1
0
mirror of https://github.com/zitadel/zitadel.git synced 2024-12-17 21:37:35 +00:00

194 Commits

Author SHA1 Message Date
Tim Möhlmann
4f7254f121 fix(deps): upgrade oidc and otel () 2023-09-01 15:52:53 +03:00
Stefan Benz
26b28ed2af
feat: add saml custom attribute action and translations ()
* feat: add saml custom attribute action and translations

* chore: update saml dependency

* fix: apply suggestions from code review

Co-authored-by: Livio Spring <livio.a@gmail.com>

* fix: custom attribute action with variadic parameter

* docs: add customize saml response docs

* docs: update docs/docs/apis/actions/customize-samlresponse.md

Co-authored-by: Livio Spring <livio.a@gmail.com>

* docs: update docs/docs/apis/actions/customize-samlresponse.md

Co-authored-by: Livio Spring <livio.a@gmail.com>

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-08-15 15:04:45 +00:00
Tim Möhlmann
4d09409328
feat(crypto): add pbkdf2 support ()
This change brings pbkdf2 support for password hashing and verification.
2023-08-02 11:27:18 +00:00
Livio Spring
59f3c328ec
feat(OIDC): add support for end_session for V2 tokens ()
This PR adds support for the OIDC end_session_endpoint for V2 tokens. Sending an id_token_hint as parameter will directly terminate the underlying (SSO) session and all its tokens. Without this param, the user will be redirected to the Login UI, where he will able to choose if to logout.
2023-07-19 13:17:39 +02:00
Tim Möhlmann
4589ddad4a
feat: integrate passwap for human user password hashing ()
* feat: use passwap for human user passwords

* fix tests

* passwap config

* add the event mapper

* cleanup query side and api

* solve linting errors

* regression test

* try to fix linter errors again

* pass systemdefaults into externalConfigChange migration

* fix: user password set in auth view

* pin passwap v0.2.0

* v2: validate hashed password hash based on prefix

* resolve remaining comments

* add error tag and translation for unsupported hash encoding

* fix unit test

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-07-14 09:49:57 +03:00
Miguel Cabrerizo
0f3c33cb86
feat: show basic info start-from-init () 2023-07-12 20:46:50 +03:00
Tim Möhlmann
6907b52b32
chore(deps): update oidc () 2023-06-09 15:18:14 +00:00
Tim Möhlmann
a301c40f9f
feat: implement register Passkey user API v2 ()
* command/crypto: DRY the code

- reuse the the algorithm switch to create a secret generator
- add a verifyCryptoCode function

* command: crypto code tests

* migrate webauthn package

* finish integration tests with webauthn mock client
2023-05-24 10:22:00 +00:00
Tim Möhlmann
6839a5c203
chore: update oidc () 2023-05-24 08:11:56 +00:00
Tim Möhlmann
5819924275
feat: device authorization RFC 8628 ()
* device auth: implement the write events

* add grant type device code

* fix(init): check if default value implements stringer

---------

Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
2023-04-19 08:46:02 +00:00
Stefan Benz
440ba9f5ef
fix: update saml to v0.0.11 ()
* fix: update saml to v0.0.11

* chore: remove unused sum

---------

Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
2023-04-11 07:39:12 +00:00
Silvan
698f46fe6a
chore: update dependencies ()
* chore(backend): update dependencies

* chore(pipeline): update golangci-lint
2023-04-06 06:29:55 +00:00
Livio Spring
991a56341b
fix: role claims mapping ()
* fix: role claims mapping

* update oidc pkg

* update oidc pkg
2023-04-04 12:36:39 +00:00
Tim Möhlmann
25c3c17986
chore: upgrade to oidc v2 release ()
* chore: upgrade to oidc v2 release

* fix tests

* fix build errors after rebase

* pin oidc v2.1.0

* pin oidc v2.1.1 (include bugfix)

* pin oidc v2.1.2 (include bugfix)

* pin oidc v2.2.1 (bugfix)

include fix 

* fix: refresh token handling

* simplify cognitive complexity

* fix: handle error

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-03-28 11:28:56 +00:00
Stefan Benz
41ff0bbc63
feat: ldap provider login ()
Add the logic to configure and use LDAP provider as an external IDP with a dedicated login GUI.
2023-03-24 15:18:56 +00:00
Silvan
20e4f1ce57
feat(actions): add fields to complement token flow ()
* deprecated `ctx.v1.userinfo`-field in "pre userinfo creation" trigger in favour of `ctx.v1.claims`. The trigger now behaves the same as "pre access token creation"
* added `ctx.v1.claims` to "complement tokens" flow
* added `ctx.v1.grants` to "complement tokens" flow
* document `ctx.v1.getUser()` in "complement tokens" flow

* feat(actions): add getUser() and grant

* map user grants

* map claims

* feat(actions): claims in complement token ctx

* docs(actions): add new fields of complement token

* docs(actions): additions to complement token

* docs(actions): correct field names
2023-03-08 15:26:28 +01:00
Silvan
e38abdcdf3
perf: query data AS OF SYSTEM TIME ()
Queries the data in the storage layser at the timestamp when the call hit the API layer
2023-02-27 22:36:43 +01:00
Livio Spring
80003939ad
feat(api): add oidc and jwt provider template ()
Adds possibility to manage OIDC and JWT template based providers
2023-02-27 16:32:18 +01:00
Florian Forster
aa9518ac02
docs: improve api docs ()
* integrate docs into nav

* generator for local use, production needs to be set by env

* fix typo

* local dev

* docs: annotate the first user endpoints in the management api

* docs: annotate the first user endpoints in the management api

* docs: annotate the first user endpoints in the management api

* docs: annotate the first user endpoints in the management api

* docs: add header params

* rewrite docs links and improve ci

* tweak build command

* fix path

* Update docs/docusaurus.config.js

Co-authored-by: Max Peintner <max@caos.ch>

* fix docker

* docs: add header params

* docs: Add tags to management api. add some descriptions

* docs: more descriptions

* docs: more descriptions

* docs: required fields

* docs: example request

* docs: example request

* docs: example request

* docs: example request

* docs: example request

* docs: user metadata requests

* docs: user requests

* docs: user requests

* docs: user requests

* docs: user requests

* docs: change nav add first methods to authentication api

* docs: auth api

* docs: auth api

* docs: auth api

* docs: auth api

* docs: auth api

* docs: api sidenav

* chore: use buf without docker

* fix deploy

* fix ci

* fix vercel

* docs: admin

* docs: admin api docs

* docs: admin api docs

* docs: admin api docs

* docs: admin api docs

* docs: security

* docs: security

* docs: admin api

* docs: change to env vars

* docs: auth api

* docs: remove assets, deprecated requests, menu

* reworked page with PaloAltoNetworks/docusaurus-openapi-docs

* works with the resolutions

* fix broken build by adding assets again

* add tags to menu

* chore: improve build speed

* no-minify

* test ssr

* ssr 20

* use lazy

* increase mem

* use default mem

* change names

* docs: remove assets, deprecated requests, menu

* docs: management api

* docs: management api

* docs: management api

* docs: sidebar

* not the best word smithing but it is ;-)

* more typos

* merge main

* fix some error

* trial

* update grpc gateway

* trigger vercel build

* docs: deprecated requests

* docs: deprecated requests

---------

Co-authored-by: Fabienne <fabienne.gerschwiler@gmail.com>
Co-authored-by: Max Peintner <max@caos.ch>
2023-02-23 18:08:06 +07:00
Stefan Benz
50728129ee
fix: update saml dependency to v0.0.10 ()
* fix: update saml dependency to v0.0.10

* fix: update saml dependency to v0.0.10
2023-02-22 14:24:27 +00:00
Stefan Benz
586495a0be
feat: add management for ldap idp template ()
Add management functionality for LDAP idps with templates and the basic functionality for the LDAP provider, which can then be used with a separate login page in the future.

---------

Co-authored-by: Livio Spring <livio.a@gmail.com>
2023-02-15 08:14:59 +00:00
Stefan Benz
3616b6b028
feat(api): allow specifying access_token type (opaque/JWT) for service users ()
Add functionality to configure the access token type on the service accounts to provide the oidc library with the necessary information to create the right type of access token.
2023-02-08 08:06:34 +00:00
Stefan Benz
e2fdd3f077
feat: support client_credentials for service users ()
Request an access_token for service users with OAuth 2.0 Client Credentials Grant. Added functionality to generate and remove a secret on service users.
2023-01-31 19:52:47 +00:00
Livio Spring
598a4d2d4b
feat: add basic structure of idp templates ()
add basic structure and implement first providers for IDP templates to be able to manage and use them in the future
2023-01-23 08:11:40 +01:00
Livio Spring
0a30e39b46
fix(CORS): add X-Requested-With to Access-Control-Request-Headers ()
allows clients with `X-Requested-With` header to succeed with their CORS request
2023-01-09 13:37:10 +01:00
Silvan
384cc34303
chore: cockroach version ()
* chore: cockroach version for tests
2022-12-02 09:42:27 +00:00
Stefan Benz
24ae69b726
fix: update saml dependency v0.0.8=>v0.0.9 () 2022-11-15 06:30:36 +00:00
Stefan Benz
4ba45280fe
fix(saml): update saml dependency () 2022-10-25 14:06:53 +02:00
Silvan
43fb3fd1a6
feat(actions): add token customization flow and extend functionally with modules ()
* fix: potential memory leak

* feat(actions): possibility to parse json
feat(actions): possibility to perform http calls

* add query call

* feat(api): list flow and trigger types
fix(api): switch flow and trigger types to dynamic objects

* fix(translations): add action translations

* use `domain.FlowType`

* localizers

* localization

* trigger types

* options on `query.Action`

* add functions for actions

* feat: management api: add list flow and trigger  ()

* console changes

* cleanup

* fix: wrong localization

Co-authored-by: Max Peintner <max@caos.ch>

* id token works

* check if claims not nil

* feat(actions): metadata api

* refactor(actions): modules

* fix: allow prerelease

* fix: test

* feat(actions): deny list for http hosts

* feat(actions): deny list for http hosts

* refactor: actions

* fix: different error ids

* fix: rename statusCode to status

* Actions objects as options ()

* fix: rename statusCode to status

* fix(actions): objects as options

* fix(actions): objects as options

* fix(actions): set fields

* add http client to old actions

* fix(actions): add log module

* fix(actions): add user to context where possible

* fix(actions): add user to ctx in external authorization/pre creation

* fix(actions): query correct flow in claims

* test: actions

* fix(id-generator): panic if no machine id

* tests

* maybe this?

* fix linting

* refactor: improve code

* fix: metadata and usergrant usage in actions

* fix: appendUserGrant

* fix: allowedToFail and timeout in action execution

* fix: allowed to fail in token complement flow

* docs: add action log claim

* Update defaults.yaml

* fix log claim

* remove prerelease build

Co-authored-by: Max Peintner <max@caos.ch>
Co-authored-by: Livio Spring <livio.a@gmail.com>
2022-10-06 14:23:59 +02:00
Stefan Benz
7a5f7f82cf
feat(saml): implementation of saml for ZITADEL v2 () 2022-09-12 18:18:08 +02:00
Silvan
77b4fc5487
feat(database): support for postgres ()
* beginning with postgres statements

* try pgx

* use pgx

* database

* init works for postgres

* arrays working

* init for cockroach

* init

* start tests

* tests

* TESTS

* ch

* ch

* chore: use go 1.18

* read stmts

* fix typo

* tests

* connection string

* add missing error handler

* cleanup

* start all apis

* go mod tidy

* old update

* switch back to minute

* on conflict

* replace string slice with `database.StringArray` in db models

* fix tests and start

* update go version in dockerfile

* setup go

* clean up

* remove notification migration

* update

* docs: add deploy guide for postgres

* fix: revert sonyflake

* use `database.StringArray` for daos

* use `database.StringArray` every where

* new tables

* index naming,
metadata primary key,
project grant role key type

* docs(postgres): change to beta

* chore: correct compose

* fix(defaults): add empty postgres config

* refactor: remove unused code

* docs: add postgres to self hosted

* fix broken link

* so?

* change title

* add mdx to link

* fix stmt

* update goreleaser in test-code

* docs: improve postgres example

* update more projections

* fix: add beta log for postgres

* revert index name change

* prerelease

* fix: add sequence to v1 "reduce paniced"

* log if nil

* add logging

* fix: log output

* fix(import): check if org exists and user

* refactor: imports

* fix(user): ignore malformed events

* refactor: method naming

* fix: test

* refactor: correct errors.Is call

* ci: don't build dev binaries on main

* fix(go releaser): update version to 1.11.0

* fix(user): projection should not break

* fix(user): handle error properly

* docs: correct config example

* Update .releaserc.js

* Update .releaserc.js

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
Co-authored-by: Elio Bischof <eliobischof@gmail.com>
2022-08-31 07:52:43 +00:00
Livio Spring
f610d48569
feat: prepare for multiple database types ()
BREAKING CHANGE: the database and admin user config has changed.
2022-07-28 16:25:42 +02:00
Stefan Benz
bc9a85daf3
feat: V2 alpha import and export of organizations ()
* feat(import): add functionality to import data into an instance

* feat(import): move import to admin api and additional checks for nil pointer

* fix(export): export implementation with filtered members and grants

* fix: export and import implementation

* fix: add possibility to export hashed passwords with the user

* fix(import): import with structure of v1 and v2

* docs: add v1 proto

* fix(import): check im imported user is already existing

* fix(import): add otp import function

* fix(import): add external idps, domains, custom text and messages

* fix(import): correct usage of default values from login policy

* fix(export): fix renaming of add project function

* fix(import): move checks for unit tests

* expect filter

* fix(import): move checks for unit tests

* fix(import): move checks for unit tests

* fix(import): produce prerelease from branch

* fix(import): correctly use provided user id for machine user imports

* fix(import): corrected otp import and added guide for export and import

* fix: import verified and primary domains

* fix(import): add reading from gcs, s3 and localfile with tracing

* fix(import): gcs and s3, file size correction and error logging

* Delete docker-compose.yml

* fix(import): progress logging and count of resources

* fix(import): progress logging and count of resources

* log subscription

* fix(import): incorporate review

* fix(import): incorporate review

* docs: add suggestion for import

Co-authored-by: Fabi <38692350+hifabienne@users.noreply.github.com>

* fix(import): add verification otp event and handling of deleted but existing users

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
Co-authored-by: Fabienne <fabienne.gerschwiler@gmail.com>
Co-authored-by: Silvan <silvan.reusser@gmail.com>
Co-authored-by: Fabi <38692350+hifabienne@users.noreply.github.com>
2022-07-28 13:42:35 +00:00
Livio Spring
c15577c1f9
fix: use default redirect uri when not passed on end_session endpoint ()
* fix: use default redirect uri when not passed on end_session endpoint

* instance state
2022-07-27 09:49:16 +02:00
Livio Spring
ccde49b323
feat: extend claims of introspection response ()
* feat: extend claims of introspection response

* update oidc lib
2022-07-25 09:38:15 +02:00
Livio Spring
aed7010508
fix: scheduling ()
* fix: improve scheduling

* build pre-release

* fix: locker

* fix: user handler and print stack in case of panic in reducer

* chore: remove sentry

* fix: improve handler projection and implement tests

* more tests

* fix: race condition in tests

* Update internal/eventstore/repository/sql/query.go

Co-authored-by: Silvan <silvan.reusser@gmail.com>

* fix: implemented suggested changes

* fix: lock statement

Co-authored-by: Silvan <silvan.reusser@gmail.com>
2022-07-22 10:08:39 +00:00
Livio Spring
f4e91f0b5b
fix: update oidc pkg (state and redirect_uri handling) () 2022-06-22 07:31:36 +00:00
Alexei-Barnes
09b021b257
feat: Configurable Unique Machine Identification ()
* feat: Configurable Unique Machine Identification

This change fixes Segfault on AWS App Runner with v2 

The change introduces two new dependencies:

* github.com/drone/envsubst for supporting AWS ECS, which has its metadata endpoint described by an environment variable
* github.com/jarcoal/jpath so that only relevant data from a metadata response is used to identify the machine.

The change ads new configuration (see `defaults.yaml`):

* `Machine.Identification` enables configuration of how machines are uniquely identified - I'm not sure about the top level category `Machine`, as I don't have anything else to add to it. Happy to hear suggestions for better naming or structure here.
* `Machine.Identifiation.PrivateId` turns on or off the existing private IP based identification. Default is on.
* `Machine.Identification.Hostname` turns on or off using the OS hostname to identify the machine. Great for most cloud environments, where this tends to be set to something that identifies the machine uniquely. Enabled by default.
* `Machine.Identification.Webhook` configures identification based on the response to an HTTP GET request.  Request headers can be configured, a JSONPath can be set for processing the response (no JSON parsing is done if this is not set), and the URL is allowed to contain environment variables in the format `"${var}"`.

The new flow for getting a unique machine id is:

1. PrivateIP (if enabled)
2. Hostname (if enabled)
3. Webhook (if enabled, to configured URL)
4. Give up and error out.

It's important that init configures machine identity first. Otherwise we could try to get an ID before configuring it. To prevent this from causing difficult to debug issues, where for example the default configuration was used, I've ensured that
the application will generate an error if the module hasn't been configured and you try to get an ID.

Misc changes:

* Spelling and gramatical corrections to `init.go::New()` long description.
* Spelling corrections to `verify_zitadel.go::newZitadel()`.
* Updated `production.md` and `development.md` based on the new build process. I think the run instructions are also out of date, but I'll leave that for someone else.
* `id.SonyFlakeGenerator` is now a function, which sets `id.sonyFlakeGenerator`, this allows us to defer initialization until configuration has been read.

* Update internal/id/config.go

Co-authored-by: Alexei-Barnes <82444470+Alexei-Barnes@users.noreply.github.com>

* Fix authored by @livio-a for tests

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-05-24 16:57:57 +02:00
Florian Forster
fa9f581d56
chore(v2): move to new org ()
* chore: move to new org

* logging

* fix: org rename caos -> zitadel

Co-authored-by: adlerhurst <silvan.reusser@gmail.com>
2022-04-26 23:01:45 +00:00
Livio Amstutz
75ec73ca4a
feat: dynamic issuer ()
* feat: dynamic issuer

* dynamic domain handling

* key rotation durations

* feat: dynamic issuer

* make webauthn displayname dynamic
2022-04-25 10:01:17 +02:00
Livio Amstutz
b949b8fc65
chore(deps): update oidc to 1.2.0 ()
* chore(deps): update oidc to 1.2.0

* add comment
2022-04-05 07:22:00 +00:00
Livio Amstutz
504fe5b761
cherry pick changes from main ()
* feat: remove exif data from uploaded images ()

* feat: remove exif tags from images

* feat: remove exif data

* feat: remove exif

* fix: add preferredLoginName to user grant response ()

* chore: log webauthn parse error ()

* log error

* log error

* feat: Help link in privacy policy

* fix: convert correct detail data on organization ()

* fix: handle empty editor users

* fix: add some missing translations ()

* fix: org policy translations

* fix: metadata event types translation

* fix: translations

* fix: filter resource owner correctly on project grant members ()

* fix: filter resource owner correctly on project grant members

* fix: filter resource owner correctly on project grant members

* fix: add orgIDs to zitadel permissions request

Co-authored-by: fabi <fabienne.gerschwiler@gmail.com>

* fix: get IAM memberships correctly in MyZitadelPermissions ()

* fix: correct login names on auth and notification users ()

* fix: correct login names on auth and notification users

* fix: migration

* fix: handle resource owner in action flows ()

* fix merge

* fix: exchange exif library ()

* fix: exchange exif library

* ignore tiffs

* requested fixes

* feat: Help link in privacy policy

Co-authored-by: Fabi <38692350+fgerschwiler@users.noreply.github.com>
Co-authored-by: fabi <fabienne.gerschwiler@gmail.com>
2022-03-24 14:00:24 +01:00
Fabi
e3528ff0b2
feat: Config to eventstore ()
* feat: add default language to eventstore

* feat: add secret generator configs events

* feat: tests

* feat: secret generators in eventstore

* feat: secret generators in eventstore

* feat: smtp config in eventstore

* feat: smtp config in eventstore

* feat: smtp config in eventstore

* feat: smtp config in eventstore

* feat: smtp config in eventstore

* fix: migrations

* fix migration version

* fix test

* feat: change secret generator type to enum

* feat: change smtp attribute names

* feat: change smtp attribute names

* feat: remove engryption algorithms from command side

* feat: remove engryption algorithms from command side

* feat: smtp config

* feat: smtp config

* format smtp from header

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-02-16 15:49:17 +00:00
Livio Amstutz
389eb4a27a
feat: run on a single port ()
* start v2

* start

* run

* some cleanup

* remove v2 pkg again

* simplify

* webauthn

* remove unused config

* fix login path in Dockerfile

* fix asset_generator.go

* health handler

* fix grpc web

* refactor

* merge

* build new main.go

* run new main.go

* update logging pkg

* fix error msg

* update logging

* cleanup

* cleanup

* go mod tidy

* change localDevMode

* fix customEndpoints

* update logging

* comments

* change local flag to external configs

* fix location generated go code

* fix

Co-authored-by: fforootd <florian@caos.ch>
2022-02-14 17:22:30 +01:00
Livio Amstutz
2d208dd8ba
fix: remove operator () 2022-02-11 15:00:14 +01:00
Silvan
e8ab237ada
fix(init): prepare database ()
* fix(init): prepare database

* fix(defaults): cockroach local defaults
2022-02-11 11:02:47 +01:00
Silvan
9d471d0d30
feat(cli): init cli ()
* feat(cli): initilize cli

* fix(config): allow multiple files

* refactor(cli): constructor naming

* go mod tidy

* refactor: move code out of v2 package

* chore: logging v0.1

* chore: remove old gitignore

* fix func

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-02-09 15:01:19 +01:00
Livio Amstutz
f1b02254b2
fix: update OIDC lib to handle keys without use () 2022-01-28 14:03:22 +00:00
Livio Amstutz
9ab566fdeb
fix(query): keys ()
* fix: add keys to projections

* change to multiple tables

* query keys

* query keys

* fix race condition

* fix timer reset

* begin tests

* tests

* remove migration

* only send to keyChannel if not nil
2022-01-12 13:22:04 +01:00
Elio Bischof
aa2a1848da
feat: add stdout and filesystem notification channels ()
* feat: add filesystem and stdout notification channels

* configure through env vars

* compile

* feat: add compact option for debug notification channels

* fix channel mock generation

* avoid sensitive information in error message

Co-authored-by: Livio Amstutz <livio.a@gmail.com>

* add review improvements

Co-authored-by: Livio Amstutz <livio.a@gmail.com>
2022-01-06 09:00:24 +01:00