mbiryukova/certificates
1
0
Fork 0
forked from TrueCloudLab/certificates
Code Pull requests Activity
1246 commits 33 branches 197 tags 41 MiB
Commit graph

220 commits

Author SHA1 Message Date
Mariano Cano
cf2989a848 Add token and subject to K8sSA provisioner to be used in custom 
templates.
 2020-07-21 14:18:06 -07:00
Mariano Cano
71be83b25e Add iss#sub uri in OIDC certificates. 
Admin will use the CR template if none is provided.
 2020-07-21 14:18:06 -07:00
Mariano Cano
c58117b30d Allow to use base64 when defining a template in the ca.json. 2020-07-21 14:18:06 -07:00
Mariano Cano
b2ca3176f5 Prepend insecure to user and CR variables names. 2020-07-21 14:18:06 -07:00
Mariano Cano
b11486f41f Fix option method for template variable. 2020-07-21 14:18:06 -07:00
Mariano Cano
04f5053a7a Add template support for x5c. 2020-07-21 14:18:06 -07:00
Mariano Cano
eb8886d828 Add CR subject as iid default subject. 
Add a minimal subject with just a common name to iid provisioners
in case we want to use it.
 2020-07-21 14:18:06 -07:00
Mariano Cano
e60ea419cc Add template support for gcp provisioner. 2020-07-21 14:18:06 -07:00
Mariano Cano
32646c49bf Add templates support to Azure provisioner. 2020-07-21 14:18:06 -07:00
Mariano Cano
a44f0ca866 Add token payload. 2020-07-21 14:18:06 -07:00
Mariano Cano
00fd41a3d0 Add template support to K8sSA provisioners. 2020-07-21 14:18:06 -07:00
Mariano Cano
13b704aeed Add template support for AWS provisioner. 2020-07-21 14:18:05 -07:00
Mariano Cano
49b9aa6e3f Fix log string. 2020-07-21 14:18:05 -07:00
Mariano Cano
4795e371bd Add back the support for ca.json DN template. 2020-07-21 14:18:05 -07:00
Mariano Cano
e6fed5e0aa Minor fixes and comments. 2020-07-21 14:18:05 -07:00
Mariano Cano
81cd288104 Enable templates in acme provisioners. 2020-07-21 14:18:05 -07:00
Mariano Cano
ca2fb42d68 Move options to the provisioner. 2020-07-21 14:18:05 -07:00
Mariano Cano
206bc6757a Add initial support for templates in the OIDC provisioner. 2020-07-21 14:18:05 -07:00
Mariano Cano
95c3a41bf0 Rename UserData to TemplateData and fix unmarshaling. 2020-07-21 14:18:04 -07:00
Mariano Cano
9f3acc254b Set the token payload in the JWK provisioner. 2020-07-21 14:18:04 -07:00
Mariano Cano
ef0ed0ff95 Integrate simple templates in the JWK provisioner. 2020-07-21 14:18:04 -07:00
Mariano Cano
9032018cf2 Convert x509util.WithOptions to new modifiers. 2020-07-21 14:18:04 -07:00
Carl Tashian
912e298043 Whitelist -> Allowlist per https://tools.ietf.org/id/draft-knodel-terminology-01.html 2020-07-20 15:42:47 -07:00
max furman
accf1be7e9 wip 2020-06-25 14:02:24 -07:00
max furman
71d87b4e61 wip 2020-06-24 23:25:15 -07:00
max furman
d25e7f64c2 wip 2020-06-24 09:58:40 -07:00
max furman
3636ba3228 wip 2020-06-23 17:13:39 -07:00
max furman
1951669e13 wip 2020-06-23 11:10:45 -07:00
max furman
7d5cf34ce5 Update profileLimitDuration validator ... 
- respect notBefore of the provisioner
- modify/fix the reported errors
 2020-06-16 12:16:43 -07:00
Mariano Cano
4ac51dd508
Merge pull request #274 from smallstep/oidc-raw-locals 
Allow dots and other symbols in principals for OIDC
 2020-05-26 11:28:30 -07:00
Mariano Cano
3246a3e81f Add missing test case. 2020-05-26 10:22:15 -07:00
max furman
6e69f99310 Always set nbf and naf for new ACME orders ... 
- Use the default value from the ACME provisioner if values are not
defined in the request.
 2020-05-22 10:31:58 -07:00
Mariano Cano
0b5fd156e8 Add a third principal on OIDC tokens with the raw local part of the email. 
For the email first.last@example.com it will create the principals
  ["firstlast", "first.last", "first.last@example.com"]

Fixes #253, #254
 2020-05-21 12:09:11 -07:00
Oleksandr Kovalchuk
4cd01b6868
Implement tests for forceCNOption modifier 
Implement unit tests which checks forceCNOption modifier (implemented
in 322200b7db) is not broken and works
correctly.

Ref: https://github.com/smallstep/certificates/issues/259
 2020-05-17 20:29:28 +03:00
Oleksandr Kovalchuk
893a53793a
Modify existing tests to accept forceCNOption modifier 
Modify existing tests to pass with changes introduced in commit
322200b7db. This is safe to do as
tests assert exact length of modifiers, which has changed.
 2020-05-17 20:27:09 +03:00
Oleksandr Kovalchuk
322200b7db
Implement modifier to set CommonName 
Implement modifier which sets CommonName to the certificate if
CommonName is empty and forceCN is set in the config. Replace previous
implementation introduced in 0218018cee
with new modifier.

Closes https://github.com/smallstep/certificates/issues/259
Ref: https://github.com/smallstep/certificates/pull/260#issuecomment-628961322
 2020-05-17 20:23:13 +03:00
Oleksandr Kovalchuk
503c9f6101
Add config option to force CN 
Add configuration option `forceCN` to ACME provisioner. When this option
is set to `true`, provisioner should generate Subject.CommonName for
certificate if it was not present in the request. Default value of
`false` should keep the existing behavior (do not modify CSR and
certificate).

Ref: https://github.com/smallstep/certificates/issues/259
 2020-05-14 13:20:55 +03:00
Mariano Cano
4e9bff0986 Add support for OIDC multitoken tenants for azure. 2020-04-24 14:36:32 -07:00
Mariano Cano
a2dfa6faa8 Fix unit tests. 2020-04-20 12:29:23 -07:00
Mariano Cano
13507efb35 Remove the requirement for CSR to have a common name. 
Fixes #226
 2020-04-20 10:43:33 -07:00
Mariano Cano
bfe1f4952d Rename interface to CertificateEnforcer and add tests. 2020-03-31 11:41:36 -07:00
Mariano Cano
64f26c0f40 Enforce a duration for identity certificates. 2020-03-30 17:33:04 -07:00
Mariano Cano
fa416336a8 Add context to tests. 2020-03-10 19:17:32 -07:00
Mariano Cano
c49a9d5e33 Add context parameter to all SSH methods. 2020-03-10 19:01:45 -07:00
Mariano Cano
f868e07a76 Allow to use custom principals on cloud provisioners. 
Fixes #203
 2020-03-05 14:33:42 -08:00
Mariano Cano
59fc8cdd2d Fix typo in comments. 2020-02-27 10:48:16 -08:00
max furman
397a181d10 Add backdate validation to sshCertValidityValidator. 2020-01-28 13:29:40 -08:00
max furman
1cb8bb3ae1 Simplify statuscoder error generators. 2020-01-28 13:29:40 -08:00
max furman
dccbdf3a90 Introduce generalized statusCoder errors and loads of ssh unit tests. 
* StatusCoder api errors that have friendly user messages.
* Unit tests for SSH sign/renew/rekey/revoke across all provisioners.
 2020-01-28 13:29:40 -08:00
Mariano Cano
895d3054a3 Remove the use of custom x509 package. 
Upgrade cli dependency.
 2020-01-28 13:29:39 -08:00