Sebastiano Tocci
90294d6f01
Moved everything to the DB!
2025-02-15 23:20:32 +01:00
Sebastiano Tocci
5bb93a4130
Fixes #3406 : add configurable maximum queryable attributes for LDAP
2025-02-15 00:37:56 +01:00
CEbbinghaus
7a9bb9eac2
Feat: Allowing spn query with non-spn structured data in LDAP ( #3400 )
...
* Added Botch for fixing spn query
* Got Invalid filter working. spn can now be searched on
* Addressed review comments
* Resolved Invalid filter correctly for no index
* Cleaned comments and added tests (still 1 failing)
* Added comments and fixed unit test
* Formatting
* Made Clippy Happy
2025-02-08 06:37:28 +00:00
dependabot[bot]
ed76bdbfb1
Bump the all group with 22 updates ( #3376 )
...
* Bump the all group with 22 updates
Bumps the all group with 22 updates:
| Package | From | To |
| --- | --- | --- |
| [async-trait](https://github.com/dtolnay/async-trait ) | `0.1.83` | `0.1.85` |
| [bitflags](https://github.com/bitflags/bitflags ) | `2.6.0` | `2.8.0` |
| [clap](https://github.com/clap-rs/clap ) | `4.5.23` | `4.5.27` |
| [clap_complete](https://github.com/clap-rs/clap ) | `4.5.40` | `4.5.42` |
| [lodepng](https://github.com/kornelski/lodepng-rust ) | `3.10.7` | `3.11.0` |
| [openssl](https://github.com/sfackler/rust-openssl ) | `0.10.68` | `0.10.69` |
| [proc-macro2](https://github.com/dtolnay/proc-macro2 ) | `1.0.92` | `1.0.93` |
| [reqwest](https://github.com/seanmonstar/reqwest ) | `0.12.11` | `0.12.12` |
| [rustls](https://github.com/rustls/rustls ) | `0.23.20` | `0.23.21` |
| [sd-notify](https://github.com/lnicola/sd-notify ) | `0.4.4` | `0.4.5` |
| [serde_json](https://github.com/serde-rs/json ) | `1.0.134` | `1.0.137` |
| [syn](https://github.com/dtolnay/syn ) | `2.0.93` | `2.0.96` |
| [tempfile](https://github.com/Stebalien/tempfile ) | `3.14.0` | `3.15.0` |
| [tokio](https://github.com/tokio-rs/tokio ) | `1.42.0` | `1.43.0` |
| [uuid](https://github.com/uuid-rs/uuid ) | `1.11.0` | `1.12.1` |
| [oauth2](https://github.com/ramosbugs/oauth2-rs ) | `4.4.2` | `5.0.0` |
| [cc](https://github.com/rust-lang/cc-rs ) | `1.2.6` | `1.2.10` |
| [axum-extra](https://github.com/tokio-rs/axum ) | `0.9.6` | `0.10.0` |
| [axum-macros](https://github.com/tokio-rs/axum ) | `0.4.2` | `0.5.0` |
| [fantoccini](https://github.com/jonhoo/fantoccini ) | `0.21.3` | `0.21.4` |
| [petgraph](https://github.com/petgraph/petgraph ) | `0.6.5` | `0.7.1` |
| [jsonschema](https://github.com/Stranger6667/jsonschema ) | `0.28.0` | `0.28.3` |
Updates `async-trait` from 0.1.83 to 0.1.85
- [Release notes](https://github.com/dtolnay/async-trait/releases )
- [Commits](https://github.com/dtolnay/async-trait/compare/0.1.83...0.1.85 )
Updates `bitflags` from 2.6.0 to 2.8.0
- [Release notes](https://github.com/bitflags/bitflags/releases )
- [Changelog](https://github.com/bitflags/bitflags/blob/main/CHANGELOG.md )
- [Commits](https://github.com/bitflags/bitflags/compare/2.6.0...2.8.0 )
Updates `clap` from 4.5.23 to 4.5.27
- [Release notes](https://github.com/clap-rs/clap/releases )
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.23...clap_complete-v4.5.27 )
Updates `clap_complete` from 4.5.40 to 4.5.42
- [Release notes](https://github.com/clap-rs/clap/releases )
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.40...clap_complete-v4.5.42 )
Updates `lodepng` from 3.10.7 to 3.11.0
- [Commits](https://github.com/kornelski/lodepng-rust/compare/v3.10.7...v3.11.0 )
Updates `openssl` from 0.10.68 to 0.10.69
- [Release notes](https://github.com/sfackler/rust-openssl/releases )
- [Commits](https://github.com/sfackler/rust-openssl/compare/openssl-v0.10.68...openssl-v0.10.69 )
Updates `proc-macro2` from 1.0.92 to 1.0.93
- [Release notes](https://github.com/dtolnay/proc-macro2/releases )
- [Commits](https://github.com/dtolnay/proc-macro2/compare/1.0.92...1.0.93 )
Updates `reqwest` from 0.12.11 to 0.12.12
- [Release notes](https://github.com/seanmonstar/reqwest/releases )
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md )
- [Commits](https://github.com/seanmonstar/reqwest/compare/v0.12.11...v0.12.12 )
Updates `rustls` from 0.23.20 to 0.23.21
- [Release notes](https://github.com/rustls/rustls/releases )
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rustls/rustls/compare/v/0.23.20...v/0.23.21 )
Updates `sd-notify` from 0.4.4 to 0.4.5
- [Changelog](https://github.com/lnicola/sd-notify/blob/master/CHANGELOG.md )
- [Commits](https://github.com/lnicola/sd-notify/compare/v0.4.4...v0.4.5 )
Updates `serde_json` from 1.0.134 to 1.0.137
- [Release notes](https://github.com/serde-rs/json/releases )
- [Commits](https://github.com/serde-rs/json/compare/v1.0.134...v1.0.137 )
Updates `syn` from 2.0.93 to 2.0.96
- [Release notes](https://github.com/dtolnay/syn/releases )
- [Commits](https://github.com/dtolnay/syn/compare/2.0.93...2.0.96 )
Updates `tempfile` from 3.14.0 to 3.15.0
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Stebalien/tempfile/compare/v3.14.0...v3.15.0 )
Updates `tokio` from 1.42.0 to 1.43.0
- [Release notes](https://github.com/tokio-rs/tokio/releases )
- [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.42.0...tokio-1.43.0 )
Updates `uuid` from 1.11.0 to 1.12.1
- [Release notes](https://github.com/uuid-rs/uuid/releases )
- [Commits](https://github.com/uuid-rs/uuid/compare/1.11.0...1.12.1 )
Updates `oauth2` from 4.4.2 to 5.0.0
- [Release notes](https://github.com/ramosbugs/oauth2-rs/releases )
- [Upgrade guide](https://github.com/ramosbugs/oauth2-rs/blob/main/UPGRADE.md )
- [Commits](https://github.com/ramosbugs/oauth2-rs/compare/4.4.2...5.0.0 )
Updates `cc` from 1.2.6 to 1.2.10
- [Release notes](https://github.com/rust-lang/cc-rs/releases )
- [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rust-lang/cc-rs/compare/cc-v1.2.6...cc-v1.2.10 )
Updates `axum-extra` from 0.9.6 to 0.10.0
- [Release notes](https://github.com/tokio-rs/axum/releases )
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md )
- [Commits](https://github.com/tokio-rs/axum/compare/axum-extra-v0.9.6...axum-extra-v0.10.0 )
Updates `axum-macros` from 0.4.2 to 0.5.0
- [Release notes](https://github.com/tokio-rs/axum/releases )
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md )
- [Commits](https://github.com/tokio-rs/axum/compare/axum-macros-v0.4.2...axum-macros-v0.5.0 )
Updates `fantoccini` from 0.21.3 to 0.21.4
- [Commits](https://github.com/jonhoo/fantoccini/compare/v0.21.3...v0.21.4 )
Updates `petgraph` from 0.6.5 to 0.7.1
- [Changelog](https://github.com/petgraph/petgraph/blob/master/RELEASES.rst )
- [Commits](https://github.com/petgraph/petgraph/compare/petgraph@v0.6.5...petgraph@v0.7.1 )
Updates `jsonschema` from 0.28.0 to 0.28.3
- [Release notes](https://github.com/Stranger6667/jsonschema/releases )
- [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Stranger6667/jsonschema/compare/rust-v0.28.0...rust-v0.28.3 )
---
updated-dependencies:
- dependency-name: async-trait
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: bitflags
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: clap
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: clap_complete
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: lodepng
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: openssl
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: proc-macro2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: reqwest
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: rustls
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: sd-notify
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: serde_json
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: syn
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: tempfile
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: tokio
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: uuid
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: oauth2
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: cc
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: axum-extra
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: axum-macros
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: fantoccini
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: petgraph
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: jsonschema
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
...
Signed-off-by: dependabot[bot] <support@github.com>
* ok the otel stuff works now
* linting fixes
* fix: less parse more from_str, adding a todo
* fix: removing a TODO
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2025-01-29 13:57:38 +10:00
Firstyear
938ad90f3b
20240906 Attribute as an Enum Type ( #3025 )
...
Changes attribute from a string to an enum - this provides many performance improvements and memory savings throughout the server.
2024-09-09 00:53:10 +00:00
James Hodgkinson
3eae7be0bb
OAuth2 Token Type ( #3008 )
...
* fix(OAuth2): Invalid `token_type` for token introspection
Fixes #3005
* fix(aut): `assert_eq` instead of `assert ==`
* fix(OAuth2): IANA registry access token types
* fix(OAuth2): deserialize case insensitively
2024-08-25 23:30:20 +00:00
James Hodgkinson
7c3deab2c4
enforcen den clippen ( #2990 )
...
* enforcen den clippen
* updating outdated oauth2-related docs
* sorry clippy, we tried
2024-08-21 00:32:56 +00:00
Firstyear
239f4594dd
20240810 application passwords ( #2968 )
...
Add the server side components for application passwords. This adds the needed datatypes and handling via the ldap components.
Admin tools will be in a follow up PR.
Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Co-authored-by: Samuel Cabrero <scabrero@suse.de>
2024-08-20 06:44:37 +00:00
Firstyear
36b6fda787
Mail substr index ( #2981 )
2024-08-18 02:49:24 +00:00
Firstyear
3ae8453375
In honour of SebaT, error on db lock acq timeout ( #2947 )
2024-08-02 09:29:46 +10:00
Tobias Krischer
814380a7f4
feat: add support for ldap compare request ( #2780 )
2024-05-25 08:28:52 +10:00
Firstyear
afc130ab89
Support 1.1 attribute in LDAP ( #2720 )
2024-04-24 13:46:56 +10:00
Firstyear
d7834b52e6
Begin the basis of the key provider model ( #2640 )
...
This completely reworks how we approach and handle cryptographic keys in Kanidm. This is needed as a foundation for replication coordination which will require handling and rotation of cryptographic keys in automated ways.
This change influences many other parts of the code base in it's implementation.
The primary influences are:
* Modification of how domain user signing keys are revoked or rotated.
* Merging of all existing service-account token keys are retired (retained) keys into the domain to simplify token signing and validation
* Allowing multiple configurations of local command line tools to swap between instances using disparate signing keys.
* Modification of key retrieval to be key id based (KID), removing the need to embed the JWK into tokens
A side effect of this change is that most user authentication sessions and oauth2 sessions will have to be re-established after upgrade. However we feel that session renewal after upgrade is an expected side effect of an upgrade.
In the future this lays the ground work to remove a large number of legacy key handling processes that have evolved, which will allow large parts of code to be removed.
2024-04-15 23:44:37 +00:00
Firstyear
b4d9cdd7d5
20240301 systemd uid ( #2602 )
...
Fixes #2601 Fixes #393 - gid numbers can be part of the systemd nspawn range.
Previously we allocated gid numbers based on the fact that uid_t is a u32, so we allowed 65536 through u32::max. However, there are two major issues with this that I didn't realise. The first is that anything greater than i32::max (2147483648) can confuse the linux kernel.
The second is that systemd allocates 524288 through 1879048191 to itself for nspawn.
This leaves with with only a few usable ranges.
1000 through 60000
60578 through 61183
65520 through 65533
65536 through 524287
1879048192 through 2147483647
The last range being the largest is the natural and obvious area we should allocate from. This happens to nicely fall in the pattern of 0x7000_0000 through 0x7fff_ffff which allows us to take the last 24 bits of the uuid then applying a bit mask we can ensure that we end up in this range.
There are now two major issues.
We have now changed our validation code to enforce a tighter range, but we may have already allocated users into these ranges.
External systems like FreeIPA allocated uid/gid numbers with reckless abandon directly into these ranges.
As a result we need to make two concessions.
We *secretly* still allow manual allocation of id's from 65536 through to 1879048191 which is the nspawn container range. This happens to be the range that freeipa allocates into. We will never generate an ID in this range, but we will allow it to ease imports since the users of these ranges already have shown they 'don't care' about that range. This also affects SCIM imports for longer term migrations.
Second is id's that fall outside the valid ranges. In the extremely unlikely event this has occurred, a startup migration has been added to regenerate these id values for affected entries to prevent upgrade issues.
An accidental effect of this is freeing up the range 524288 to 1879048191 for other subuid uses.
2024-03-07 03:25:54 +00:00
Firstyear
fbc021f487
20240221 2489 cleanup api v1 ( #2573 )
2024-02-27 09:25:02 +00:00
Firstyear
cc79b2a205
20231222 piv authentication ( #2398 )
...
Foundations of PIV authentication
2023-12-29 23:15:26 +00:00
Firstyear
3408816932
Add DN as a virtual ldap attr ( #2379 )
2023-12-19 15:07:19 +10:00
Firstyear
d09c2448ff
1481 2024 access control rework ( #2366 )
...
Rework default access controls to better separate roles and access profiles.
2023-12-17 23:10:13 +00:00
Firstyear
ac299b5286
Update to the latest compact-jwt version ( #2331 )
2023-11-24 02:53:22 +00:00
Firstyear
bb8914c70d
20231120 2320 sssd compat ( #2328 )
2023-11-22 10:18:03 +10:00
Samuel Cabrero
c3c0b5f459
Rework ldap bind routine ( #2268 )
...
Signed-off-by: Samuel Cabrero <scabrero@suse.de>
2023-11-01 15:09:22 +10:00
William Brown
ecc46bb015
Add book chapter + cli
2023-10-28 13:07:06 +10:00
NavinShrinivas
b80a3b271c
Cargo fmt and clippy checks
...
Signed-off-by: NavinShrinivas <karupal2002@gmail.com>
2023-10-28 13:07:06 +10:00
NavinShrinivas
12ea1c8702
Restrict posix passwords on ldap bind with config
...
Signed-off-by: NavinShrinivas <karupal2002@gmail.com>
2023-10-28 13:07:06 +10:00
Firstyear
6ff9082fd2
20231014 account policy ( #2218 )
...
* Start to prep for unix+ssh keys in credupdate session
2023-10-19 01:40:06 +00:00
James Hodgkinson
d9da1eeca0
Chasing yaks down dark alleyways ( #2207 )
...
* adding some test coverage because there was some rando panic-inducing thing
* ldap constants
* documenting a macro
* helpful weird errors
* the war on strings continues
* less json more better
* testing things fixing bugs
* idm_domain_reset_token_key wasn't working, added a test and fixed it (we weren't testing it)
* idm_domain_set_ldap_basedn - adding tests
* adding testing for idm_account_credential_update_cancel_mfareg
* warning of deprecation
2023-10-11 15:44:29 +10:00
James Hodgkinson
d5ed335b52
Cinco de yakko ( #2108 )
...
* there are always more yaks
* see? ldap yaks.
* fixing stupid radius container build thing
2023-09-16 12:11:06 +10:00
James Hodgkinson
383592d921
Schema dooby doo ... yon ( #2103 )
...
Refers #1987
Notable changes:
- in server/lib/src/entry.rs - aiming to pass the enum instead of the strings
- changed signature of add_ava to take Attribute instead of &str (which is used in the entry_init macro... which was fun)
- set_ava<T> now takes Attribute
- added TryFrom<&AttrString> for Attribute
2023-09-12 11:47:24 +10:00
James Hodgkinson
d5d76d1a3c
Schema dooby doo part two ( #2071 )
...
* scim strings!
* mapmapmap
* mapmapmap -comments and map
* updating delete teest
* fixing some tests
2023-09-05 16:58:42 +10:00
James Hodgkinson
05b35df413
Less human strings more enums ( #1989 )
...
* statics or enums you choose
* acp rewrite, defined SchemaAcp as a test
* macros and targetscopes and filters oh my
2023-08-21 17:16:43 +10:00
Firstyear
d731b20a9d
20230728 techdebt paydown ( #1909 )
2023-07-31 12:20:52 +10:00
Firstyear
0eaab19775
20230608 ldap sync ( #1728 )
2023-06-13 14:26:50 +10:00
Firstyear
1974d27dd8
Filter rdns and dns for ldap filters ( #1576 )
2023-04-27 22:37:44 +10:00
Firstyear
33f0034b80
20230424 clippppppppppppyyyyyyyy ( #1574 )
...
* Resolve a lot of clips
2023-04-26 21:55:42 +10:00
Firstyear
c1f62674f5
1496 ldap basedn config ( #1500 )
2023-03-29 09:34:43 +10:00
Firstyear
0e57b6f914
1399 some async cleanup ( #1421 )
...
* More cleanerer
* More async!
* Fix up tests
2023-03-03 17:53:54 +10:00
Firstyear
00cca81012
1399 cleanup reorg ( #1412 )
2023-03-01 13:10:52 +10:00
