CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,162 Commits 7 Branches 2 Tags
a87fe5f803e2b28fa008158d8a080aa3fe65184e
Commit Graph
110 Commits
Author SHA1 Message Date
Michael Gaffney 21033a6174 Refactor: multiple rename to fix the spelling of subtype (#1227) 
The definition of 'subtype' is 'a secondary or subordinate type'. The
'T' should not be capitalized (unless it is referring to a type of
submarine, which its not).
 2021-05-17 15:36:45 -04:00
Jeff Mitchell 22d5c88a0b Add Output Fields support (#1192) 2021-05-04 20:57:35 -04:00
Jim 2437cdcc8d OIDC: add support for account claim maps (#1186) 2021-05-04 08:41:04 -04:00
Jim 8d317023f8 OIDC: make callback URL paths deterministic. (#1188) 2021-05-02 15:25:29 -04:00
Jim 25e657fa51 Ongoing OIDC: support to request additional OIDC scopes from the IdP (#1175) 2021-04-28 06:53:13 -04:00
Jim 75108cbc8b Ongoing OIDC: return the primary account info along with the user. (#1145) 2021-04-20 20:33:56 -04:00
Jim 358f5a61fb bump protoc to v3.15.8 (#1147) 2021-04-18 21:34:25 -04:00
Jeff Mitchell be10cc4b42 Update grpc/proto deps (#1136) 
* Update grpc/proto deps

* Make gen
 2021-04-15 14:11:23 -04:00
Todd Knight 072b950540 Filter inactive and private oidc auth methods from unauthenticated list requests (#1110) 2021-04-13 16:42:25 -07:00
Jeff Mitchell 412018fbb4 Update misleading Authenticated bool with new name and explanation. (#1111) 2021-04-13 17:55:40 -04:00
Todd Knight 14c222709c Make oidc auth callback redirect on most errors (#1105) 2021-04-13 09:21:26 -07:00
Jim d0f36f6a74 ensure that inbound auth method id matches request wrapper auth metho… (#1104) 2021-04-12 17:17:28 -04:00
Jim 8f9c287233 properly handle ClientSecret updates (#1097) 2021-04-09 15:33:21 -04:00
Jim 26c0c4479d send MaxAge when set for auth method (#1094) 2021-04-09 10:41:54 -04:00
JimTodd KnightJeff MitchellMichael Gaffney
 		dd0f34bc35 Add new OIDC auth method. (#1090) 
Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com>
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
 2021-04-08 20:54:32 -04:00
Michael Gaffney aafbada3ae Remove calls to t.Helper() from test methods (not helpers) (#1063) 2021-04-02 19:40:51 -04:00
Jeff Mitchell 3c430678ae Fix test scope errors (#1029) 
When using a disabled verifier context we were faking scope information. Due to other recent changes, this was now causing test errors. This adjusts that flow to actually query the DB, fixing tests and making them more like real code.
 2021-03-25 03:15:43 -04:00
Jeff Mitchell aa570f4e48 Honor child scope list permissions when recursing (#1016) 
Current behavior is that you need list grant on the parent scope when
recursively listing, and this is sufficient. This is good for
administrative workflows but can be unintuitive for resources that only
exist at a project level. This change allows permissions on the child
scope to also be taken into account, so that you can start a recursive
list from a parent scope without direct list support on that scope but
still get back child scopes for which list access is granted.

This also fixes a bug where visibility of a scope for recursive listing
would be based on whether the user had list resources for roles within
that scope instead of for the resource type in question.
 2021-03-24 15:33:04 -04:00
Jeff Mitchell fcbf372881 Bump proto/grpc deps (#1017) 
* Bump proto/grpc deps

* Back out buf change

* Run make gen
 2021-03-20 16:12:01 -04:00
Jeff Mitchell 68f8d7e595 Rerun make gen 2021-03-09 13:49:12 -05:00
Louis Ruch e3e96a87fa Fix error codes 2021-03-09 08:28:33 -08:00
Louis Ruch 7387cec475 Remove sentinel errors (#968) 
* Remove sentinal errors
 2021-03-05 06:34:06 -08:00
Jeff Mitchell 377d837df3 Update gen 2021-02-12 11:44:46 -05:00
s-christoff 6623be8bfb Refactor internal/auth to return domain specific errors (#905) 
* Refactor internal/auth to return domain specific errors
 2021-02-11 13:32:45 -06:00
Jeff Mitchell 1afa3a4b6c Disallow an invalid grant format (#914) 2021-02-05 12:39:55 -05:00
Jeff Mitchell 6cd97a4a6e Add support for recursive listing (#885) 2021-01-25 19:37:40 -05:00
Jeff Mitchell 6b58a3317d Add recursive listing to roles (#881) 
This also lays the framework for adding recursive listing to the rest of the resources.
 2021-01-23 13:39:04 -05:00
Jeff Mitchell dcb15cffbd Add authorized actions output on resources (#870) 2021-01-20 10:53:01 -05:00
Jeff Mitchell 27919ab11b Groundwork for returning authorized actions (#860) 
This returns authorized actions on targets to users when they perform an operation on a target, including listing. It also prevents users from seeing values in listing targets on which they have no permissions.
 2021-01-13 14:42:37 -05:00
Jeff Mitchell 84c617dc49 Run make gen after the gofumpt update 2021-01-08 10:32:02 -05:00
Michael GaffneyandJeff Mitchell 94cb79bbdd See how Boundary would look with gofumpt applied (#853) 
* See how Boundary would look with https://github.com/mvdan/gofumpt applied

Results of running `gofumpt -w -s .`

* Update tools file and Makefile for gofumpt

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2021-01-07 10:02:32 -05:00
Louis Ruch bfbb179741 ICU-738/Refactor internal/db to domain errors (#815) 
* Refactor internal/db to domain errors
 2020-12-21 10:07:34 -08:00
Jeff Mitchell 8b39faef1b Rearrange some auth logic and add some opts useful for filtering/testing (#835) 2020-12-17 10:30:40 -05:00
Jeff Mitchell 11b821a200 Bump deps (#818) 2020-12-15 14:56:41 -05:00
Louis Ruch d8f8d60418 Allow dash in account name (#806) 
* Allow dash in account name
 2020-12-02 09:56:19 -08:00
Jim af6ef1b687 Refactor existing sentinel errors (#774) 2020-11-05 16:54:03 -05:00
Jeff Mitchell 813d21565f Allow authorize-session to be invoked with target name (#737) 2020-10-22 08:40:00 -04:00
Jeff Mitchell 1acd690299 Clear account ID if token does not map to a user 
It's possible there are acceptable use cases for still matching account
ID if the account no longer maps to a user, but it's equally possible
that this can cause confusion. Removing it seems safer.
 2020-10-12 10:15:38 -04:00
Jeff Mitchell 9237d6f787 Rename authorize to authorize-session (#531) 
As pointed out by Rob, this makes it clearer what the action actually
is. We were sort of torn on it before, but I've definitely come around
to it.
 2020-10-05 11:02:23 -04:00
Jeff Mitchell fa700dc002 Add account ID templating (#518) 
* Remove default role and create via the same mechanism as other initial resources
 2020-10-01 10:51:54 -04:00
Jeff Mitchell 6ddfe407a3 Update allowed formats of ACL strings (#508) 2020-10-01 01:49:20 -04:00
Jim 1e71c55920 deprecate access to underlying *sql.DB via internal/db.DB() (#506) 2020-09-30 18:11:59 -04:00
Jeff Mitchell a38f40606e Create default roles in scopes to allow authentication and listing scopes/auth methods (#502) 2020-09-29 20:38:16 -04:00
Jeff Mitchell cf3fa4522d Swap base58 libraries (#472) 
* Swap base58 libraries

This doesn't reduce binary size but it removes a metric ton of
dependencies.
 2020-09-26 14:01:49 -04:00
Jeff Mitchell c30fd5620e Add account add/set/remove to CLI (#473) 2020-09-26 13:58:48 -04:00
Jeff Mitchell 8d8a7358f8 Add AdditionalVerification function (#423) 2020-09-23 23:39:44 -04:00
Todd Knight 2f8d7f0a32 API Errors: Hide and log internal errors (#411) 2020-09-23 08:10:27 -07:00
Jeff Mitchell 38ce9d9eac Combine controller and worker commands (#415) 2020-09-23 01:23:10 -04:00
Jeff Mitchell 9b2646eaf9 Fix retry behavior with KMS recovery and misleading error message (#391) 2020-09-21 11:05:44 -04:00
Jeff MitchellandJim Lambert 62baef1b7e Add multi connection parameters through targets and into session creation (#375) 
* Update protos and gen

* Add new values to targets CLI command

* Lots more plumbing of new parameters through everything

* allow fields to be set to zero value.

* Disallow set but empty name/description strings in create/update verifiers

Co-authored-by: Jim Lambert <jlambert@hashicorp.com>
 2020-09-19 10:31:49 -04:00