36 commits

Author	SHA1	Message	Date
Carl Tashian	912e298043	Whitelist -> Allowlist per https://tools.ietf.org/id/draft-knodel-terminology-01.html	2020-07-20 15:42:47 -07:00
Mariano Cano	4e9bff0986	Add support for OIDC multitoken tenants for azure.	2020-04-24 14:36:32 -07:00
Mariano Cano	c49a9d5e33	Add context parameter to all SSH methods.	2020-03-10 19:01:45 -07:00
max furman	1cb8bb3ae1	Simplify statuscoder error generators.	2020-01-28 13:29:40 -08:00
max furman	dccbdf3a90	Introduce generalized statusCoder errors and loads of ssh unit tests. ... * StatusCoder api errors that have friendly user messages. * Unit tests for SSH sign/renew/rekey/revoke across all provisioners.	2020-01-28 13:29:40 -08:00
Mariano Cano	84ff172093	Add support for backdate to SSH certificates.	2020-01-28 13:29:39 -08:00
max furman	414a94b210	Instrument getIdentity func for OIDC ssh provisioner	2020-01-28 13:28:16 -08:00
max furman	54e3cf7322	Add multiuse capability to k8ssa provisioners	2020-01-28 13:28:16 -08:00
max furman	29853ae016	sshpop provisioner + ssh renew | revoke | rekey first pass	2020-01-28 13:28:16 -08:00
max furman	d368791606	Add x5c provisioner capabilities	2019-10-14 14:51:37 -07:00
Mariano Cano	6c4abfabbb	Make /.well-known/openid-configuration optional	2019-09-18 15:54:10 -07:00
Mariano Cano	3527ee6940	Add support for listenAddress parameter if OIDC provisioners. ... Fixes smallstep/cli#150	2019-09-18 15:25:28 -07:00
Mariano Cano	396b4222aa	Implement validator for ssh keys. ... Fixes #100	2019-09-10 17:04:13 -07:00
Mariano Cano	10e7b81b9f	Merge branch 'master' into ssh-ca	2019-09-05 23:06:01 +02:00
max furman	2b41faa9cf	Enforce >= 2048 bit rsa keys at the provisioner layer ... * Fixes #94 * In the future this should be configurable by provisioner	2019-08-27 14:44:59 -07:00
Mariano Cano	57a529cc1a	Allow to enable the SSH CA per provisioner	2019-08-05 11:40:27 -07:00
Mariano Cano	a8f4ad1b8e	Set default SSH options if no user options are given.	2019-07-31 17:03:33 -07:00
Mariano Cano	41b97372e6	Rename function to SanitizeSSHUserPrincipal	2019-07-29 16:38:57 -07:00
Mariano Cano	53f62f871c	Set not extensions to host certificates.	2019-07-29 16:36:46 -07:00
Mariano Cano	48c98dea2a	Make SanitizeSSHPrincipal a public function.	2019-07-29 16:21:22 -07:00
Mariano Cano	f01286bb48	Add support for SSH certificates to OIDC. ... Update the interface for all the provisioners.	2019-07-29 15:54:07 -07:00
Matteo Saloni	1919cfdff3	Add option for checking group membership declared in JWT token	2019-06-25 10:50:55 +02:00
max furman	ab4d569f36	Add /revoke API with interface db backend	2019-04-10 13:50:35 -07:00
Mariano Cano	7378ed27ac	Refactor claims so they can be totally omitted if only the parent is set.	2019-03-19 15:10:52 -07:00
Mariano Cano	5d5f03f963	Set omitempty to admins and domains.	2019-03-19 11:23:18 -07:00
Mariano Cano	60880d1f0a	Add domains and check emails properly.	2019-03-15 13:49:50 -07:00
Mariano Cano	5edbce017f	Set docs for client secret as mandatory, but it can be blank.	2019-03-15 11:10:52 -07:00
Mariano Cano	2c0c0112c6	Add an optional client secret field.	2019-03-14 18:00:11 -07:00
Mariano Cano	0b4cde1ad3	Move type to the first position of the struct.	2019-03-13 15:33:52 -07:00
Mariano Cano	4ceb88fbae	Add tests for OIDC and complete some JWK tests.	2019-03-11 12:48:46 -07:00
Mariano Cano	dce3100cfb	Add missing time in validation.	2019-03-11 11:12:47 -07:00
Mariano Cano	a97ea87caa	Move options to provisioner so we can set the duration of the cert.	2019-03-07 15:14:18 -08:00
Mariano Cano	2d00cd0933	Validate audiences in the default provisioner.	2019-03-06 18:32:56 -08:00
Mariano Cano	6d395f3818	Add missing validy validator to oidc.	2019-03-06 17:30:14 -08:00
Mariano Cano	0dee841a4f	Complete first version of provisioner implementations.	2019-03-06 14:54:56 -08:00
Mariano Cano	a2a45f635b	Add initial implementation of an OIDC provisioner.	2019-03-04 17:58:20 -08:00