Commit Graph

1796 Commits

Author SHA1 Message Date
Leandro Lafin 30751c7512
Update stale bot to v8 2024-07-11 13:44:33 -03:00
Leandro Lafin 03e49ae19a
Issue 2016: CVE-2022-41717: DoS in Go net/http may lead to DoS 2024-07-11 13:43:53 -03:00
Leandro Lafin b92604d224
Update golang.org/x/net to v0.7.0 ato address GHSA-vvpx-j8f3-3w6h 2024-07-11 13:36:46 -03:00
Leandro Lafin f8345d2986
Add documentation for --redis-insecure-skip-tls-verify flag 2024-07-11 13:35:16 -03:00
Leandro Lafin bc02aed6e8
Log the difference between invalid email and not authorized session 2024-07-11 13:34:39 -03:00
Leandro Lafin df0c641de9
Added documentation for the keycloak-oidc provider and the new Keycloak admin console 2024-07-11 13:32:39 -03:00
Leandro Lafin 3e21a6a203
Ensure sign-in page background is uniform throughout the page 2024-07-11 13:30:23 -03:00
Leandro Lafin 81b756a5d7
Issue 1929: Oauth2-proxy v7.4.0 is not using alpine:3.16 as it is 2024-07-11 13:29:30 -03:00
Leandro Lafin a8ad42e1e8
Fix a typo in oauthproxy.go 2024-07-11 11:19:45 -03:00
Leandro Lafin 596f4aaf26
fix typo in comment for oidc/provider.go 2024-07-11 11:19:02 -03:00
Leandro Lafin 1175b65ab5
Issue 1878: Validate URL call does not correctly honor already set URL 2024-07-11 11:15:41 -03:00
Leandro Lafin 734b1483d2
Update formatting error in overview for custom-sign-in-logo 2024-07-11 11:12:50 -03:00
Leandro Lafin 4d0303eef8
Fill empty UserIDClaim before assigning it to other values 2024-07-11 11:11:50 -03:00
Leandro Lafin 0c20afa6a3
Chnages checkout version to v3 2024-07-11 11:07:04 -03:00
Leandro Lafin 5e0b2d6f8a
feat: readiness check 2024-07-11 11:03:33 -03:00
Leandro Lafin e33bb5e8b0
Fix default scope settings for none oidc providers like GitHub 2024-07-10 18:02:50 -03:00
Leandro Lafin 8693c9a53b
Remove unsupported special characters from the code verifier runes 2024-07-10 17:58:34 -03:00
Leandro Lafin a4221a337d
Fix PKCE code verifier generation to never use UTF-8 characters 2024-07-10 17:57:26 -03:00
Leandro Lafin 05b688e088
Fix uninitialized user claim 2024-07-10 17:41:52 -03:00
Leandro Lafin be68c55542
Set correct platform type for arm v8 docker images 2024-07-10 17:38:17 -03:00
Leandro Lafin fc89630760
Protect htpasswd user list from race condition 2024-07-10 17:35:41 -03:00
Eduardo Vozniak 8f7537a6e9
add HSP IAM audit capabilities (#52)
<!--- Provide a general summary of your changes in the Title above -->

## Description

Add HSDP IAM audit capabilities to oauth2 proxy

## Motivation and Context

HSDP IAM does not provide important audit capabilities out of the box
such as successful login and some key auth errors.

## How Has This Been Tested?

Tested locally with:

```sh
export OAUTH2_PROXY_ENABLE_AUDIT='true'
export OAUTH2_PROXY_AUDIT_URL='url'
export OAUTH2_PROXY_AUDIT_PRODUCT_NAME='Reporting'
export OAUTH2_PROXY_AUDIT_PRODUCT_KEY='product key'
export OAUTH2_PROXY_AUDIT_SHARED_KEY='shared key'
export OAUTH2_PROXY_AUDIT_SECRET_KEY='secret'
```

## Checklist:

<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->

- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.
2024-07-03 10:11:30 -03:00
Erikson Bahr ab969ac2bd
fix valueset and improve error handling 2024-07-03 09:34:44 -03:00
Erikson Bahr a00969ab06
fix lint 2024-07-01 15:28:38 -03:00
Erikson Bahr 8e832221bb
no longer break pipeline if cookie refresher fail 2024-07-01 15:22:04 -03:00
Erikson Bahr ce668ef7f6
add HSP IAM audit capabilities 2024-07-01 15:21:22 -03:00
Eduardo Vozniak f7de8bbb22
use introspect url from discovery (#51)
<!--- Provide a general summary of your changes in the Title above -->

## Description

<!--- Describe your changes in detail -->

## Motivation and Context

<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## How Has This Been Tested?

<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran
to -->
<!--- see how your change affects other areas of the code, etc. -->

## Checklist:

<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->

- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.
2024-04-23 12:48:03 -03:00
Erikson Bahr 0ee3758b01
use introspect url from discovery 2024-04-23 12:43:42 -03:00
Eduardo Vozniak 0bf401c2d1
allow setting arbitrary cookie refresh url (#50)
<!--- Provide a general summary of your changes in the Title above -->

## Description

<!--- Describe your changes in detail -->

Allow setting arbitrary URLs for oauth2 proxy cookie refresh mechanism.
#49

## Motivation and Context

<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## How Has This Been Tested?

<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran
to -->
<!--- see how your change affects other areas of the code, etc. -->

## Checklist:

<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->

- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.
2024-02-02 09:45:08 -03:00
Erikson Bahr 946f277f47
pass legacy url to actual one 2024-02-02 08:57:07 -03:00
Erikson Bahr 153743e952
update docs 2024-02-02 08:46:24 -03:00
Erikson Bahr 23cf172dd6
allow setting arbitrary cookie refresh url 2024-02-02 08:42:37 -03:00
Leandro Lafin 5de6ce45d0
SSO - Refresh hsdpamcookie to allow signle sign on between other Philips products (#49)
<!--- Provide a general summary of your changes in the Title above -->

## Description

Users with different tabs, applications etc will now have their cookie
refreshed so when they open other tabs that have other applications,
these applications will now be authenticated.

Example: I'm doing logging for 1 hour, when I open reporting, hsp
reporting will ask for login due to expired cookie. Now this is no
longer happer


https://www.hsdp.io/documentation/identity-and-access-management-iam/api-documents/resource-reference-api/oauth2-api#/Session%20Refresh/refreshSessionUsingGET

New settings introduced:

`OAUTH2_PROXY_OIDC_ENABLE_COOKIE_REFRESH` default false
`OAUTH2_PROXY_OIDC_COOKIE_REFRESH_NAME` default 'hsdpamcookie'

## Motivation and Context

<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## How Has This Been Tested?

<!--- Please describe in detail how you tested your changes. -->
<!--- Include details of your testing environment, and the tests you ran
to -->
<!--- see how your change affects other areas of the code, etc. -->

Tested locally

## Checklist:

<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->

- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.
2024-02-01 14:26:15 -03:00
Erikson Bahr e09053e3c3
fix unit tests 2024-02-01 13:59:16 -03:00
Erikson Bahr d6734336dc
remove deadcode 2024-02-01 13:38:54 -03:00
Erikson Bahr 4b00a44fcf
fix unit tests 2024-02-01 11:55:09 -03:00
Erikson Bahr 71512442de
fix unit tests 2024-02-01 11:26:05 -03:00
Erikson Bahr e18e301a86
add local-debug-build to make 2024-02-01 11:19:47 -03:00
Erikson Bahr 7ca98f24c8
fix unit tests 2024-02-01 11:15:02 -03:00
Erikson Bahr 1140950b9c
update docs 2024-02-01 11:00:15 -03:00
Erikson Bahr df015b5123
add 'OAUTH2_PROXY_OIDC_ENABLE_COOKIE_REFRESH' and 'OAUTH2_PROXY_OIDC_COOKIE_REFRESH_NAME' options 2024-02-01 10:38:06 -03:00
Erikson Bahr 0c8b7f9e33
fix lint 2024-02-01 09:56:38 -03:00
Erikson Bahr ac2d04686f
implement oidc singl sign on cookie refresher 2024-02-01 08:53:16 -03:00
Lucas Fraguas fe7fb31f05
Remove unused dependency 2024-01-09 11:24:03 -03:00
Lucas Fraguas 5f47af88e7
Rollback Go version to 1.19 2024-01-09 11:07:56 -03:00
Lucas Fraguas 87aaa79008
Update Docker and Go versions 2024-01-08 15:53:57 -03:00
Eduardo Vozniak 91ddd6bd5e
Fixing introspect 2023-10-02 19:50:48 -03:00
Eduardo Vozniak 05c8b59f67
Updating docker secrets 2023-10-02 15:56:22 -03:00
Eduardo Vozniak 8c7518ec0e
Fixing publish 2023-10-02 15:46:46 -03:00
Eduardo Vozniak c595c79980
Updating publish 2023-10-02 15:41:01 -03:00