dependabot[bot]
ed76bdbfb1
Bump the all group with 22 updates ( #3376 )
...
* Bump the all group with 22 updates
Bumps the all group with 22 updates:
| Package | From | To |
| --- | --- | --- |
| [async-trait](https://github.com/dtolnay/async-trait ) | `0.1.83` | `0.1.85` |
| [bitflags](https://github.com/bitflags/bitflags ) | `2.6.0` | `2.8.0` |
| [clap](https://github.com/clap-rs/clap ) | `4.5.23` | `4.5.27` |
| [clap_complete](https://github.com/clap-rs/clap ) | `4.5.40` | `4.5.42` |
| [lodepng](https://github.com/kornelski/lodepng-rust ) | `3.10.7` | `3.11.0` |
| [openssl](https://github.com/sfackler/rust-openssl ) | `0.10.68` | `0.10.69` |
| [proc-macro2](https://github.com/dtolnay/proc-macro2 ) | `1.0.92` | `1.0.93` |
| [reqwest](https://github.com/seanmonstar/reqwest ) | `0.12.11` | `0.12.12` |
| [rustls](https://github.com/rustls/rustls ) | `0.23.20` | `0.23.21` |
| [sd-notify](https://github.com/lnicola/sd-notify ) | `0.4.4` | `0.4.5` |
| [serde_json](https://github.com/serde-rs/json ) | `1.0.134` | `1.0.137` |
| [syn](https://github.com/dtolnay/syn ) | `2.0.93` | `2.0.96` |
| [tempfile](https://github.com/Stebalien/tempfile ) | `3.14.0` | `3.15.0` |
| [tokio](https://github.com/tokio-rs/tokio ) | `1.42.0` | `1.43.0` |
| [uuid](https://github.com/uuid-rs/uuid ) | `1.11.0` | `1.12.1` |
| [oauth2](https://github.com/ramosbugs/oauth2-rs ) | `4.4.2` | `5.0.0` |
| [cc](https://github.com/rust-lang/cc-rs ) | `1.2.6` | `1.2.10` |
| [axum-extra](https://github.com/tokio-rs/axum ) | `0.9.6` | `0.10.0` |
| [axum-macros](https://github.com/tokio-rs/axum ) | `0.4.2` | `0.5.0` |
| [fantoccini](https://github.com/jonhoo/fantoccini ) | `0.21.3` | `0.21.4` |
| [petgraph](https://github.com/petgraph/petgraph ) | `0.6.5` | `0.7.1` |
| [jsonschema](https://github.com/Stranger6667/jsonschema ) | `0.28.0` | `0.28.3` |
Updates `async-trait` from 0.1.83 to 0.1.85
- [Release notes](https://github.com/dtolnay/async-trait/releases )
- [Commits](https://github.com/dtolnay/async-trait/compare/0.1.83...0.1.85 )
Updates `bitflags` from 2.6.0 to 2.8.0
- [Release notes](https://github.com/bitflags/bitflags/releases )
- [Changelog](https://github.com/bitflags/bitflags/blob/main/CHANGELOG.md )
- [Commits](https://github.com/bitflags/bitflags/compare/2.6.0...2.8.0 )
Updates `clap` from 4.5.23 to 4.5.27
- [Release notes](https://github.com/clap-rs/clap/releases )
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.23...clap_complete-v4.5.27 )
Updates `clap_complete` from 4.5.40 to 4.5.42
- [Release notes](https://github.com/clap-rs/clap/releases )
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.40...clap_complete-v4.5.42 )
Updates `lodepng` from 3.10.7 to 3.11.0
- [Commits](https://github.com/kornelski/lodepng-rust/compare/v3.10.7...v3.11.0 )
Updates `openssl` from 0.10.68 to 0.10.69
- [Release notes](https://github.com/sfackler/rust-openssl/releases )
- [Commits](https://github.com/sfackler/rust-openssl/compare/openssl-v0.10.68...openssl-v0.10.69 )
Updates `proc-macro2` from 1.0.92 to 1.0.93
- [Release notes](https://github.com/dtolnay/proc-macro2/releases )
- [Commits](https://github.com/dtolnay/proc-macro2/compare/1.0.92...1.0.93 )
Updates `reqwest` from 0.12.11 to 0.12.12
- [Release notes](https://github.com/seanmonstar/reqwest/releases )
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md )
- [Commits](https://github.com/seanmonstar/reqwest/compare/v0.12.11...v0.12.12 )
Updates `rustls` from 0.23.20 to 0.23.21
- [Release notes](https://github.com/rustls/rustls/releases )
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rustls/rustls/compare/v/0.23.20...v/0.23.21 )
Updates `sd-notify` from 0.4.4 to 0.4.5
- [Changelog](https://github.com/lnicola/sd-notify/blob/master/CHANGELOG.md )
- [Commits](https://github.com/lnicola/sd-notify/compare/v0.4.4...v0.4.5 )
Updates `serde_json` from 1.0.134 to 1.0.137
- [Release notes](https://github.com/serde-rs/json/releases )
- [Commits](https://github.com/serde-rs/json/compare/v1.0.134...v1.0.137 )
Updates `syn` from 2.0.93 to 2.0.96
- [Release notes](https://github.com/dtolnay/syn/releases )
- [Commits](https://github.com/dtolnay/syn/compare/2.0.93...2.0.96 )
Updates `tempfile` from 3.14.0 to 3.15.0
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Stebalien/tempfile/compare/v3.14.0...v3.15.0 )
Updates `tokio` from 1.42.0 to 1.43.0
- [Release notes](https://github.com/tokio-rs/tokio/releases )
- [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.42.0...tokio-1.43.0 )
Updates `uuid` from 1.11.0 to 1.12.1
- [Release notes](https://github.com/uuid-rs/uuid/releases )
- [Commits](https://github.com/uuid-rs/uuid/compare/1.11.0...1.12.1 )
Updates `oauth2` from 4.4.2 to 5.0.0
- [Release notes](https://github.com/ramosbugs/oauth2-rs/releases )
- [Upgrade guide](https://github.com/ramosbugs/oauth2-rs/blob/main/UPGRADE.md )
- [Commits](https://github.com/ramosbugs/oauth2-rs/compare/4.4.2...5.0.0 )
Updates `cc` from 1.2.6 to 1.2.10
- [Release notes](https://github.com/rust-lang/cc-rs/releases )
- [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rust-lang/cc-rs/compare/cc-v1.2.6...cc-v1.2.10 )
Updates `axum-extra` from 0.9.6 to 0.10.0
- [Release notes](https://github.com/tokio-rs/axum/releases )
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md )
- [Commits](https://github.com/tokio-rs/axum/compare/axum-extra-v0.9.6...axum-extra-v0.10.0 )
Updates `axum-macros` from 0.4.2 to 0.5.0
- [Release notes](https://github.com/tokio-rs/axum/releases )
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md )
- [Commits](https://github.com/tokio-rs/axum/compare/axum-macros-v0.4.2...axum-macros-v0.5.0 )
Updates `fantoccini` from 0.21.3 to 0.21.4
- [Commits](https://github.com/jonhoo/fantoccini/compare/v0.21.3...v0.21.4 )
Updates `petgraph` from 0.6.5 to 0.7.1
- [Changelog](https://github.com/petgraph/petgraph/blob/master/RELEASES.rst )
- [Commits](https://github.com/petgraph/petgraph/compare/petgraph@v0.6.5...petgraph@v0.7.1 )
Updates `jsonschema` from 0.28.0 to 0.28.3
- [Release notes](https://github.com/Stranger6667/jsonschema/releases )
- [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Stranger6667/jsonschema/compare/rust-v0.28.0...rust-v0.28.3 )
---
updated-dependencies:
- dependency-name: async-trait
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: bitflags
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: clap
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: clap_complete
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: lodepng
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: openssl
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: proc-macro2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: reqwest
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: rustls
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: sd-notify
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: serde_json
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: syn
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: tempfile
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: tokio
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: uuid
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: oauth2
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: cc
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: axum-extra
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: axum-macros
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: fantoccini
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: petgraph
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: jsonschema
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
...
Signed-off-by: dependabot[bot] <support@github.com>
* ok the otel stuff works now
* linting fixes
* fix: less parse more from_str, adding a todo
* fix: removing a TODO
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2025-01-29 13:57:38 +10:00
Firstyear
b3be758b74
20250114 3325 SCIM access control ( #3359 )
...
Add an extended query operation to return effective access controls so that UI's can dynamically display what is or is not editable on an entry.
2025-01-20 11:28:22 +00:00
James Hodgkinson
419c4a1827
fix: unrecoverable error page doesn't include logo or domain name ( #3352 )
2025-01-14 03:49:20 +00:00
Firstyear
e7d91ed55d
20250110 eo fixes ( #3353 )
...
While preparing for everything open, I found a small number of doc/book issues, some logging issues, and some minor performance wins. This pr is just small bits of various polish around the place.
2025-01-12 03:53:31 +00:00
Firstyear
1a29aa7301
Add ssh_publickeys as a claim for oauth2 ( #3346 )
...
Allow ssh_publickeys to be exposed as a claim for oauth2 and oidc
applications so that they can consume these keys for various uses.
An example could be something like gitlab which can then associate
the public keys with the users account.
2025-01-08 08:21:28 +00:00
Firstyear
063366cba4
Allow modification of password minimum length ( #3345 )
...
Allow all account policy values to be altered on system protected
objects.
2025-01-08 06:51:46 +00:00
micolous
16591007dd
Add OAuth2 response_mode=fragment ( #3335 )
...
* Add response_mode=fragment to discovery documents
* Add test for `response_mode=query`
* refactor OAuth 2.0 tests back into regular functions, because macros are messy
* Disallow some `response_type` x `response_mode` combinations per spec
2025-01-08 15:41:01 +10:00
Firstyear
1983ce19e9
Resolve passkey regression ( #3343 )
...
During other testing I noticed that passkeys no longer worked
on a reauthentication. This was due to a regression in you
guessed it, cookies, where the auth session id wasn't being
removed properly.
2025-01-07 16:05:14 +10:00
Firstyear
3430a1c31d
Ignore anonymous in oauth2 read allow access ( #3336 )
...
Administrators will sometimes configure oauth2 clients with `idm_all_accounts`
as an allowed scope group. Despite anonymous being *unable* to interact with
oauth2, this still allowed oauth2 clients to be read by anonymous in this
configuration. For some users, this may be considered a public info
disclosure.
2025-01-04 03:09:48 +00:00
Firstyear
bbefb0b1b1
Update to latest webauthn-rs/time ( #3315 )
...
This updates to the latest webauthn-rs release. When
updating, an issue with time was found that changes
the behaviour of it's parser for rfc3339. This also
updates our tests to accomodate that change.
Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2024-12-21 06:45:06 +00:00
Firstyear
9f499f3913
Further SCIM sync testing, minor fixes ( #3305 )
...
This adds further testing of SCIM sync, especially around
conversion of the SCIM Sync Person and Group types into
SCIM Entry. This test would have prevented #3298 and
#3299 from occuring.
During testing two more fixes were found. external_id should have
been required (not optional) and a group with no members would
cause a serialisation issue.
2024-12-20 07:16:07 +00:00
Firstyear
50a7d9d700
Allow opt-in of easter eggs ( #3308 )
...
So that we can start to add some more easter eggs to the server,
we also need to respect user preferences that may not want them.
This adds a configuration setting to the domain allowing a release
build to opt-in to easter eggs, and development builds to opt-out
of them.
2024-12-19 03:30:35 +00:00
Firstyear
6c3b8500a2
Use specific errors for intent token revoked ( #3291 )
...
Rather than the generic 'invalid state' error, we now return
proper site-specific errors for credential commit failures, with
error messages to explain what went wrong.
2024-12-16 10:28:00 +10:00
Firstyear
07b9ca8939
Allow group managers to modify entry-managed-by ( #3272 )
...
When we added entry-managed-by, we allowed it to be set on group creation but not post-group-creation. The idea was to delegate ownership of the group. However, this has the obvious trap that an account group like idm_admins can't alter entry-managed-by post creation, needing the use of the admin account which has access control privs, or a delete and recreate of the entry.
Since the idm admin could delete and recreate the group with a new entry manager, there is functionally no difference to allowing them to modify the entry-managed-by here of low priv groups. This changes the group manager access control by default to allow this.
2024-12-10 03:49:57 +00:00
Firstyear
9b3350f753
Cleanup of println and other outputs ( #3266 )
2024-12-04 15:13:14 +10:00
James Hodgkinson
388ed679a8
Check DNS on replication loop start not at task start ( #3243 )
2024-12-03 03:58:16 +00:00
James Hodgkinson
42459f56b0
fix(docstrings): minor lack of formatting breaking things ( #3260 )
2024-12-03 12:52:31 +10:00
Firstyear
ea0e63cc2a
20240927 SCIM put ( #3151 )
2024-11-30 06:56:17 +00:00
Firstyear
db101e6d26
Clippy Lints ( #3255 )
2024-11-30 06:13:26 +00:00
James Hodgkinson
c1ed939c28
Allow OAuth2 loopback redirects if the path matches ( #3252 )
2024-11-30 05:40:05 +00:00
Georg
77e13b817a
Correct spelling of occurred ( #3222 )
...
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2024-11-19 00:37:51 +00:00
Firstyear
1218abd8c6
Prevent Invalid MFA Reg States ( #3194 )
2024-11-10 03:36:28 +00:00
Firstyear
0f3f604ba0
Hoist max_age to prevent incorrect deserialisation ( #3190 )
2024-11-09 13:28:29 +09:00
Firstyear
4f87ee2fc8
Use correct oauth2 manage acp ( #3186 )
2024-11-08 01:31:35 +00:00
Firstyear
a7394e8875
Re-migrate all acps to force updating ( #3184 )
...
* Re-migrate all acps to force updating
* Update server/lib/src/server/migrations.rs
---------
Co-authored-by: James Hodgkinson <james@terminaloutcomes.com>
2024-11-07 18:52:42 +09:00
Firstyear
853f787327
security - low - fault in migrations ( #3182 )
...
A fault existed in the server's internal migration code, where attributes
that were multivalued would be merged rather than replaced in certain
contexts. This migration path is used for access controls, meaning that
on upgrades, attributes that were meant to be removed from access
controls or changes to access control target groups were not reflected
during the upgrade process.
This has a potentially low security impact as it may have allowed
users to change their name/displayname even if the administrator
had disable the name_self_write access control.
2024-11-07 14:32:37 +10:00
George Wu
fbb3b6b2db
Update missing inputmode numeric when adding a new TOTP. ( #3160 )
2024-10-29 12:57:24 +00:00
Firstyear
ce31abeeb0
Improve OAuth2 authorisation ux ( #3158 )
...
- Resolve an issue where oauth2 could trigger the login page to
incorrectly redirect to an oauth2 application instead of apps
- Add indication of what client application we are accessing
if the session is not yet authenticated
2024-10-29 04:56:28 +00:00
Firstyear
a76a0f5a6e
Begin 1.5.0 Development Cycle ( #3150 )
2024-10-27 01:53:24 +00:00
Wei Jian Gan
bc55313d87
Harmonize UI and remove unused css ( #3033 )
...
-------
Co-authored-by: Wei Jian Gan <wg@danicapension.dk>
Co-authored-by: William Brown <william@blackhats.net.au>
2024-10-26 04:47:44 +00:00
James Hodgkinson
5a709520dc
OAuth2 Device flow foundations ( #3098 )
2024-10-26 12:08:48 +10:00
CEbbinghaus
dc56a3217d
Chore: Refactor Groups to be more generic ( #3136 )
2024-10-25 00:36:20 +00:00
Firstyear
5a3e5f1e07
20241017 3107 token ttl ( #3114 )
2024-10-18 03:28:52 +00:00
Firstyear
2075125439
Working scim entry get for person ( #3088 )
2024-10-15 04:29:45 +00:00
Firstyear
1cccebd382
20241012 attr name SCIM fix ( #3102 )
...
* Fix handling of attribute to ensure that it is consistently Attribute in scim sync
2024-10-14 08:00:03 +10:00
Merlijn
4e125b5043
Scim add EntryReference ( #3079 )
...
Allow references to be displayed as a complex object
2024-10-10 00:13:45 +00:00
Firstyear
c779443454
Fix Increment Replication Post Upgrade ( #3089 )
2024-10-05 19:53:39 +10:00
Firstyear
131ff80b32
20240921 ssh keys and unix password in credential update session ( #3056 )
2024-10-03 05:57:18 +00:00
Firstyear
cc662f184a
20240925 cleanups ( #3060 )
2024-10-03 14:04:02 +10:00
CEbbinghaus
d109622d71
Make good on some TechDebt ( #3084 )
...
adds MissingClass & MissingAttribute OperationError kinds to more strongly type our error messages.
2024-10-03 10:48:28 +10:00
CEbbinghaus
dc4a438c31
Feat: Adding POSIX Password fallback ( #3067 )
...
* Added Schema for credential fallback
* Added account polcity management to ac migration
* Refactored Ldap & Unix auth to be common
* removed unused methods and renamed unused fields
* Fixed LDAP missing Anonymous logic
* Added CLI argument for configuring primary cred fallback
2024-10-02 19:28:36 +10:00
Firstyear
cf63c6b98b
Complete the implementation of the posix account cache ( #3041 )
...
Allow caching and checking of shadow entries (passwords)
Cache and serve system id's
improve some security warnings
prepare for multi-resolver
Allow the kanidm provider to be not configured
Allow group extension
2024-10-02 02:12:13 +00:00
Firstyear
90afc8207c
20240926 tech debt ( #3066 )
...
Large clean up
2024-10-01 10:07:08 +10:00
Firstyear
23636acbf7
Fix migration of last mod cid ( #3065 )
2024-09-30 09:56:48 +00:00
Firstyear
e4f5c2313d
Increase totp secret size ( #3061 )
2024-09-30 07:45:43 +00:00
Firstyear
6065f2db60
Add rfc7009 and rfc7662 metadata to oidc discovery ( #3046 )
2024-09-17 03:35:43 +00:00
Firstyear
d3891e301f
20240810 SCIM entry basic ( #3032 )
2024-09-12 12:53:43 +10:00
Firstyear
f053ff7fba
CreatedAt/ModifiedAt fix ( #3034 )
...
* fix(repl): CreatedAt/ModifiedAt attributes
2024-09-12 11:42:16 +10:00
Firstyear
938ad90f3b
20240906 Attribute as an Enum Type ( #3025 )
...
Changes attribute from a string to an enum - this provides many performance improvements and memory savings throughout the server.
2024-09-09 00:53:10 +00:00
Firstyear
95fc6fc5bf
20240828 Support Larger Images, Allow Custom Domain Icons ( #3016 )
...
Allow setting custom domain icons.
2024-09-05 04:19:27 +00:00
