CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
811 Commits 7 Branches 2 Tags
d30dd0ff644e5c5e73fff8dc96e42e4ee0f5c8cd
Commit Graph
75 Commits
Author SHA1 Message Date
Jim af6ef1b687 Refactor existing sentinel errors (#774) 2020-11-05 16:54:03 -05:00
Jeff Mitchell 813d21565f Allow authorize-session to be invoked with target name (#737) 2020-10-22 08:40:00 -04:00
Jeff Mitchell 1acd690299 Clear account ID if token does not map to a user 
It's possible there are acceptable use cases for still matching account
ID if the account no longer maps to a user, but it's equally possible
that this can cause confusion. Removing it seems safer.
 2020-10-12 10:15:38 -04:00
Jeff Mitchell 9237d6f787 Rename authorize to authorize-session (#531) 
As pointed out by Rob, this makes it clearer what the action actually
is. We were sort of torn on it before, but I've definitely come around
to it.
 2020-10-05 11:02:23 -04:00
Jeff Mitchell fa700dc002 Add account ID templating (#518) 
* Remove default role and create via the same mechanism as other initial resources
 2020-10-01 10:51:54 -04:00
Jeff Mitchell 6ddfe407a3 Update allowed formats of ACL strings (#508) 2020-10-01 01:49:20 -04:00
Jim 1e71c55920 deprecate access to underlying *sql.DB via internal/db.DB() (#506) 2020-09-30 18:11:59 -04:00
Jeff Mitchell a38f40606e Create default roles in scopes to allow authentication and listing scopes/auth methods (#502) 2020-09-29 20:38:16 -04:00
Jeff Mitchell cf3fa4522d Swap base58 libraries (#472) 
* Swap base58 libraries

This doesn't reduce binary size but it removes a metric ton of
dependencies.
 2020-09-26 14:01:49 -04:00
Jeff Mitchell c30fd5620e Add account add/set/remove to CLI (#473) 2020-09-26 13:58:48 -04:00
Jeff Mitchell 8d8a7358f8 Add AdditionalVerification function (#423) 2020-09-23 23:39:44 -04:00
Todd Knight 2f8d7f0a32 API Errors: Hide and log internal errors (#411) 2020-09-23 08:10:27 -07:00
Jeff Mitchell 38ce9d9eac Combine controller and worker commands (#415) 2020-09-23 01:23:10 -04:00
Jeff Mitchell 9b2646eaf9 Fix retry behavior with KMS recovery and misleading error message (#391) 2020-09-21 11:05:44 -04:00
Jeff MitchellandJim Lambert 62baef1b7e Add multi connection parameters through targets and into session creation (#375) 
* Update protos and gen

* Add new values to targets CLI command

* Lots more plumbing of new parameters through everything

* allow fields to be set to zero value.

* Disallow set but empty name/description strings in create/update verifiers

Co-authored-by: Jim Lambert <jlambert@hashicorp.com>
 2020-09-19 10:31:49 -04:00
Jeff Mitchell 07a7e9750a Tie together the database-driven session handling with the worker and add relevant CLI comands (#370) 2020-09-19 00:18:17 -04:00
Jeff Mitchell 0a44ed3edd Fix global scope lookup (#367) 
The changed auth logic + verify logic in the scope handler pass the
parent ID for validation, which is correct, as a scope lives in its
parent ID. However, the global scope has no parent, and the changes
resulted in an empty ID being passed in rather than the global scope
itself. This fixes that lookup.
 2020-09-16 11:15:42 -04:00
Jeff Mitchell 6201357902 Use scope-specific token DEKs (#342) 2020-09-14 12:30:11 -04:00
Jeff Mitchell f8237fb945 Move some packages into SDK, out of internal 2020-09-09 01:24:25 -04:00
Jeff Mitchell f94f21fd97 Update API codes (#336) 2020-09-08 23:57:26 -04:00
Todd Knight c3ecea172d Generate new version of SDK resources and Add Tests (#331) 2020-09-08 16:27:51 -04:00
Todd Knight 1c2c078e0a Adding Authz checks that support new pathing (#328) 2020-09-04 14:48:11 -07:00
Jeff Mitchell c4522aa813 Update host sets and auth system to new paradigm (#319) 2020-09-01 12:31:54 -04:00
Todd Knight 0aba6db720 Enable Split Cookies (#318) 2020-09-01 09:23:41 -07:00
Jeff Mitchell 274afa6b02 Shave off an IAM lookup if the user is the anonymous user (#305) 
* Shave off an IAM lookup if the user is the anonymous user

* Fix build

* If authz failures are turned off, make the token type unknown instead of invalid

* Change returned token format when authz failures are disabled

* Change logic back

* Fix logic
 2020-08-26 23:28:38 -04:00
Michael Gaffney de162c5533 Replace and remove ErrNilParameter with ErrInvalidParameter (#295) 2020-08-25 12:18:14 -04:00
Jeff Mitchell 8f579c75c3 paum -> ampw (#303) 2020-08-25 00:21:08 -04:00
Jeff Mitchell 74544f6324 Encrypt tokens on the way out and decrypt on the way in (#302) 
* Encrypt tokens on the way out and decrypt on the way in

This isn't a security feature related to tokens specifically; it's so
that we can discard cryptographically bad tokens before we ever hit the
DB. This way we can't pass through a DDoS to the database due to
fetching obviously invalid token values.

I'm using base58 to encode the resulting value as there aren't great
base62 options, and allowing base64 / and + values can hamper usability
by creating copying/highlighting breaks.
 2020-08-25 00:20:50 -04:00
Jeff Mitchell ac4d9fa311 Add nonce storage and replay prevention test (#293) 2020-08-24 13:22:10 -04:00
Jeff Mitchell b47cca0329 Add (non-db aspects of) the recovery key workflow (#286) 2020-08-20 13:34:03 -04:00
Jim 9570897032 basic keys mgmt repo (#264) 2020-08-19 16:47:18 -04:00
Todd Knight eaae887bbe Don't require type for children of subtyped resources. (#285) 2020-08-19 10:51:15 -07:00
Todd Knight 1deea8aa3a Fixing missed documentation fix from PR 267. 2020-08-17 10:07:56 -07:00
Todd Knight e14f968fc3 Account (Set|Change)Passsword (#267) 2020-08-17 09:37:15 -07:00
Jeff Mitchell 7b36571788 Change auth validity feedback (#273) 
* Change auth validity feedback

Move from a bool indicating validity to lack of an error. This allows
the error to be directly returned and typed.

* Fix erroneous line
 2020-08-16 00:42:36 -04:00
Todd Knight 23b437894a Masks can now update attribute fields. (#271) 2020-08-14 14:08:12 -07:00
Jeff Mitchell bb6b189513 Create a default role on new scope creation (#265) 2020-08-13 17:39:48 -04:00
Todd Knight 245c7fbb44 Add Account Update handler (#257) 
* Allow updating accounts (not username or pw).

* Updating new field names to LoginName.

* Adding creation with password test.

* Fixing documentation for WithLoginName
 2020-08-12 08:20:35 -07:00
Jeff Mitchell 73a38b1433 Remove some unneeded resource types and fix the resource typing for default role in global scope (#256) 2020-08-12 00:02:26 -04:00
Jeff Mitchell 4cfab04307 Migrate user name to login name (#255) 2020-08-11 17:25:00 -04:00
Jeff Mitchell 61378381c6 Add version to account update (#252) 2020-08-11 12:28:11 -04:00
Jeff Mitchell 565059ed63 Add versioning to auth methods and accounts (#249) 2020-08-11 11:19:29 -04:00
Michael GaffneyandJeff Mitchell a7c467bd68 Password - UpdateAccount and SetPassword (#248) 
* Implement UpdateAccount

* Implement SetPassword

* Add tests for duplicate user names

* Fix imports broken after product rename

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2020-08-11 10:12:36 -04:00
Jeff Mitchell 6661117d4c The name. The name. The name! 2020-08-10 17:15:02 -04:00
Jim 1c836c430b support for associating/disassociating an auth account with a user (#233) 2020-08-10 15:17:15 -04:00
Michael Gaffney bdb31cf8b5 Bump deps (#245) 2020-08-08 10:49:43 -04:00
Jeff Mitchell 6a21e8dedb Fix some speling and a test 2020-08-07 21:14:07 -04:00
Jeff Mitchell df4730b1a0 Minor fixes and first API test changeover (#243) 2020-08-07 15:01:18 -04:00
Jeff Mitchell 5bf307797b Fix typo and also set default min user name length to 3 because jeff, jim, todd, mike 2020-08-07 13:38:44 -04:00
Todd Knight f84991c0f1 Use authenticate and Auth Method repo functions (#242) 2020-08-07 10:18:40 -07:00