Commit graph

133 commits

Author SHA1 Message Date
Vladimir Dronnikov 221445d387
expose group patch for parity (#2628)
Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2024-03-07 09:54:20 +10:00
Firstyear 3760951b6d
Add domain version test framework (#2576)
Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2024-02-28 21:04:33 +00:00
Firstyear fbc021f487
20240221 2489 cleanup api v1 (#2573) 2024-02-27 09:25:02 +00:00
James Hodgkinson 4efdb7208f
of course I started looking at clippy things and now I can't stop (#2560) 2024-02-21 00:52:10 +00:00
Firstyear 68d788a9f7
20240216 308 resource limits (#2559)
This adds account policy based resource limits to control the maximum
number of entries that an account may query
2024-02-21 00:15:43 +00:00
James Hodgkinson 097db70c3d
prctl compile-time fixes, also chasing lints (#2558)
* fixing up error handling for prctl calls
* minor clippy lintypoos
* making clippy happier
* clippizing a test
* more clippy-calming
* adding tpm-udev to ubuntu flows for testing
* rebuilt wasm
* moving from rg to grep because someone doesn't like nice things
* such clippy like wow
* clippy config to the rescue
2024-02-20 18:21:33 +10:00
Firstyear 816fde766f
Fix update intent ttl parameters (#2540) 2024-02-16 07:02:36 +00:00
Firstyear e3e77fe7b4
Update to latest dev version (#2486) 2024-02-08 09:54:07 +10:00
Firstyear d42268269a
20240125 2217 client credentials grant (#2456)
* Huge fix of a replication problem.
* Update test
* Increase min replication level
* Client Credentials Grant implementation
2024-02-01 02:00:29 +00:00
James Hodgkinson c8bd1739f9
PyKanidm updates and testing (#2301)
* otel can eprintln kthx

* started python integration tests, features

* more tests more things

* adding heaps more things

* updating docs

* fixing python test

* fixing errors, updating integration test

* Add models for OAuth2, Person, ServiceAccount and add missing endpoints

* Alias Group to GroupInfo to keep it retrocompatible

* Fixed issues from review

* adding oauth2rs_get_basic_secret

* adding oauth2rs_get_basic_secret

* Fixed mypy issues

* adding more error logs

* updating test scripts and configs

* fixing tests and validating things

* more errors

---------

Co-authored-by: Dogeek <simon.bordeyne@gmail.com>
2024-01-31 03:27:43 +00:00
Firstyear 86916a3d87
Return sshkey label to cli fields (#2440)
* Return ssh label to cli fields
2024-01-20 17:17:57 +10:00
Firstyear 8dc884f38e
2390 1980 allow native applications (#2428) 2024-01-16 10:44:12 +10:00
Firstyear 3b0b350c9e
cookies (#2426) 2024-01-13 09:21:59 +10:00
Firstyear d09c2448ff
1481 2024 access control rework (#2366)
Rework default access controls to better separate roles and access profiles.
2023-12-17 23:10:13 +00:00
James Hodgkinson cbadf0af9b
Unixd build/debugging updates (#2350)
* noisy for no reason message
* updating build script to include unix modules
* adding restart config for kanidm systemd services
2023-12-03 06:34:02 +00:00
Firstyear 76269f9de2
20231129 webauthn attestation (#2351)
This adds full support for attestation of webauthn/passkeys.
2023-12-03 06:13:52 +00:00
Firstyear 31b939fca3
20231128 freeipa migration (#2338)
* Add more weak password formats for freeipa
* Verification of freeipa migration from older ipa versions
2023-11-29 10:43:15 +10:00
Firstyear 060cb729a7
Expose TPM in more interface places (#2334) 2023-11-27 14:35:59 +10:00
James Hodgkinson c1f1720ee2
Adding kanidm client config docs and notes ref #2248 (#2333) 2023-11-25 09:55:54 +10:00
James Hodgkinson 916bb4ec04
Adding env var configs for the server (#2329)
* env var config for server
* I am my own clippy now
* Man, that got complicated quick
2023-11-24 01:27:49 +00:00
Firstyear 47bcea7708
20231109 1122 credential class (#2300)
* Add CredentialType for acc pol
* Reword ui hints
* Finish account policy
* Clean up artefacts
2023-11-11 09:26:44 +10:00
James Hodgkinson 60e5935faa
Moving daemon tracing to OpenTelemetry (#2292)
* sally forth into the great otel unknown
* make the build env identification slightly more durable
* docs updates
* wasm recompile
2023-11-09 05:15:12 +00:00
Firstyear 3bd2cc8a9f
20231101 add id cert to unixint (#2284) 2023-11-09 13:11:23 +10:00
Firstyear b7852d1d71
pw min length in account policy (#2289) 2023-11-05 10:33:25 +10:00
James Hodgkinson 7025a9ff55
Feature: kanidm CLI pulling OpenAPI schema (#2285)
* diag is super noisy when you actually turn on logging... even though it wasn't an error?
* adding api download-schema to the CLI
* docs
2023-11-03 17:37:27 +10:00
Allan dbf476fe5e
Remove unused imports and clippy lint (#2276)
* Fix unused import errors
* Apply clippy get_first lint
* Add contributor

---------

Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2023-11-01 05:54:29 +00:00
William Brown 4a08b77285 make versions consistent 2023-10-31 21:24:07 +10:00
James Hodgkinson fcd9a7b938 1.1.0 rc.15 dev post-release (#2271)
* versions in cargo.toml, descriptions etc
* updated release checklist
2023-10-31 21:24:07 +10:00
James Hodgkinson 3bfc347c53
CLI integration test beginnings (#2261)
* more integration test things, using assert_cmd to test the CLI end-to-end
* packagez
* making clippy happy
* making deno happy
2023-10-30 06:10:54 +00:00
William Brown ecc46bb015 Add book chapter + cli 2023-10-28 13:07:06 +10:00
James Hodgkinson e02328ae8b
Splitting the SPAs (#2219)
* doing some work for enumerating how the accounts work together
* fixing up build scripts and removing extra things
* making JavaScript as_tag use the struct field names
* making shared.js a module, removing wasmloader.js
* don't compress compressed things
2023-10-27 06:03:58 +00:00
James Hodgkinson 7093149975
Auth flow docs (#2249) 2023-10-24 04:00:37 +00:00
Firstyear afe9d28754
20231019 1122 account policy basics (#2245)
---------

Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2023-10-22 11:16:42 +00:00
James Hodgkinson 6850a17e8c
Windows build fixes and test coverage (#2220)
* adding testing for users functions
* turning KanidmClient build error into a ClientError
* removing a redundant closure
2023-10-17 07:18:07 +00:00
James Hodgkinson f28d5cef22
OpenAPI/swagger docs autogen (#2175)
* always be clippyin'
* pulling oauth2 api things out into their own module
* starting openapi generation
2023-10-14 12:39:14 +10:00
Firstyear 8bcf1935a5
20231012 346 name deny list (#2214)
* Migrate to improved system config reload, cleanup acc pol
* Denied names feature
2023-10-13 08:50:36 +10:00
Firstyear 88da55260a
Add file diagnosis (#2210) 2023-10-12 12:09:54 +10:00
James Hodgkinson d9da1eeca0
Chasing yaks down dark alleyways (#2207)
* adding some test coverage because there was some rando panic-inducing thing
* ldap constants
* documenting a macro
* helpful weird errors
* the war on strings continues
* less json more better
* testing things fixing bugs
* idm_domain_reset_token_key wasn't working, added a test and fixed it (we weren't testing it)
* idm_domain_set_ldap_basedn - adding tests
* adding testing for idm_account_credential_update_cancel_mfareg
* warning of deprecation
2023-10-11 15:44:29 +10:00
James Hodgkinson 0adc3e0dd9
Chasing wooly quadrapeds again (#2163)
* I really like well-tended yaks
* documenting yaks
* spellink
* less surprise more good
* schema test fix
* clippyisms
2023-10-05 12:30:46 +10:00
Firstyear f6d2bcb44b
68 20230929 replication finalisation (#2160)
Replication is now ready for test deployments!
2023-10-05 11:11:27 +10:00
James Hodgkinson e7f594a1c1
In-system image storage (#2112)
* In-system image storage refers to #2057
* adding multipart feature to axum
* thanks to @Firstyear for fixing my bufs
* fixing coverage test things
* clippy-calming
* more tests, jpg acropalypse tests, benches
* spelling
* lockfile updates
* linting
2023-10-04 17:24:12 +10:00
Firstyear 3e345174b6
68 20230919 replication configuration (#2131) 2023-09-29 12:02:13 +10:00
James Hodgkinson c7a269575c
Enforce TLS key size minimums (#2145)
* Enforce TLS key size minimums - Fixes #2144
* at some point clippy got mad
2023-09-26 09:59:00 +10:00
James Hodgkinson c998a1eda5
bindaddress default doesn't match documentation (#2150)
Fixes #2147
2023-09-26 09:38:07 +10:00
James Hodgkinson 9b2fab7bb1
CLI and kanidm_client changes to handle errors and TLS validation changes (#2127)
* pulling out exitcode, adding hyper dep to handle errors (was already transitively there due to reqwest)
* adding better error handling, more options for client things
2023-09-19 13:31:19 +10:00
James Hodgkinson 01677938cc
move from git2 to gix (#2085) 2023-09-09 14:34:52 +10:00
James Hodgkinson d3d80e7364
Schema-dooby-doo-part-trois (#2082)
* adding extra_attributes field to BuiltinGroup, migrating more things.
* checkpoint 3 - ACP, easy as 1,2,3
* codespell
* now throwing error on dyngroup with defined members
2023-09-09 09:38:47 +10:00
Samuel Cabrero 9dda8b1ad3
Authentication shortcut to get a RW session (#1993)
* auth: Add a privileged flag to AuthStep::Init2 step to request a rw session

The privileged flag is defined as Option<bool> for compatibility with
existing clients.
2023-08-24 09:54:33 +10:00
Sebastiano Tocci eb7527379b
Configurable session timeouts (#1965)
* added `auth_session_expiry` and `auth_privilege_expiry`
* Added `AcountPolicy` struct
* spelling and stuff
* added cli tools
2023-08-22 11:00:43 +10:00
James Hodgkinson 05b35df413
Less human strings more enums (#1989)
* statics or enums you choose
* acp rewrite, defined SchemaAcp as a test
* macros and targetscopes and filters oh my
2023-08-21 17:16:43 +10:00
Sebastiano Tocci 003234c2d0
Identity verification feature (#1819) 2023-08-16 21:02:48 +10:00
James Hodgkinson 9a6168b67d
Fixing test release (#1983)
* Fixing cargo test --release

* more tracing less dbg
2023-08-15 15:42:15 +10:00
James Hodgkinson 83f189fed3
error handling and web server logging fixes (#1960)
* Fixing the setup_dev_environment script
* clippy calming
* handle_internalunixusertokenread throwing 500's without context
Fixes #1958
2023-08-14 20:47:49 +10:00
James Hodgkinson cc79f7eba1
Are we JSON yet? Kinda. But we're closer. (#1967) 2023-08-14 08:51:44 +10:00
Firstyear 270b9f8ef2
Resolve build failiures when selinux is enabled (#1927) 2023-08-01 19:08:21 +10:00
Firstyear bf3e16cbd3
Resolve issue with publishing (#1925)
* Resolve issue with publishing

* Fix version
2023-08-01 17:25:32 +10:00
Firstyear cccc20ea42
20230731 release (#1921)
* Cleanup how we check for last git commit to avoid an insecure dep
* Resolve unmaintained or old deps
* Fix ci
2023-07-31 22:27:21 +10:00
Firstyear 62ce42f8c1
Improve default shells for distros (#1920) 2023-07-31 14:58:27 +10:00
Firstyear e17dcc0ddb
1788 admin unix socket (#1880) 2023-07-24 10:05:10 +10:00
Firstyear 79ff5e9775
1785 allow sync attr yielding via partial write admin (#1879) 2023-07-19 11:42:53 +10:00
Firstyear 8e1e533f40
1792 public oauth clients (#1821) 2023-07-07 18:53:31 +10:00
James Hodgkinson cc35654388
Converting from tide to axum (#1797)
* Starting to chase down testing
* commenting out unused/inactive endpoints, adding more tests
* clippyism
* making clippy happy v2
* testing when things are not right
* moar checkpoint
* splitting up testkit things a bit
* moving https -> tide
* mad lad be crabbin
* spawning like a frog
* something something different spawning
* woot it works ish
* more server things
* adding version header to requests
* adding kopid_middleware
* well that was supposed to be an hour... four later
* more nonsense
* carrying on with the conversion
* first pass through the conversion is DONE!
* less pub more better
* session storage works better, fixed some paths
* axum-csp version thing
* try a typedheader
* better openssl config things
* updating lockfile
* http2
* actually sending JSON when we say we will!
* just about to do something dumb
* flargl
* more yak shaving
* So many clippy-isms, fixing up a query handler bleep bloop
* So many clippy-isms, fixing up a query handler bleep bloop
* fmt
* all tests pass including basic web logins and nav
* so much clippyism
* stripping out old comments
* fmt
* commenty things
* stripping out tide
* updates
* de-tiding things
* fmt
* adding optional header matching ,thanks @cuberoot74088
* oauth2 stuff to match #1807 but in axum
* CLIPPY IS FINALLY SATED
* moving scim from /v1/scim to /scim
* one day clippy will make sense
* cleanups
* removing sketching middleware
* cleanup, strip a broken test endpoint (routemap), more clippy
* docs fmt
* pulling axum-csp from the wrong cargo.toml
* docs fmt
* fmt fixes
2023-07-05 22:26:39 +10:00
Firstyear 17fa61ceeb
Add client UX for redirecting to an external portal for synced accounts (#1791) 2023-07-05 09:13:06 +10:00
Firstyear 0425122ba3
20230629 tpm keygen ... again (#1793) 2023-06-30 12:41:32 +10:00
James Hodgkinson cc1cc691f3
Started chasing noise, found some code to delete... (#1768)
logging changes:

* Offering auth mechanisms -> debug
* 404's aren't really warnings
* double tombstone message, one goes to debug

other changes:

* CSP changes to allow the bootstrap images to load
* more testing javascriptfile things, I R 
* it's nice to know where things are
* putting non-rust web things in static/ instead of src/
* RequestCredentials::SameOrigin is the default, also adding a utility function to save dupe code. Wow this saved... kilobytes.
* removing commented code, fixing up codespell config
* clippyisms
* wtf, gha
* dee-gloo-ing some things
* adding some ubuntu build test things
* sigh rustwasm/wasm-pack/issues/1138
* more do_request things
* packaging things
* hilarious dev env setup script
* updated script works, all the UI works, including the experimental UI for naughty crabs
* deb package fixes
* fixed some notes
* setup experimental UI tweaks
2023-06-27 11:38:22 +10:00
Firstyear 23eb4283e9
Improve tpm key generation - improve unix config for tpms. (#1782) 2023-06-27 10:09:19 +10:00
Firstyear a20dd3b113
Remove r2d2 - sad beep noises (#1766) 2023-06-24 16:15:31 +10:00
James Hodgkinson f25bd5bb65
Kanidmd is a bit noisy (#1765)
* the log_level config option works in kanidmd now
* anon event -> debug
* some more debuggy things
* removing some dupe events for the same thing
2023-06-24 15:56:01 +10:00
Firstyear d5670d0add
Ux improvements - Allow enrolling other devices (#1764) 2023-06-24 12:24:13 +10:00
Firstyear a0b59c6072
Make argon2id default pw hasher - improve parameter detection (#1762)
* Make argon2id default pw hasher - improve parameter detection
* Remove print
2023-06-22 12:09:09 +10:00
Firstyear f3080df628
Implement tpm binding of cached password hashes (#1754) 2023-06-21 20:33:01 +10:00
James Hodgkinson a9547d7150
Allow account locking with expire-at 'epoch' and 'now' (#1757)
Fixes #1755
2023-06-21 11:46:59 +10:00
Firstyear 6513fae5e2
1737 1739 sync - map uidnumbers mail (#1741) 2023-06-16 19:15:36 +10:00
Firstyear c65be8174a
Add support for argon2id (#1736) 2023-06-16 13:26:05 +10:00
Firstyear e61c9bdd0d
Disable neon on linux (#1740) 2023-06-16 12:54:46 +10:00
Bjørn Forsman 59c6723f7d
Bring back CpuOptLevel x86_64_v1 (#1590)
* Allow CpuOptLevel x86_64
Let's not force people to upgrade to x86_64_v2 yet. Default is unchanged
(x86_64_v2).
* target-cpu changes
* x86, and an old one at that? ew.
---------

Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2023-05-26 11:26:16 +10:00
Firstyear c1f62674f5
1496 ldap basedn config (#1500) 2023-03-29 09:34:43 +10:00
Firstyear 4718f2dc6b
1115 priv (reauth, sudo) mode (#1479) 2023-03-27 11:38:09 +10:00
James Hodgkinson 5573ab9224
RADIUS container fixes (#1424) 2023-03-07 11:50:45 +10:00
dependabot[bot] 113258d523
chore(deps): bump base64 from 0.13.1 to 0.21.0 (#1350)
* chore(deps): bump base64 from 0.13.1 to 0.21.0

Bumps [base64](https://github.com/marshallpierce/rust-base64) from 0.13.1 to 0.21.0.
- [Release notes](https://github.com/marshallpierce/rust-base64/releases)
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](https://github.com/marshallpierce/rust-base64/compare/v0.13.1...v0.21.0)

---
updated-dependencies:
- dependency-name: base64
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* base64 fixes

* fmt fixes

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2023-03-06 13:57:21 +10:00
James Hodgkinson a3016ea6ed
Openssl build fix (#1422)
* adding build.rs for libs
2023-03-05 17:25:38 +10:00
Firstyear e33beea89d
1399 cleanup cli docs (#1413)
* Cleanup cli args
* Update book
* Update wasm
* making the CI happy


---------

Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2023-03-02 12:47:23 +10:00
Firstyear 00cca81012
1399 cleanup reorg (#1412) 2023-03-01 13:10:52 +10:00