1
0
mirror of https://github.com/zitadel/zitadel.git synced 2024-12-21 15:27:31 +00:00

202 Commits

Author SHA1 Message Date
Livio Spring
34e9748cba
chore: update dependencies () 2023-10-26 15:03:57 +00:00
Tim Möhlmann
94cf30c547
feat(oidc): use the new oidc server interface ()
* feat(oidc): use the new oidc server interface

* rename from provider to server

* pin logging and oidc packages

* use oidc introspection fix branch

* add overloaded methods with tracing

* cleanup unused code

* include latest oidc fixes

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-10-25 15:44:05 +00:00
Tim Möhlmann
3bbcc3434a
chore(deps): upgrade to oidc v3 ()
This pr upgrades oidc to v3 . Function signature changes have been migrated as well. Specifically there are more client calls that take a context now. Where feasable a context is added to those calls. Where a context is not (easily) available context.TODO() is used as a reminder for when it does.

Related to 
2023-10-17 15:19:51 +00:00
Stefan Benz
15fd3045e0
feat: add SAML as identity provider ()
* feat: first implementation for saml sp

* fix: add command side instance and org for saml provider

* fix: add query side instance and org for saml provider

* fix: request handling in event and retrieval of finished intent

* fix: add review changes and integration tests

* fix: add integration tests for saml idp

* fix: correct unit tests with review changes

* fix: add saml session unit test

* fix: add saml session unit test

* fix: add saml session unit test

* fix: changes from review

* fix: changes from review

* fix: proto build error

* fix: proto build error

* fix: proto build error

* fix: proto require metadata oneof

* fix: login with saml provider

* fix: integration test for saml assertion

* lint client.go

* fix json tag

* fix: linting

* fix import

* fix: linting

* fix saml idp query

* fix: linting

* lint: try all issues

* revert linting config

* fix: add regenerate endpoints

* fix: translations

* fix mk.yaml

* ignore acs path for user agent cookie

* fix: add AuthFromProvider test for saml

* fix: integration test for saml retrieve information

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-09-29 11:26:14 +02:00
Livio Spring
68bfab2fb3
feat(login): use default org for login without provided org context ()
* start feature flags

* base feature events on domain const

* setup default features

* allow setting feature in system api

* allow setting feature in admin api

* set settings in login based on feature

* fix rebasing

* unit tests

* i18n

* update policy after domain discovery

* some changes from review

* check feature and value type

* check feature and value type
2023-09-29 08:21:32 +00:00
Tim Möhlmann
d380627e80
feat(passwap): base64 standard encoding for pbkdf2 ()
Upgrade passwap to include the above feature.
2023-09-27 08:00:46 +02:00
Tim Möhlmann
e6d273b328
chore(deps): bump oidc ()
* chore(deps): bump oidc

Include the Issuer from Frowarded header feature

* use the new constructor
2023-09-22 11:05:11 +02:00
Stefan Benz
3183ba22d4
fix: update saml to v0.1.2 ()
* fix: update saml to v0.1.2

* docs: add optional to RelayState for SAML API

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-09-18 05:59:57 +00:00
Tim Möhlmann
87cdd20d72
fix(deps): upgrade oidc and otel () 2023-09-01 10:32:13 +00:00
Stefan Benz
26b28ed2af
feat: add saml custom attribute action and translations ()
* feat: add saml custom attribute action and translations

* chore: update saml dependency

* fix: apply suggestions from code review

Co-authored-by: Livio Spring <livio.a@gmail.com>

* fix: custom attribute action with variadic parameter

* docs: add customize saml response docs

* docs: update docs/docs/apis/actions/customize-samlresponse.md

Co-authored-by: Livio Spring <livio.a@gmail.com>

* docs: update docs/docs/apis/actions/customize-samlresponse.md

Co-authored-by: Livio Spring <livio.a@gmail.com>

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-08-15 15:04:45 +00:00
Tim Möhlmann
4d09409328
feat(crypto): add pbkdf2 support ()
This change brings pbkdf2 support for password hashing and verification.
2023-08-02 11:27:18 +00:00
Livio Spring
59f3c328ec
feat(OIDC): add support for end_session for V2 tokens ()
This PR adds support for the OIDC end_session_endpoint for V2 tokens. Sending an id_token_hint as parameter will directly terminate the underlying (SSO) session and all its tokens. Without this param, the user will be redirected to the Login UI, where he will able to choose if to logout.
2023-07-19 13:17:39 +02:00
Tim Möhlmann
4589ddad4a
feat: integrate passwap for human user password hashing ()
* feat: use passwap for human user passwords

* fix tests

* passwap config

* add the event mapper

* cleanup query side and api

* solve linting errors

* regression test

* try to fix linter errors again

* pass systemdefaults into externalConfigChange migration

* fix: user password set in auth view

* pin passwap v0.2.0

* v2: validate hashed password hash based on prefix

* resolve remaining comments

* add error tag and translation for unsupported hash encoding

* fix unit test

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-07-14 09:49:57 +03:00
Miguel Cabrerizo
0f3c33cb86
feat: show basic info start-from-init () 2023-07-12 20:46:50 +03:00
Tim Möhlmann
6907b52b32
chore(deps): update oidc () 2023-06-09 15:18:14 +00:00
Tim Möhlmann
a301c40f9f
feat: implement register Passkey user API v2 ()
* command/crypto: DRY the code

- reuse the the algorithm switch to create a secret generator
- add a verifyCryptoCode function

* command: crypto code tests

* migrate webauthn package

* finish integration tests with webauthn mock client
2023-05-24 10:22:00 +00:00
Tim Möhlmann
6839a5c203
chore: update oidc () 2023-05-24 08:11:56 +00:00
Tim Möhlmann
5819924275
feat: device authorization RFC 8628 ()
* device auth: implement the write events

* add grant type device code

* fix(init): check if default value implements stringer

---------

Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
2023-04-19 08:46:02 +00:00
Stefan Benz
440ba9f5ef
fix: update saml to v0.0.11 ()
* fix: update saml to v0.0.11

* chore: remove unused sum

---------

Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
2023-04-11 07:39:12 +00:00
Silvan
698f46fe6a
chore: update dependencies ()
* chore(backend): update dependencies

* chore(pipeline): update golangci-lint
2023-04-06 06:29:55 +00:00
Livio Spring
991a56341b
fix: role claims mapping ()
* fix: role claims mapping

* update oidc pkg

* update oidc pkg
2023-04-04 12:36:39 +00:00
Tim Möhlmann
25c3c17986
chore: upgrade to oidc v2 release ()
* chore: upgrade to oidc v2 release

* fix tests

* fix build errors after rebase

* pin oidc v2.1.0

* pin oidc v2.1.1 (include bugfix)

* pin oidc v2.1.2 (include bugfix)

* pin oidc v2.2.1 (bugfix)

include fix 

* fix: refresh token handling

* simplify cognitive complexity

* fix: handle error

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-03-28 11:28:56 +00:00
Stefan Benz
41ff0bbc63
feat: ldap provider login ()
Add the logic to configure and use LDAP provider as an external IDP with a dedicated login GUI.
2023-03-24 15:18:56 +00:00
Silvan
20e4f1ce57
feat(actions): add fields to complement token flow ()
* deprecated `ctx.v1.userinfo`-field in "pre userinfo creation" trigger in favour of `ctx.v1.claims`. The trigger now behaves the same as "pre access token creation"
* added `ctx.v1.claims` to "complement tokens" flow
* added `ctx.v1.grants` to "complement tokens" flow
* document `ctx.v1.getUser()` in "complement tokens" flow

* feat(actions): add getUser() and grant

* map user grants

* map claims

* feat(actions): claims in complement token ctx

* docs(actions): add new fields of complement token

* docs(actions): additions to complement token

* docs(actions): correct field names
2023-03-08 15:26:28 +01:00
Silvan
e38abdcdf3
perf: query data AS OF SYSTEM TIME ()
Queries the data in the storage layser at the timestamp when the call hit the API layer
2023-02-27 22:36:43 +01:00
Livio Spring
80003939ad
feat(api): add oidc and jwt provider template ()
Adds possibility to manage OIDC and JWT template based providers
2023-02-27 16:32:18 +01:00
Florian Forster
aa9518ac02
docs: improve api docs ()
* integrate docs into nav

* generator for local use, production needs to be set by env

* fix typo

* local dev

* docs: annotate the first user endpoints in the management api

* docs: annotate the first user endpoints in the management api

* docs: annotate the first user endpoints in the management api

* docs: annotate the first user endpoints in the management api

* docs: add header params

* rewrite docs links and improve ci

* tweak build command

* fix path

* Update docs/docusaurus.config.js

Co-authored-by: Max Peintner <max@caos.ch>

* fix docker

* docs: add header params

* docs: Add tags to management api. add some descriptions

* docs: more descriptions

* docs: more descriptions

* docs: required fields

* docs: example request

* docs: example request

* docs: example request

* docs: example request

* docs: example request

* docs: user metadata requests

* docs: user requests

* docs: user requests

* docs: user requests

* docs: user requests

* docs: change nav add first methods to authentication api

* docs: auth api

* docs: auth api

* docs: auth api

* docs: auth api

* docs: auth api

* docs: api sidenav

* chore: use buf without docker

* fix deploy

* fix ci

* fix vercel

* docs: admin

* docs: admin api docs

* docs: admin api docs

* docs: admin api docs

* docs: admin api docs

* docs: security

* docs: security

* docs: admin api

* docs: change to env vars

* docs: auth api

* docs: remove assets, deprecated requests, menu

* reworked page with PaloAltoNetworks/docusaurus-openapi-docs

* works with the resolutions

* fix broken build by adding assets again

* add tags to menu

* chore: improve build speed

* no-minify

* test ssr

* ssr 20

* use lazy

* increase mem

* use default mem

* change names

* docs: remove assets, deprecated requests, menu

* docs: management api

* docs: management api

* docs: management api

* docs: sidebar

* not the best word smithing but it is ;-)

* more typos

* merge main

* fix some error

* trial

* update grpc gateway

* trigger vercel build

* docs: deprecated requests

* docs: deprecated requests

---------

Co-authored-by: Fabienne <fabienne.gerschwiler@gmail.com>
Co-authored-by: Max Peintner <max@caos.ch>
2023-02-23 18:08:06 +07:00
Stefan Benz
50728129ee
fix: update saml dependency to v0.0.10 ()
* fix: update saml dependency to v0.0.10

* fix: update saml dependency to v0.0.10
2023-02-22 14:24:27 +00:00
Stefan Benz
586495a0be
feat: add management for ldap idp template ()
Add management functionality for LDAP idps with templates and the basic functionality for the LDAP provider, which can then be used with a separate login page in the future.

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-02-15 08:14:59 +00:00
Stefan Benz
3616b6b028
feat(api): allow specifying access_token type (opaque/JWT) for service users ()
Add functionality to configure the access token type on the service accounts to provide the oidc library with the necessary information to create the right type of access token.
2023-02-08 08:06:34 +00:00
Stefan Benz
e2fdd3f077
feat: support client_credentials for service users ()
Request an access_token for service users with OAuth 2.0 Client Credentials Grant. Added functionality to generate and remove a secret on service users.
2023-01-31 19:52:47 +00:00
Livio Spring
598a4d2d4b
feat: add basic structure of idp templates ()
add basic structure and implement first providers for IDP templates to be able to manage and use them in the future
2023-01-23 08:11:40 +01:00
Livio Spring
0a30e39b46
fix(CORS): add X-Requested-With to Access-Control-Request-Headers ()
allows clients with `X-Requested-With` header to succeed with their CORS request
2023-01-09 13:37:10 +01:00
Silvan
384cc34303
chore: cockroach version ()
* chore: cockroach version for tests
2022-12-02 09:42:27 +00:00
Stefan Benz
24ae69b726
fix: update saml dependency v0.0.8=>v0.0.9 () 2022-11-15 06:30:36 +00:00
Stefan Benz
4ba45280fe
fix(saml): update saml dependency () 2022-10-25 14:06:53 +02:00
Silvan
43fb3fd1a6
feat(actions): add token customization flow and extend functionally with modules ()
* fix: potential memory leak

* feat(actions): possibility to parse json
feat(actions): possibility to perform http calls

* add query call

* feat(api): list flow and trigger types
fix(api): switch flow and trigger types to dynamic objects

* fix(translations): add action translations

* use `domain.FlowType`

* localizers

* localization

* trigger types

* options on `query.Action`

* add functions for actions

* feat: management api: add list flow and trigger  ()

* console changes

* cleanup

* fix: wrong localization

Co-authored-by: Max Peintner <max@caos.ch>

* id token works

* check if claims not nil

* feat(actions): metadata api

* refactor(actions): modules

* fix: allow prerelease

* fix: test

* feat(actions): deny list for http hosts

* feat(actions): deny list for http hosts

* refactor: actions

* fix: different error ids

* fix: rename statusCode to status

* Actions objects as options ()

* fix: rename statusCode to status

* fix(actions): objects as options

* fix(actions): objects as options

* fix(actions): set fields

* add http client to old actions

* fix(actions): add log module

* fix(actions): add user to context where possible

* fix(actions): add user to ctx in external authorization/pre creation

* fix(actions): query correct flow in claims

* test: actions

* fix(id-generator): panic if no machine id

* tests

* maybe this?

* fix linting

* refactor: improve code

* fix: metadata and usergrant usage in actions

* fix: appendUserGrant

* fix: allowedToFail and timeout in action execution

* fix: allowed to fail in token complement flow

* docs: add action log claim

* Update defaults.yaml

* fix log claim

* remove prerelease build

Co-authored-by: Max Peintner <max@caos.ch>
Co-authored-by: Livio Spring <livio.a@gmail.com>
2022-10-06 14:23:59 +02:00
Stefan Benz
7a5f7f82cf
feat(saml): implementation of saml for ZITADEL v2 () 2022-09-12 18:18:08 +02:00
Silvan
77b4fc5487
feat(database): support for postgres ()
* beginning with postgres statements

* try pgx

* use pgx

* database

* init works for postgres

* arrays working

* init for cockroach

* init

* start tests

* tests

* TESTS

* ch

* ch

* chore: use go 1.18

* read stmts

* fix typo

* tests

* connection string

* add missing error handler

* cleanup

* start all apis

* go mod tidy

* old update

* switch back to minute

* on conflict

* replace string slice with `database.StringArray` in db models

* fix tests and start

* update go version in dockerfile

* setup go

* clean up

* remove notification migration

* update

* docs: add deploy guide for postgres

* fix: revert sonyflake

* use `database.StringArray` for daos

* use `database.StringArray` every where

* new tables

* index naming,
metadata primary key,
project grant role key type

* docs(postgres): change to beta

* chore: correct compose

* fix(defaults): add empty postgres config

* refactor: remove unused code

* docs: add postgres to self hosted

* fix broken link

* so?

* change title

* add mdx to link

* fix stmt

* update goreleaser in test-code

* docs: improve postgres example

* update more projections

* fix: add beta log for postgres

* revert index name change

* prerelease

* fix: add sequence to v1 "reduce paniced"

* log if nil

* add logging

* fix: log output

* fix(import): check if org exists and user

* refactor: imports

* fix(user): ignore malformed events

* refactor: method naming

* fix: test

* refactor: correct errors.Is call

* ci: don't build dev binaries on main

* fix(go releaser): update version to 1.11.0

* fix(user): projection should not break

* fix(user): handle error properly

* docs: correct config example

* Update .releaserc.js

* Update .releaserc.js

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
Co-authored-by: Elio Bischof <eliobischof@gmail.com>
2022-08-31 07:52:43 +00:00
Livio Spring
f610d48569
feat: prepare for multiple database types ()
BREAKING CHANGE: the database and admin user config has changed.
2022-07-28 16:25:42 +02:00
Stefan Benz
bc9a85daf3
feat: V2 alpha import and export of organizations ()
* feat(import): add functionality to import data into an instance

* feat(import): move import to admin api and additional checks for nil pointer

* fix(export): export implementation with filtered members and grants

* fix: export and import implementation

* fix: add possibility to export hashed passwords with the user

* fix(import): import with structure of v1 and v2

* docs: add v1 proto

* fix(import): check im imported user is already existing

* fix(import): add otp import function

* fix(import): add external idps, domains, custom text and messages

* fix(import): correct usage of default values from login policy

* fix(export): fix renaming of add project function

* fix(import): move checks for unit tests

* expect filter

* fix(import): move checks for unit tests

* fix(import): move checks for unit tests

* fix(import): produce prerelease from branch

* fix(import): correctly use provided user id for machine user imports

* fix(import): corrected otp import and added guide for export and import

* fix: import verified and primary domains

* fix(import): add reading from gcs, s3 and localfile with tracing

* fix(import): gcs and s3, file size correction and error logging

* Delete docker-compose.yml

* fix(import): progress logging and count of resources

* fix(import): progress logging and count of resources

* log subscription

* fix(import): incorporate review

* fix(import): incorporate review

* docs: add suggestion for import

Co-authored-by: Fabi <38692350+hifabienne@users.noreply.github.com>

* fix(import): add verification otp event and handling of deleted but existing users

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
Co-authored-by: Fabienne <fabienne.gerschwiler@gmail.com>
Co-authored-by: Silvan <silvan.reusser@gmail.com>
Co-authored-by: Fabi <38692350+hifabienne@users.noreply.github.com>
2022-07-28 13:42:35 +00:00
Livio Spring
c15577c1f9
fix: use default redirect uri when not passed on end_session endpoint ()
* fix: use default redirect uri when not passed on end_session endpoint

* instance state
2022-07-27 09:49:16 +02:00
Livio Spring
ccde49b323
feat: extend claims of introspection response ()
* feat: extend claims of introspection response

* update oidc lib
2022-07-25 09:38:15 +02:00
Livio Spring
aed7010508
fix: scheduling ()
* fix: improve scheduling

* build pre-release

* fix: locker

* fix: user handler and print stack in case of panic in reducer

* chore: remove sentry

* fix: improve handler projection and implement tests

* more tests

* fix: race condition in tests

* Update internal/eventstore/repository/sql/query.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* fix: implemented suggested changes

* fix: lock statement

Co-authored-by: Silvan <silvan.reusser@gmail.com>
2022-07-22 10:08:39 +00:00
Livio Spring
f4e91f0b5b
fix: update oidc pkg (state and redirect_uri handling) () 2022-06-22 07:31:36 +00:00
Alexei-Barnes
09b021b257
feat: Configurable Unique Machine Identification ()
* feat: Configurable Unique Machine Identification

This change fixes Segfault on AWS App Runner with v2 

The change introduces two new dependencies:

* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.

The change ads new configuration (see `defaults.yaml`):

* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request.  Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.

The new flow for getting a unique machine id is:

1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.

It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.

Misc changes:

* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.

* Update internal/id/config.go

Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>

* Fix authored by @livio-a for tests

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 16:57:57 +02:00
Florian Forster
fa9f581d56
chore(v2): move to new org ()
* chore: move to new org

* logging

* fix: org rename caos -> zitadel

Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
2022-04-26 23:01:45 +00:00
Livio Amstutz
75ec73ca4a
feat: dynamic issuer ()
* feat: dynamic issuer

* dynamic domain handling

* key rotation durations

* feat: dynamic issuer

* make webauthn displayname dynamic
2022-04-25 10:01:17 +02:00
Livio Amstutz
b949b8fc65
chore(deps): update oidc to 1.2.0 ()
* chore(deps): update oidc to 1.2.0

* add comment
2022-04-05 07:22:00 +00:00
Livio Amstutz
504fe5b761
cherry pick changes from main ()
* feat: remove exif data from uploaded images ()

* feat: remove exif tags from images

* feat: remove exif data

* feat: remove exif

* fix: add preferredLoginName to user grant response ()

* chore: log webauthn parse error ()

* log error

* log error

* feat: Help link in privacy policy

* fix: convert correct detail data on organization ()

* fix: handle empty editor users

* fix: add some missing translations ()

* fix: org policy translations

* fix: metadata event types translation

* fix: translations

* fix: filter resource owner correctly on project grant members ()

* fix: filter resource owner correctly on project grant members

* fix: filter resource owner correctly on project grant members

* fix: add orgIDs to zitadel permissions request

Co-authored-by: fabi <fabienne.gerschwiler@gmail.com>

* fix: get IAM memberships correctly in MyZitadelPermissions ()

* fix: correct login names on auth and notification users ()

* fix: correct login names on auth and notification users

* fix: migration

* fix: handle resource owner in action flows ()

* fix merge

* fix: exchange exif library ()

* fix: exchange exif library

* ignore tiffs

* requested fixes

* feat: Help link in privacy policy

Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com>
Co-authored-by: fabi <fabienne.gerschwiler@gmail.com>
2022-03-24 14:00:24 +01:00