max furman
8b256f0351
address linter warning for go 1.19
2023-05-09 23:47:28 -07:00
Andrew Reed
7101fbb0ee
Provisioner webhooks ( #1001 )
2022-09-29 19:16:26 -05:00
Mariano Cano
e7d7eb1a94
Add provisioner as a signOption for SSH
2022-05-18 18:42:42 -07:00
Herman Slatman
5e9bce508d
Unexport GetPolicy()
2022-05-05 12:32:53 +02:00
Herman Slatman
c40a4d2694
Contain policy engines inside provisioner Controller
2022-04-22 01:20:38 +02:00
Herman Slatman
9797b3350e
Merge branch 'master' into herman/allow-deny
2022-04-08 16:01:56 +02:00
Herman Slatman
571b21abbc
Fix (most) PR comments
2022-03-31 16:12:29 +02:00
Herman Slatman
dc23fd23bf
Merge branch 'master' into herman/allow-deny-next
2022-03-24 12:36:12 +01:00
Mariano Cano
b401376829
Add current provisioner to AuthorizeSign SignOptions.
...
The original provisioner cannot be retrieved from a certificate
if a linked ra is used.
2022-03-21 19:21:40 -07:00
Mariano Cano
8ef8f4f665
Use the provisioner controller in Nebula renewals
2022-03-10 10:45:12 -08:00
Mariano Cano
259e95947c
Add support for the provisioner controller
...
The claimer, audiences and custom callback methods are now managed
by the provisioner controller in an uniform way.
2022-03-09 18:43:45 -08:00
Herman Slatman
7c541888ad
Refactor configuration of allow/deny on authority level
2022-03-08 13:26:07 +01:00
Herman Slatman
c3c6f3da72
Merge branch 'master' into herman/allow-deny
2022-02-22 17:36:56 +01:00
Mariano Cano
abe951d416
Fix name of the variable in comment.
2022-02-17 17:59:17 -08:00
Mariano Cano
a0cf808393
Make the X5C leaf certificate available to the templates.
...
X509 and SSH templates of the X5C provisioner will have now access
to the leaf certificate used to sign the token using the template
variable .AuthorizationCrt
Fixes #433
2022-02-17 17:53:44 -08:00
Herman Slatman
88c7b63c9d
Split SSH user and cert policy configuration and execution
2022-02-01 15:18:39 +01:00
Herman Slatman
9617edf0c2
Improve internationalized domain name handling
...
This PR improves internationalized domain name handling according
to rules of IDNA and based on the description in RFC 5280, section 7:
https://datatracker.ietf.org/doc/html/rfc5280#section-7 .
Support for internationalized URI(s), so-called IRIs, still needs to
be done.
2022-01-27 17:18:33 +01:00
Herman Slatman
512b8d6730
Refactor instantiation of policy engines
...
Instead of using the `base` struct, the x509 and SSH policy
engines are now added to each provisioner directly.
2022-01-25 16:45:25 +01:00
Herman Slatman
91d51c2b88
Add allow/deny to Nebula provisioner
2022-01-14 13:06:32 +01:00
Mariano Cano
0920224816
Fix error message.
2022-01-07 11:09:32 -08:00
Mariano Cano
449a9fdfd6
Address review comments.
2022-01-06 12:00:58 -08:00
Mariano Cano
b424aa3dc1
Add nebula header and use der version of certificate.
2022-01-06 11:19:46 -08:00
Mariano Cano
f49a4b326f
Add missing comments.
2022-01-05 10:54:09 -08:00
Mariano Cano
6600f1253e
Fix error messages after review.
2022-01-05 10:12:49 -08:00
Mariano Cano
76794ce613
Use default SANs without sans in the token.
...
Fix step claim condition in SSH
2022-01-04 12:05:58 -08:00
Mariano Cano
9ec0276887
Update certificate set with new api.
2022-01-03 18:54:01 -08:00
Mariano Cano
cb72796a2d
Fix decoding of certificate.
2021-12-29 16:07:05 -08:00
Mariano Cano
32390a2964
Add initial implementation of a nebula provisioner.
...
A nebula provisioner will generate a X509 or SSH certificate with
the identities in the nebula certificate embedded in the token.
The token is signed with the private key of the nebula certificate.
2021-12-29 14:12:03 -08:00
