Fixes:
* Just use the token we have if we would ideally refresh before expiration but don't have a refresh token.
* Don't hide useful OpenID Connect error details (such as self-signed cert rejected instead of just request failed). (fixes#427)
* Lagosta fixes from branch issue-379-handle-connection-issues commit 58f5ccc7 (relates to #442).
Functional improvements:
* Return or log less in some error scenarios (#419).
* Upgrade to Oso 0.11.2 to get a MUCH better error report when a ?= query in a .polar file fails, plus the Mutex around Oso is no longer needed.
* Log when OIDC discovery completes successfully.
* Be cautious, just log connection issues to the OpenID Connect provider for now, don't retry discovery.
* Use a lower timeout for the OpenID Connect HTTP client than the normal Krill HTTP client.
* Log more cause chains where available.
Code quality improvements:
* Apply review feddback: unwrap locks and crash out via panic to be consistent with the rest of Krill.
* Factor out the repeated RAII guard handling.
* Split login() out into helper methods.
* Removed TODO comment.
Testing improvements:
* Removed left-behind debug screenshot.
* Add a test to show a bug whereby access is wrongly denied if a token is pending expiration and has no refresh token.
* Add a test to make sure Krill handles timeout of requests to the OIDC provider correctly. Also adds support for a lower timeout in test mode ala how it's done elsewhere in Krill, and more faithfully replicates the normal Krill HTTP client configuration when configuring the OIDC HTTP client. Also factored the OIDC HTTP client code out as it is getting too large to live in provider.rs.
* Extend the OpenID Connect provider not available test to show that Krill copes with the provider being unavailable and coming back to life again.
* Re-worked the test/mock relationship so that the mock no longer has hard-coded users and username based behaviour activation but rather now the test sets the desired behaviour and is thus easier to understand and more flexible.
* Extended the OpenID Connect mock so that its endpoints can be disabled and enabled during tests, and be disabled before Krill even does initial discovery.
* Use example.com based bad ACR ID token.
* Remove support for the NoResponse mock failure mode as it blocks the tiny http server thread indefinitely also preventing a test using it from exiting, and adds little no perceived benefit over the SlowResponse failure mode (which does at least stop blocking within the expected test run time).
* The mock OpenID Connect provider must be shutdown before the UI test result is asserted, otherwise the test process never terminates.
* Use the expected OpenID Connect provider timeout when in test mode.
* Extend the openid connect test to test the 'hybrid' user attributes case.
* Give the login more time to complete before expiring the access token. (#466).
* Wait for the right backend status BEFORE clicking the ROAs tab. (#465)
Other:
* OpenID Connect log message consistency tweaks.
* Sync with updated correspoinding Lagosta branch commit d2a92fe1 with latest Lagosta master merged in and a yarn build empty catch block fix.
* Sync with commit b9a2f5b3 in the corresponding PR branch in Lagosta to get a testbed REST API client fix.
Co-authored-by: Tim Bruijnzeels <tim@nlnetlabs.nl>
* Move child_request API endpoint for conststency. (#330)
* Move get RFC 8183 Publisher Request API endpoints (#330)
* Accept XML and json to add/update parent on same endpoints (#330)
* Simplify the JSON to add a child and remove unused fields. (#330)
* Update path to child_request in openapi spec.
* Update path to publisher request.
* Update api spec and documentation.
* Fix update parent API documentation and call by CLI.
* CLI stability
* Update pubd OpenAPI spec t o match changes made to the Krill API.
* Update the e2e test client code to submit only the id_cert and not the whole RFC8183 request, as required by changes made to the Krill API.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
* Remove embedded repository contact option, migrate commands and events.
* Migrate old CA init events. Test upgrade from 0.6.0.
* Migrate embedded in CA history.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
- Various changes to support a grey policy in between black and white approach of permitting or denying access to CAs entirely, whereby a user can have a different role in one CA than in another.
- Introduces the NoResourceType for requests not relating to a specific "resource", e.g. CA, such as LOGIN. NoResourceType maps to `nil` in Oso policy language.
- Add support for Permission constants in Polar files. Build the Permission enum using a macro.
- Added CA_ADMIN (for bulk operations) and CA_DELETE permissions.
- Support loading more than one custom auth policy file.
- Checks were missing on some API calls if the user had the necessary permission *on the relevant resources*.
- Rename the team policy as a demo to indicate that it is educational only.
- Split a role-per-ca demo out of the team policy demo.
- Extend the with_ta Cypress test to cover the role-per-ca ca demo policy (as it creates the needed data).
- Don't misrepresent an external policy file in log statements as being internal.
- Better comments describing what the tests are doing.
- Remove unused role parameter in team access demo policy.
- Add disallow() in Oso policies as a way to define deny rules.
* Let users configure the AIA to use with TA certificates. Set 'ta_aia' in the config file. (#409)
* Use explicit configuration section for testbed, no longer rely on magic env variables.
Note: this will all be revised again if/when the Publication server and TA vs CA code is fully separated in future.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
This allows us to keep the full history of semantically important events, while not spamming the history and avoiding excessive use of disk space. See issues #370 and #423.
This is a substantial change. Highlights follow:
* Added a developer documentation section
* No longer using events for manifest/crl generation (#370)
* No longer using events for publication deltas (#423)
* Removed pre 0.6.0 migration code - people will have to upgrade to at least 0.6.0 first
* Added migration code for 0.6.0-0.8.1 to this
* Migrate repository by doing a keyroll. (#370)
* Remove archiving code for commands (no longer applicable)
Minor other fixes:
* Use a swap file when writing (avoid corrupt json if disk is full) (#370)
* Make removing publisher content idempotent for publishers already removed.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
Co-authored-by: Jasper den Hertog <jasper@plainspace.com>
Note: Until merged to master this branch requires that a branch by the same name exists in the rpki-deploy repo with the corresponding changes to support these changes, which include:
- OpenAPI YML corrections.
- Support the new way to activate the TA.
- FIX: Include the correct ta.cer URI in the TAL.
- Use two seprarate Python libraries for Krill: one for CA REST SAPIs and one for PUB REST APIs.
- FIX: Test for the actual CAs and resources to create, as the presence of the testbed CA violates the previous check assumptions.
- FIX: Resource ASN, v4 and v6 values can no longer be assumed to have the same sort order as when given to Krill.
- Factor out test suite code into helper functions for better readability and maintainability.
- Retry RTR fetching (needed for ROAs obtained from Rcynic Lihttpd server served JSON as otherwise connecting too early results in SyncTimeout).
Known issues: on failure all RP tests will retry 3 times while actually only the Rcynic test should retry.
- Formalize support for different logout strategies and add the fallback strategy.
- Generate the logout URL at logout time in preparation for supporting dynamic logout requests (as needed by token revocation).
- Secure the connection to the mock OpenID Connect provider with a self-signed TLS certificate.
- Allow self-signed certificates for HTTPS connections to localhost (same policy as elsewhere in Krill).
- Upgrade openidconnect-rs to latest v2.0.0 alpha to gain contributed support for OAuth 2.0 Token Revocation. (#385 and #397)
- Use reqwest 0.9.x directly instead of via the openidconnect-rs crate (we cannot use the v0.11.x reqwest that comes with the crate as (a) it doesn't permit self-signed certificates, (b) the blocking implementation was changed to be async which causes problems when inside an existing async runtime, and (c) switching the OpenID Connect client code over to be async is non-trivial - see #428).
- Pass the ID token as `id_token_hint` to the OpenID Connect RP-Initiated Logout 1.0 endpoint. (#408)
- Refined logic for the various logout mechanism permutations. (#425).
- Require OpenID Connection RP-Initiated Logout 1.0 and OAuth 2.0 Token Revocation endpoints to be HTTPS per the specs.
- Passes manual testing with Microsoft Azure Active Directory RP-Initiated Logout support and Google Compute Cloud OAuth 2.0 Token Revocation support.
- Added a Google Cloud Platform example to the comments in the default config file.
- Updated and added tests.
- Fixed logout and token revocation in the mock OpenID Connect provider to actually terminate login sessions.
- Handle a race condition in Lagosta where null user data was accessed that was just deleted due to logout.
- Handle errors from the Krill logout endpoint in Lagosta.
* FIX: don't permit users with empty roles to login.
* FIX: incorrect return value stated in JMESPath resub() fn docstring.
* FIX: Don't panic on unwrap() if the JMESPath resub() fn doesn't find a match.
* Show a useful error message if the JMESPath recap() or resub() fns are given an invalid regular expression as input, not an unwrap() with a source file and line number.
* Require a claim value to be non-empty after trimming whitespace in order to be considered a search match. Raise an error (and thus fail the OpenID Connect based login process) if an internal error occurs while doing JMESPath, as we can't trust the claim resolution outcome in that case.
Use a user agent cookie with strict security settings to verify the CSRF token. Adds a test to verify that passing the wrong CSRF state value to Krill correctly results in an error.
* Use strongly typed Permission checks instead of unrestricted String based checks.
* FIX: Don't include Permission:: in the message logged at WARN level about a user not having permission, only log the permission name, e.g. CA_CREATE.
* FIX: Also update the team policy demo polar file to use the new Permission type.
* Add a test that should (but doesn't in non-multi-user mode) panic because it tries to create a CA using the wrong master token.
* cargo fmt
* Add some comments explaining what the test does and how it works.
* FIX: Don't permit anonymous users to perform restricted actions in non-multi-user mode (this regression was introduced in the v0.8.1-bis branch, it was never released).
Testbed mode should be more liberal in handling formatting variations in child and publisher registration XML. Synced with Lagosta commit d94470db. (#369, #403)
Tim Bruijnzeels