:19:02 -04:00
Jeff Mitchell 604d642e1e Restrict auth method listing for u_anon (#1122)
This keeps only essential information in list output for auth methods
when the user is u_anon. Boundary's default is to allow listing of
auth methods for anonymous users to allow discovery of authentication
points, but there's no need to return more information about internal
configuration than necessary.
2021-04-14 16:49:08 -04:00
Jim e0e6e58bb2 better api error codes from OIDC auth method update/change-state operations (#1116) 2021-04-14 15:00:20 -04:00
Todd Knight fad9f6d525 Allow oidc accounts to be add|set|removed to users. (#1117) 2021-04-14 11:34:17 -07:00
Todd Knight 072b950540 Filter inactive and private oidc auth methods from unauthenticated list requests (#1110) 2021-04-13 16:42:25 -07:00
Jeff Mitchell ca57e50516 Add more OIDC error output. (#1108)
Some of this is in the form of logging, and some via returning error
messages to users.

Also cleans a couple of linter complaints.
2021-04-13 19:07:50 -04:00
Jeff Mitchell 412018fbb4 Update misleading Authenticated bool with new name and explanation. (#1111) 2021-04-13 17:55:40 -04:00
Todd Knight 14c222709c Make oidc auth callback redirect on most errors (#1105) 2021-04-13 09:21:26 -07:00
Jim d0f36f6a74 ensure that inbound auth method id matches request wrapper auth metho… (#1104) 2021-04-12 17:17:28 -04:00
Jeff Mitchell 90b30bad25 Use 202 for token polling endpoint instead of 204 (#1103) 2021-04-12 14:57:14 -04:00
Todd Knight 71673ea161 Pass disable_discovered_config_validation in the API change-state call (#1100) 2021-04-12 08:49:22 -07:00
dd0f34bc35 Add new OIDC auth method. (#1090)
Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com>
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
2021-04-08 20:54:32 -04:00
s-christoff 5c5b07c04a Revert "Refactor internal/servers/controller/handlers errors (#1070)" (#1092)
This reverts commit 21ac3cdddd.
2021-04-08 19:20:36 -05:00
s-christoff 21ac3cdddd Refactor internal/servers/controller/handlers errors (#1070) 2021-04-08 17:48:57 -05:00
Lars Lehtonen d3b72899f1 fix scopes double import (#1066) 2021-04-05 12:16:38 -04:00
Jeff Mitchell 6c48f6ea77 Use pointers for any Uber atomic values (#1044)
BK clued me into the fact that for some types, similar alignment
problems exist as with the normal atomic package (e.g. 64-bit types on
32-bit architectures) if they are not pointer values. So change the few
places they weren't pointers to pointers.

None of these are 64-bit, but it feels like best practice for using the
library and should just standardize on it.
2021-04-05 09:37:34 -04:00
Louis Ruch 93bad3cb83 400 if account already assocaited (#1048) 2021-03-30 13:00:48 -07:00