- Formalize support for different logout strategies and add the fallback strategy.
- Generate the logout URL at logout time in preparation for supporting dynamic logout requests (as needed by token revocation).
- Secure the connection to the mock OpenID Connect provider with a self-signed TLS certificate.
- Allow self-signed certificates for HTTPS connections to localhost (same policy as elsewhere in Krill).
- Upgrade openidconnect-rs to latest v2.0.0 alpha to gain contributed support for OAuth 2.0 Token Revocation. (#385 and #397)
- Use reqwest 0.9.x directly instead of via the openidconnect-rs crate (we cannot use the v0.11.x reqwest that comes with the crate as (a) it doesn't permit self-signed certificates, (b) the blocking implementation was changed to be async which causes problems when inside an existing async runtime, and (c) switching the OpenID Connect client code over to be async is non-trivial - see #428).
- Pass the ID token as `id_token_hint` to the OpenID Connect RP-Initiated Logout 1.0 endpoint. (#408)
- Refined logic for the various logout mechanism permutations. (#425).
- Require OpenID Connection RP-Initiated Logout 1.0 and OAuth 2.0 Token Revocation endpoints to be HTTPS per the specs.
- Passes manual testing with Microsoft Azure Active Directory RP-Initiated Logout support and Google Compute Cloud OAuth 2.0 Token Revocation support.
- Added a Google Cloud Platform example to the comments in the default config file.
- Updated and added tests.
- Fixed logout and token revocation in the mock OpenID Connect provider to actually terminate login sessions.
- Handle a race condition in Lagosta where null user data was accessed that was just deleted due to logout.
- Handle errors from the Krill logout endpoint in Lagosta.
* FIX: don't permit users with empty roles to login.
* FIX: incorrect return value stated in JMESPath resub() fn docstring.
* FIX: Don't panic on unwrap() if the JMESPath resub() fn doesn't find a match.
* Show a useful error message if the JMESPath recap() or resub() fns are given an invalid regular expression as input, not an unwrap() with a source file and line number.
* Require a claim value to be non-empty after trimming whitespace in order to be considered a search match. Raise an error (and thus fail the OpenID Connect based login process) if an internal error occurs while doing JMESPath, as we can't trust the claim resolution outcome in that case.
Use a user agent cookie with strict security settings to verify the CSRF token. Adds a test to verify that passing the wrong CSRF state value to Krill correctly results in an error.
* Use strongly typed Permission checks instead of unrestricted String based checks.
* FIX: Don't include Permission:: in the message logged at WARN level about a user not having permission, only log the permission name, e.g. CA_CREATE.
* FIX: Also update the team policy demo polar file to use the new Permission type.
* Add a test that should (but doesn't in non-multi-user mode) panic because it tries to create a CA using the wrong master token.
* cargo fmt
* Add some comments explaining what the test does and how it works.
* FIX: Don't permit anonymous users to perform restricted actions in non-multi-user mode (this regression was introduced in the v0.8.1-bis branch, it was never released).
Testbed mode should be more liberal in handling formatting variations in child and publisher registration XML. Synced with Lagosta commit d94470db. (#369, #403)
Ximon Eighteen