Commit Graph

2467 Commits

Author SHA1 Message Date
Anderson Valério a31eabc52d
Merge branch 'pics' into anderson/add-audit-log-logoutall 2024-12-30 14:38:58 -03:00
Anderson Valério 7f91759342
update variable name 2024-12-30 14:38:29 -03:00
Joana Deluca Kleis 673256fd30
fix: fix log message params (#61)
## Description

Small fix in the oidc cookie refresh log message (the params were
inverted).
2024-12-30 13:50:27 -03:00
Joana Deluca Kleis 2f4b00f577
fix: fix log message params 2024-12-30 13:36:54 -03:00
Anderson Valério 48f13a7004
feat: sign out all sessions (#60)
## Description

Adding support for `/sign_out_all_sessions`.

/sign_out_all_sessions endpoint will remove the current session and make
a POST request to IAM, configured via
`OAUTH2_PROXY_BACKEND_LOGOUT_ALL_SESSIONS_URL` env, to invalidate all
the tokens and sessions. This will not invalidate other user sessions.

Once the tokens and sessions are invalidated, after the refresh token
period defined on the `OAUTH2_PROXY_COOKIE_REFRESH` env, OAuth will fail
to refresh the access token and clear that session.

related to:
- https://github.com/philips-internal/pics-foundation-envoy/pull/105
- https://github.com/philips-internal/pics/pull/3006


[AB#1579962](https://tfsemea1.ta.philips.com/tfs/TPC_Region11/0839b845-d626-4499-94ae-563a86a88d0a/_workitems/edit/1579962)

## Motivation and Context

Possibility for signing out on all devices.

## How Has This Been Tested?

Integrated locally with PICS by running binary. Docs
[here](https://github.com/philips-internal/pics/blob/main/src/services/Oauth2Proxy/docs/development.md).

## Checklist:

- [x] Add OAUTH2_PROXY_BACKEND_LOGOUT_ALL_SESSIONS_URL env
- [x] Add  /sign_out_all_sessions endpoint
- [x] Remove other user sessions when tokens are invalid
2024-12-30 08:43:50 -03:00
Anderson Valério 982e27fc00
tests for pics_oauthproxy 2024-12-27 14:59:07 -03:00
Anderson Valério f46f7a39f3
update test for refresh token change 2024-12-27 12:02:26 -03:00
Anderson Valério 72f89818fa
add doc for new env 2024-12-27 10:19:59 -03:00
Anderson Valério 92e7960b6c
fix lint bodyclose 2024-12-27 10:10:38 -03:00
Anderson Valério 8bf8b0ecc2
fix userID lint 2024-12-27 09:57:35 -03:00
Anderson Valério 1da13b0eff
fix userID lint 2024-12-27 09:50:43 -03:00
Anderson Valério 6cf267d368
clear session when refresh token fail to generate a new acess token 2024-12-27 08:38:23 -03:00
Anderson Valério 2851483446
add sign_out_all_sessions endpoint 2024-12-27 08:38:10 -03:00
Anderson Valério fb64fad321
add BackendLogoutAllSessionsURL configuration 2024-12-27 08:37:43 -03:00
Sailinder Harpal a9ac8d5496
Add audit log (#59)
<!--- Provide a general summary of your changes in the Title above -->

## Description

<!--- Describe your changes in detail -->
For Story AB#1618387

Adding function to audit log 'logout for all session'.

Reference documentation:
https://hl7.org/fhir/valueset-audit-event-type.html
https://hl7.org/fhir/R4/codesystem-dicom-dcim.html#dicom-dcim-110114

## Motivation and Context

<!--- Why is this change required? What problem does it solve? -->
<!--- If it fixes an open issue, please link to the issue here. -->

## How Has This Been Tested?

Tested locally with webhook.

Build a new docker image in wsl with `docker buildx build -t
oauth-local:v0.0.3 .`
Update the docker-compose.yml file to 
Updated the environment variable for .env.oauth2-proxy.us-east
Adding =>
`OAUTH2_PROXY_AUDIT_URL=https://webhook.site/0d7939ba-13f3-4cbc-ac2c-b814a3add0ca`

The audit logging is posted to the webhook =>
`
{
    "resourceType": "AuditEvent",
    "event": {
        "type": {
            "system": "http://hl7.org/fhir/ValueSet/audit-event-type",
            "version": "1",
            "code": "110123",
            "display": "Logout",
            "userSelected": "All Sessions"
        },
        "action": "E",
        "dateTime": "2024-12-19T12:44:30Z",
        "outcome": "0",
        "outcomeDesc": "Success"
    },
    "participant": [
        {
            "userId": {
                "value": "SECRET"
            },
            "altId": "SECRET",
            "requestor": true
        }
    ],
    "source": {
        "identifier": {
            "type": {
"system": "http://hl7.org/fhir/ValueSet/audit-source-type",
                "code": "4",
                "display": "Application Server"
            },
            "value": "admin_fthv@philips.com"
        },
        "type": [
            {
                "system": "http://hl7.org/fhir/security-source-type",
                "code": "1",
                "display": "End-user display device, diagnostic device."
            }
        ],
        "extension": [
            {
                "url": "/worklist",
                "extension": [
                    {
                        "url": "applicationName",
                        "valueString": "ReportingTest"
                    },
                    {
                        "url": "applicationVersion",
                        "valueString": "1"
                    },
                    {
                        "url": "serverName",
                        "valueString": "oauth2proxy"
                    },
                    {
                        "url": "componentName",
                        "valueString": "oauth2proxy"
                    },
                    {
                        "url": "productKey",
                        "valueString": "SECRET"
                    },
                    {
                        "url": "tenant",
                        "valueString": "SECRET"
                    }
                ]
            }
        ]
    }
}
`
## Checklist:

<!--- Go over all the following points, and put an `x` in all the boxes
that apply. -->
<!--- If you're unsure about any of these, don't hesitate to ask. We're
here to help! -->

- [ ] My change requires a change to the documentation or CHANGELOG.
- [ ] I have updated the documentation/CHANGELOG accordingly.
- [ ] I have created a feature (non-master) branch for my PR.
- [ ] I have written tests for my code changes.
2024-12-20 13:05:34 +01:00
Harpal, Sailinder 2f165d5eab
Change text 2024-12-19 15:52:54 +01:00
Harpal, Sailinder b1bfa56d0e
Add audit log 2024-12-19 14:31:01 +01:00
Anderson Valério 9ce484ba03
Merge 7.7.1 (#58)
## Description

Merge from Upstream/Release/7.7.1

AB#1611455

## Motivation and Context

Keeping OAuth2-Proxy up-to-date with the upstream

## How Has This Been Tested?

Created a local container image of the oauth-proxy from this PR and
integrated it with Reporting locally.
- run in the root of this repo
  - docker buildx build -t oauth-local .
- Updated FROM statement in pics/src/services/Oauth2Proxy/Dockerfile to 
  - FROM oauth-local

The following flows were checked:
- Login
- Audit logs
- Logout 


## Checklist:

- [x] Merge from Upstream/Release/7.7.1
2024-12-11 08:42:13 -03:00
Anderson Valério f321907ee7
update lint in pics/audit 2024-12-09 22:09:52 -03:00
Anderson Valério 67b8fd0061
bump golanci-lint 2024-12-09 22:00:53 -03:00
Anderson Valério c0c59bdcbc
The linter 'exportloopref' is deprecated (since v1.60.2) due to: Since Go1.22 (loopvar) this linter is no longer relevant. Replaced by copyloopvar 2024-12-09 21:30:51 -03:00
Anderson Valério c41b56e1f4
fix go mod 2024-12-09 21:25:15 -03:00
Anderson Valério d8e977c923
fix alpha_config doc 2024-12-09 21:16:55 -03:00
Anderson Valério 262f01e313
Merge remote-tracking branch 'upstream/release/v7.7.1' into merge_7.7.1 2024-12-09 21:03:44 -03:00
Anderson Valério fb0723e5bb
Isolating some PICS custom changes (#57)
## Description

Isolating PICS custom changes

## Motivation and Context

It's hard to understand what are our custom changes and what is from
OAuth2-Proxy main repo

## How Has This Been Tested?

Created a local container image of the oauth-proxy from this PR and
integrated it with Reporting locally.
- run in the root of this repo
  - docker buildx build -t oauth-local .
- Updated FROM statement in pics/src/services/Oauth2Proxy/Dockerfile to 
  - FROM oauth-local

The following flows were checked:
- Login
- Audit logs
- Logout 


## Checklist:

- [x] Isolating some dunction in separated files
- [x] Creating a folder for Pics packages
2024-12-09 09:15:36 -03:00
Anderson Valério 519a415ad1
revert test change 2024-12-06 12:06:04 -03:00
Anderson Valério 0961bc3fda
revert test change 2024-12-06 12:04:44 -03:00
Anderson Valério 6f656ad5c6
revert test change 2024-12-06 12:02:32 -03:00
Anderson Valério 76fb7074f1
comment unused function 2024-12-05 15:36:06 -03:00
Anderson Valério 4f04b856e5
pics legacy options 2024-12-05 14:51:24 -03:00
Anderson Valério 125e2f0ab6
pics cookie refresh 2024-12-05 14:51:06 -03:00
Anderson Valério 6e288ec2b6
moving audit to pics folder 2024-12-04 09:02:21 -03:00
Anderson Valério b71c2f8857
pics_oidc 2024-12-04 09:01:16 -03:00
Anderson Valério 2a34c871d4
Minimizing changes with upstream (#56)
Removing blank lines/spaces/tabs differences with upstream

## Motivation and Context

Minimize conflicts when merging a new version

## How Has This Been Tested?


## Checklist:

- [x] Reverted formatting changes to minimize conflicts
2024-12-04 08:57:31 -03:00
Anderson Valério 8053bfe399
Revert "isolating changes on oidc provider"
This reverts commit c053cb8d0a.
2024-12-04 08:38:46 -03:00
Anderson Valério b5ebcb2a13
Revert "moving audit to pics folder"
This reverts commit 59f46e6c9f.
2024-12-04 08:32:15 -03:00
Anderson Valério e6e7c91352
reverting formatting changes 2024-12-02 14:54:27 -03:00
Anderson Valério 8600d79ff5
reverting formatting changes 2024-12-02 14:39:15 -03:00
Anderson Valério 8b5b97c399
reverting formatting changes 2024-12-02 12:00:49 -03:00
Anderson Valério fd6f9c0c63
reverting formatting changes 2024-12-02 10:51:28 -03:00
Anderson Valério 9db036e422
revert html formatting 2024-12-02 10:36:58 -03:00
Anderson Valério f0c2b53784
reverting changes that only cause conflicts 2024-11-29 15:15:55 -03:00
Anderson Valério c053cb8d0a
isolating changes on oidc provider 2024-11-29 15:14:58 -03:00
Anderson Valério 59f46e6c9f
moving audit to pics folder 2024-11-29 15:14:10 -03:00
github-actions[bot] 055a63432c
update to release version v7.7.1 2024-10-08 14:41:41 +02:00
Nuno Miguel Micaelo Borges ff761d2523
fix: runtime error: index out of range (0) with length 0 (#2328)
* Issue 2311: runtime error: index out of range [0] with length 0 while extracting state of of the csrf

---------

Co-authored-by: tuunit <jan@larwig.com>
2024-10-08 14:40:41 +02:00
rd-danny-fleer 642ba174d4
fix: unable to use hyphen in JSON path for oidc-groups-claim option (#2619) 2024-10-07 20:08:44 +02:00
Joel Speed d68336dcf4
Merge pull request #2803 from tuunit/bugfix/self-signed-certificate-handling
fix: self signed certificate handling in v7.7.0
2024-10-07 11:54:22 +01:00
tuunit 4bd920b208
add changelog entry 2024-10-06 21:55:45 +02:00
tuunit bae168f06a
better handling of default transport modification 2024-10-06 21:43:38 +02:00