Tim Möhlmann
6398349c24
feat(oidc): token exchange impersonation ( #7516 )
...
* add token exchange feature flag
* allow setting reason and actor to access tokens
* impersonation
* set token types and scopes in response
* upgrade oidc to working draft state
* fix tests
* audience and scope validation
* id toke and jwt as input
* return id tokens
* add grant type token exchange to app config
* add integration tests
* check and deny actors in api calls
* fix instance setting tests by triggering projection on write and cleanup
* insert sleep statements again
* solve linting issues
* add translations
* pin oidc v3.15.0
* resolve comments, add event translation
* fix refreshtoken test
* use ValidateAuthReqScopes from oidc
* apparently the linter can't make up its mind
* persist actor thru refresh tokens and check in tests
* remove unneeded triggers
2024-03-20 10:18:46 +00:00
Tim Möhlmann
f680dd934d
refactor: rename package errors to zerrors ( #7039 )
...
* chore: rename package errors to zerrors
* rename package errors to gerrors
* fix error related linting issues
* fix zitadel error assertion
* fix gosimple linting issues
* fix deprecated linting issues
* resolve gci linting issues
* fix import structure
---------
Co-authored-by: Elio Bischof <elio@zitadel.com>
2023-12-08 15:30:55 +01:00
Tim Möhlmann
3bbcc3434a
chore(deps): upgrade to oidc v3 ( #6737 )
...
This pr upgrades oidc to v3 . Function signature changes have been migrated as well. Specifically there are more client calls that take a context now. Where feasable a context is added to those calls. Where a context is not (easily) available context.TODO() is used as a reminder for when it does.
Related to #6619
2023-10-17 15:19:51 +00:00
Livio Spring
7c494fd219
feat(login): add OTP (email and sms) ( #6353 )
...
* feat: login with otp
* fix(i18n): japanese translation
* add missing files
* fix provider change
* add event types translations to en
* add tests
* resourceOwner
* remove unused handler
* fix: secret generators and add comments
* add setup step
* rename
* linting
* fix setup
* improve otp handling
* fix autocomplete
* translations for login and notifications
* translations for event types
* changes from review
* check selected mfa type
2023-08-15 12:47:05 +00:00
Livio Spring
a1942ecdaa
feat(api): add and remove OTP (SMS and email) ( #6295 )
...
* refactor: rename otp to totp
* feat: add otp sms and email
* implement tests
2023-08-02 18:57:53 +02:00
Livio Spring
ee26f99ebf
fix: store auth methods instead of AMR in auth request linking and OIDC Session ( #6192 )
...
This PR changes the information stored on the SessionLinkedEvent and (OIDC Session) AddedEvent from OIDC AMR strings to domain.UserAuthMethodTypes, so no information is lost in the process (e.g. authentication with an IDP)
2023-07-12 12:24:01 +00:00
Livio Spring
14b8cf4894
feat(api): add OIDC session service ( #6157 )
...
This PR starts the OIDC implementation for the API V2 including the Implicit and Code Flow.
Co-authored-by: Livio Spring <livio.a@gmail.com>
Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>
Co-authored-by: Stefan Benz <46600784+stebenz@users.noreply.github.com>
2023-07-10 13:27:00 +00:00
Tim Möhlmann
5819924275
feat: device authorization RFC 8628 ( #5646 )
...
* device auth: implement the write events
* add grant type device code
* fix(init): check if default value implements stringer
---------
Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
2023-04-19 08:46:02 +00:00
Silvan
b9795b5c57
fix(amr): add pwd because password is wrong ( #4284 )
...
* fix(amr): add pwd because password is wrong
* docs: deprecation notice
* docs: nicer wording
* Update docs/docs/apis/openidoauth/claims.md
Co-authored-by: Livio Spring <livio.a@gmail.com>
Co-authored-by: Livio Spring <livio.a@gmail.com>
2022-08-31 08:16:31 +00:00
Florian Forster
fa9f581d56
chore(v2): move to new org ( #3499 )
...
* chore: move to new org
* logging
* fix: org rename caos -> zitadel
Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
2022-04-26 23:01:45 +00:00
Livio Amstutz
75ec73ca4a
feat: dynamic issuer ( #3481 )
...
* feat: dynamic issuer
* dynamic domain handling
* key rotation durations
* feat: dynamic issuer
* make webauthn displayname dynamic
2022-04-25 10:01:17 +02:00
Livio Amstutz
87560157c1
fix: change to repository event types and removed unused code ( #3386 )
...
* fix: change to repository event types and removed unused code
* some fixes
* remove unused code
2022-03-31 11:36:26 +02:00
Livio Amstutz
958362e6c9
feat: handle instance from context ( #3382 )
...
* commander
* commander
* selber!
* move to packages
* fix(errors): implement Is interface
* test: command
* test: commands
* add init steps
* setup tenant
* add default step yaml
* possibility to set password
* merge v2 into v2-commander
* fix: rename iam command side to instance
* fix: rename iam command side to instance
* fix: rename iam command side to instance
* fix: rename iam command side to instance
* fix: search query builder can filter events in memory
* fix: filters for add member
* fix(setup): add `ExternalSecure` to config
* chore: name iam to instance
* fix: matching
* remove unsued func
* base url
* base url
* test(command): filter funcs
* test: commands
* fix: rename orgiampolicy to domain policy
* start from init
* commands
* config
* fix indexes and add constraints
* fixes
* fix: merge conflicts
* fix: protos
* fix: md files
* setup
* add deprecated org iam policy again
* typo
* fix search query
* fix filter
* Apply suggestions from code review
* remove custom org from org setup
* add todos for verification
* change apps creation
* simplify package structure
* fix error
* move preparation helper for tests
* fix unique constraints
* fix config mapping in setup
* fix error handling in encryption_keys.go
* fix projection config
* fix query from old views to projection
* fix setup of mgmt api
* set iam project and fix instance projection
* fix tokens view
* fix steps.yaml and defaults.yaml
* fix projections
* change instance context to interface
* instance interceptors and additional events in setup
* cleanup
* tests for interceptors
* fix label policy
* add todo
* single api endpoint in environment.json
Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
Co-authored-by: fabi <fabienne.gerschwiler@gmail.com>
2022-03-29 11:53:19 +02:00
Livio Amstutz
56b916a2b0
feat: projections auto create their tables ( #3324 )
...
* begin init checks for projections
* first projection checks
* debug notification providers with query fixes
* more projections and first index
* more projections
* more projections
* finish projections
* fix tests (remove db name)
* create tables in setup
* fix logging / error handling
* add tenant to views
* rename tenant to instance_id
* add instance_id to all projections
* add instance_id to all queries
* correct instance_id on projections
* add instance_id to failed_events
* use separate context for instance
* implement features projection
* implement features projection
* remove unique constraint from setup when migration failed
* add error to failed setup event
* add instance_id to primary keys
* fix IAM projection
* remove old migrations folder
* fix keysFromYAML test
2022-03-23 09:02:39 +01:00
Livio Amstutz
fc6154cffc
feat: token revocation and OP certification ( #2594 )
...
* fix: try using only user session if no user is set (id_token_hint) on prompt none
* fix caos errors As implementation
* implement request mode
* return explicit error on invalid refresh token use
* begin token revocation
* token revocation
* tests
* tests
* cleanup
* set op config
* add revocation endpoint to config
* add revocation endpoint to config
* migration version
* error handling in token revocation
* migration version
* update oidc lib to 1.0.0
2021-11-03 08:35:24 +01:00
Fabi
e4bdaf26b0
feat: select idp and auto register ( #2336 )
...
* faet: auto regsiter config on idp
* feat: auto register on login
* feat: auto register on register
* feat: redirect to selected identity provider
* fix: test
* fix: test
* fix: user by id request org id
* fix: migration version and test
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2021-09-10 09:49:49 +02:00
Livio Amstutz
4a2ca5a1e8
fix: handle reauth correctly (max_age=0 or prompt=login) ( #1870 )
...
* max age
* merge main
* fix when no prompt is set
* fix: update oidc pkg
* fix tests
2021-06-16 10:02:15 +02:00
Livio Amstutz
ab78b34c6c
feat: request registration process by prompt ( #1798 )
...
* feat: request registration process by prompt
* fix merge
* add prompt create to docs
2021-06-14 10:40:38 +02:00
Livio Amstutz
ec5020bebc
feat: refresh token ( #1728 )
...
* begin refresh tokens
* refresh tokens
* list and revoke refresh tokens
* handle remove
* tests for refresh tokens
* uniqueness and default expiration
* rename oidc token methods
* cleanup
* migration version
* Update internal/static/i18n/en.yaml
Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com>
* fixes
* feat: update oidc pkg for refresh tokens
Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com>
2021-05-20 11:33:35 +00:00
Fabi
d8e42744b4
fix: move v2 pkgs ( #1331 )
...
* fix: move eventstore pkgs
* fix: move eventstore pkgs
* fix: remove v2 view
* fix: remove v2 view
2021-02-23 15:13:04 +01:00
Fabi
320679467b
feat: User login commands ( #1228 )
...
* feat: change login to command side
* feat: change login to command side
* fix: fix push on user
* feat: user command side
* feat: sign out
* feat: command side login
* feat: command side login
* feat: fix register user
* feat: fix register user
* feat: fix web auth n events
* feat: add machine keys
* feat: send codes
* feat: move authrequest to domain
* feat: move authrequest to domain
* feat: webauthn working
* feat: external users
* feat: external users login
* feat: notify users
* fix: tests
* feat: cascade remove user grants on project remove
* fix: webauthn
* fix: pr requests
* fix: register human with member
* fix: fix bugs
* fix: fix bugs
2021-02-08 11:30:30 +01:00
Livio Amstutz
300ade66a7
feat: add WebAuthN support for passwordless login and 2fa ( #966 )
...
* at least registration prompt works
* in memory test for login
* buttons to start webauthn process
* begin eventstore impl
* begin eventstore impl
* serialize into bytes
* fix: u2f, passwordless types
* fix for localhost
* fix script
* fix: u2f, passwordless types
* fix: add u2f
* fix: verify u2f
* fix: session data in event store
* fix: u2f credentials in eventstore
* fix: webauthn pkg handles business models
* feat: tests
* feat: append events
* fix: test
* fix: check only ready webauthn creds
* fix: move u2f methods to authrepo
* frontend improvements
* fix return
* feat: add passwordless
* feat: add passwordless
* improve ui / error handling
* separate call for login
* fix login
* js
* feat: u2f login methods
* feat: remove unused session id
* feat: error handling
* feat: error handling
* feat: refactor user eventstore
* feat: finish webauthn
* feat: u2f and passwordlss in auth.proto
* u2f step
* passwordless step
* cleanup js
* EndpointPasswordLessLogin
* migration
* update mfaChecked test
* next step test
* token name
* cleanup
* attribute
* passwordless as tokens
* remove sms as otp type
* add "user" to amr for webauthn
* error handling
* fixes
* fix tests
* naming
* naming
* fixes
* session handler
* i18n
* error handling in login
* Update internal/ui/login/static/i18n/de.yaml
Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com>
* Update internal/ui/login/static/i18n/en.yaml
Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com>
* improvements
* merge fixes
* fixes
* fixes
Co-authored-by: Fabiennne <fabienne.gerschwiler@gmail.com>
Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com>
2020-12-02 17:00:04 +01:00
Fabi
202aae4954
feat: mfa policy ( #913 )
...
* feat: add mfa to login policy
* feat: add mfa to login policy
* feat: add mfa to login policy
* feat: add mfa to login policy
* feat: add mfa to login policy on org
* feat: add mfa to login policy on org
* feat: append events on policy views
* feat: iam login policy mfa definition
* feat: login policies on orgs
* feat: configured mfas in login process
* feat: configured mfas in login process
* Update internal/ui/login/static/i18n/en.yaml
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
* fix: rename software and hardware mfas
* fix: pr requests
* fix user mfa
* fix: test
* fix: oidc version
* fix: oidc version
* fix: proto gen
Co-authored-by: Livio Amstutz <livio.a@gmail.com>
Co-authored-by: Max Peintner <max@caos.ch>
2020-11-04 11:26:10 +01:00
Livio Amstutz
6128c0c672
fix: response type mapping ( #426 )
...
* fix: return authorizations on userinfo
* fix: response type mapping
* fix tests
* fix angular
* regenerate mgmt proto
* enable login link again
2020-07-09 15:52:20 +02:00
Livio Amstutz
3549a8b64e
feat: port reduction ( #323 )
...
* move mgmt pkg
* begin package restructure
* rename auth package to authz
* begin start api
* move auth
* move admin
* fix merge
* configs and interceptors
* interceptor
* revert generate-grpc.sh
* some cleanups
* console
* move console
* fix tests and merging
* js linting
* merge
* merging and configs
* change k8s base to current ports
* fixes
* cleanup
* regenerate proto
* remove unnecessary whitespace
* missing param
* go mod tidy
* fix merging
* move login pkg
* cleanup
* move api pkgs again
* fix pkg naming
* fix generate-static.sh for login
* update workflow
* fixes
* logging
* remove duplicate
* comment for optional gateway interfaces
* regenerate protos
* fix proto imports for grpc web
* protos
* grpc web generate
* grpc web generate
* fix changes
* add translation interceptor
* fix merging
* regenerate mgmt proto
2020-07-08 13:56:37 +02:00
