CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,259 Commits 7 Branches 2 Tags
e41ffb0b28e439d25a05dfc6fccff07fbdf74a12
Commit Graph
125 Commits
Author SHA1 Message Date
Louis Ruch 466219f109 Add gostringer to client_secret (#1315) 2021-06-16 11:44:08 -07:00
Jeff Mitchell 054c0aa538 Update password generated account IDs (#1290) 2021-06-08 12:31:58 -04:00
Jeff Mitchell 4d27b58d2d Add managed groups test (#1289) 2021-06-07 20:35:45 -04:00
Jeff Mitchell b513f21153 Add test for GrantsForUser (#1287) 
* Start of test

* Add a test for existing GrantsForUser functionality.

The test has randomization built in to allocate users across groups and
both users and groups across roles. It tracks which users and groups
have been assigned to which roles, then ensures that GrantsForUser
returns the correct set of roles for a given user.

This required modifying the CTE in GrantsForUser to return role_id as
well.

This doesn't test managed groups yet, that will come in a follow-on PR.
 2021-06-07 10:19:21 -04:00
Jeff Mitchell 9ecc384007 Add managed group support to role principals (#1270) 2021-06-04 10:44:57 -04:00
Jeff Mitchell ad93315b59 Add predictable account IDs in dev mode (#1271) 2021-06-04 10:35:51 -04:00
Jeff Mitchell 5c8a8c3998 Merge remote-tracking branch 'origin/main' into ICU-1573 2021-06-03 13:39:44 -04:00
Michael Gaffney 094bdcdd2b protobuf: remove unused imports (#1267) 
This removes unused imports in the protobuf files which are reported as
warnings by the protoc compiler.
 2021-06-02 14:59:36 -04:00
Jeff Mitchell 9208d10936 Merge branch 'main' into ICU-1573 2021-06-02 14:09:02 -04:00
Jeff Mitchell 306d4fb4d3 Add API/CLI for managed groups (#1265) 2021-06-02 14:05:10 -04:00
Jeff Mitchell 179a49657e Managed Groups service (#1262) 2021-06-02 14:01:37 -04:00
Jim 6cfc1a7753 use a slice for claim maps so the order is deterministic (#1263) 2021-06-02 07:09:41 -04:00
Jeff Mitchell 6c9b9e948e Add the bits to actually read filters and assign values to users (#1261) 2021-06-01 20:15:57 -04:00
Jeff Mitchell 4363a4084e Add membership setting function (#1259) 2021-06-01 15:18:10 -04:00
Jeff Mitchell 7da892a054 Managed Groups OIDC Repo (#1254) 2021-06-01 15:12:34 -04:00
Michael Gaffney 21033a6174 Refactor: multiple rename to fix the spelling of subtype (#1227) 
The definition of 'subtype' is 'a secondary or subordinate type'. The
'T' should not be capitalized (unless it is referring to a type of
submarine, which its not).
 2021-05-17 15:36:45 -04:00
Jeff Mitchell 22d5c88a0b Add Output Fields support (#1192) 2021-05-04 20:57:35 -04:00
Jim 2437cdcc8d OIDC: add support for account claim maps (#1186) 2021-05-04 08:41:04 -04:00
Jim 8d317023f8 OIDC: make callback URL paths deterministic. (#1188) 2021-05-02 15:25:29 -04:00
Jim 25e657fa51 Ongoing OIDC: support to request additional OIDC scopes from the IdP (#1175) 2021-04-28 06:53:13 -04:00
Jim 75108cbc8b Ongoing OIDC: return the primary account info along with the user. (#1145) 2021-04-20 20:33:56 -04:00
Jim 358f5a61fb bump protoc to v3.15.8 (#1147) 2021-04-18 21:34:25 -04:00
Jeff Mitchell be10cc4b42 Update grpc/proto deps (#1136) 
* Update grpc/proto deps

* Make gen
 2021-04-15 14:11:23 -04:00
Todd Knight 072b950540 Filter inactive and private oidc auth methods from unauthenticated list requests (#1110) 2021-04-13 16:42:25 -07:00
Jeff Mitchell 412018fbb4 Update misleading Authenticated bool with new name and explanation. (#1111) 2021-04-13 17:55:40 -04:00
Todd Knight 14c222709c Make oidc auth callback redirect on most errors (#1105) 2021-04-13 09:21:26 -07:00
Jim d0f36f6a74 ensure that inbound auth method id matches request wrapper auth metho… (#1104) 2021-04-12 17:17:28 -04:00
Jim 8f9c287233 properly handle ClientSecret updates (#1097) 2021-04-09 15:33:21 -04:00
Jim 26c0c4479d send MaxAge when set for auth method (#1094) 2021-04-09 10:41:54 -04:00
JimTodd KnightJeff MitchellMichael Gaffney
 		dd0f34bc35 Add new OIDC auth method. (#1090) 
Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com>
Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>
 2021-04-08 20:54:32 -04:00
Michael Gaffney aafbada3ae Remove calls to t.Helper() from test methods (not helpers) (#1063) 2021-04-02 19:40:51 -04:00
Jeff Mitchell 3c430678ae Fix test scope errors (#1029) 
When using a disabled verifier context we were faking scope information. Due to other recent changes, this was now causing test errors. This adjusts that flow to actually query the DB, fixing tests and making them more like real code.
 2021-03-25 03:15:43 -04:00
Jeff Mitchell aa570f4e48 Honor child scope list permissions when recursing (#1016) 
Current behavior is that you need list grant on the parent scope when
recursively listing, and this is sufficient. This is good for
administrative workflows but can be unintuitive for resources that only
exist at a project level. This change allows permissions on the child
scope to also be taken into account, so that you can start a recursive
list from a parent scope without direct list support on that scope but
still get back child scopes for which list access is granted.

This also fixes a bug where visibility of a scope for recursive listing
would be based on whether the user had list resources for roles within
that scope instead of for the resource type in question.
 2021-03-24 15:33:04 -04:00
Jeff Mitchell fcbf372881 Bump proto/grpc deps (#1017) 
* Bump proto/grpc deps

* Back out buf change

* Run make gen
 2021-03-20 16:12:01 -04:00
Jeff Mitchell 68f8d7e595 Rerun make gen 2021-03-09 13:49:12 -05:00
Louis Ruch e3e96a87fa Fix error codes 2021-03-09 08:28:33 -08:00
Louis Ruch 7387cec475 Remove sentinel errors (#968) 
* Remove sentinal errors
 2021-03-05 06:34:06 -08:00
Jeff Mitchell 377d837df3 Update gen 2021-02-12 11:44:46 -05:00
s-christoff 6623be8bfb Refactor internal/auth to return domain specific errors (#905) 
* Refactor internal/auth to return domain specific errors
 2021-02-11 13:32:45 -06:00
Jeff Mitchell 1afa3a4b6c Disallow an invalid grant format (#914) 2021-02-05 12:39:55 -05:00
Jeff Mitchell 6cd97a4a6e Add support for recursive listing (#885) 2021-01-25 19:37:40 -05:00
Jeff Mitchell 6b58a3317d Add recursive listing to roles (#881) 
This also lays the framework for adding recursive listing to the rest of the resources.
 2021-01-23 13:39:04 -05:00
Jeff Mitchell dcb15cffbd Add authorized actions output on resources (#870) 2021-01-20 10:53:01 -05:00
Jeff Mitchell 27919ab11b Groundwork for returning authorized actions (#860) 
This returns authorized actions on targets to users when they perform an operation on a target, including listing. It also prevents users from seeing values in listing targets on which they have no permissions.
 2021-01-13 14:42:37 -05:00
Jeff Mitchell 84c617dc49 Run make gen after the gofumpt update 2021-01-08 10:32:02 -05:00
Michael GaffneyandJeff Mitchell 94cb79bbdd See how Boundary would look with gofumpt applied (#853) 
* See how Boundary would look with https://github.com/mvdan/gofumpt applied

Results of running `gofumpt -w -s .`

* Update tools file and Makefile for gofumpt

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>
 2021-01-07 10:02:32 -05:00
Louis Ruch bfbb179741 ICU-738/Refactor internal/db to domain errors (#815) 
* Refactor internal/db to domain errors
 2020-12-21 10:07:34 -08:00
Jeff Mitchell 8b39faef1b Rearrange some auth logic and add some opts useful for filtering/testing (#835) 2020-12-17 10:30:40 -05:00
Jeff Mitchell 11b821a200 Bump deps (#818) 2020-12-15 14:56:41 -05:00
Louis Ruch d8f8d60418 Allow dash in account name (#806) 
* Allow dash in account name
 2020-12-02 09:56:19 -08:00