PR #646
* cargo update
* Use an enum instead of a trait (prepare to allow async)
* Use async reqwest client for openid connect checks.
* Move extract bearer token function to util::httpclient.
Co-authored-by: Ximon Eighteen <3304436+ximon18@users.noreply.github.com>
* Encrypt session state using ChaCha20-Poly1305 instead of AES-GCM.
* Replace config file users login use of insecure unsalted SHA2 password hashing with secure scrypt salted password hashing.
* Log the start of the request before determining the actor.
* Allow sufficient time for password hashing delays during login with config file user based tests..
* Synced with Lagosta commit b49f23de.
- Various changes to support a grey policy in between black and white approach of permitting or denying access to CAs entirely, whereby a user can have a different role in one CA than in another.
- Introduces the NoResourceType for requests not relating to a specific "resource", e.g. CA, such as LOGIN. NoResourceType maps to `nil` in Oso policy language.
- Add support for Permission constants in Polar files. Build the Permission enum using a macro.
- Added CA_ADMIN (for bulk operations) and CA_DELETE permissions.
- Support loading more than one custom auth policy file.
- Checks were missing on some API calls if the user had the necessary permission *on the relevant resources*.
- Rename the team policy as a demo to indicate that it is educational only.
- Split a role-per-ca demo out of the team policy demo.
- Extend the with_ta Cypress test to cover the role-per-ca ca demo policy (as it creates the needed data).
- Don't misrepresent an external policy file in log statements as being internal.
- Better comments describing what the tests are doing.
- Remove unused role parameter in team access demo policy.
- Add disallow() in Oso policies as a way to define deny rules.
- Formalize support for different logout strategies and add the fallback strategy.
- Generate the logout URL at logout time in preparation for supporting dynamic logout requests (as needed by token revocation).
- Secure the connection to the mock OpenID Connect provider with a self-signed TLS certificate.
- Allow self-signed certificates for HTTPS connections to localhost (same policy as elsewhere in Krill).
- Upgrade openidconnect-rs to latest v2.0.0 alpha to gain contributed support for OAuth 2.0 Token Revocation. (#385 and #397)
- Use reqwest 0.9.x directly instead of via the openidconnect-rs crate (we cannot use the v0.11.x reqwest that comes with the crate as (a) it doesn't permit self-signed certificates, (b) the blocking implementation was changed to be async which causes problems when inside an existing async runtime, and (c) switching the OpenID Connect client code over to be async is non-trivial - see #428).
- Pass the ID token as `id_token_hint` to the OpenID Connect RP-Initiated Logout 1.0 endpoint. (#408)
- Refined logic for the various logout mechanism permutations. (#425).
- Require OpenID Connection RP-Initiated Logout 1.0 and OAuth 2.0 Token Revocation endpoints to be HTTPS per the specs.
- Passes manual testing with Microsoft Azure Active Directory RP-Initiated Logout support and Google Compute Cloud OAuth 2.0 Token Revocation support.
- Added a Google Cloud Platform example to the comments in the default config file.
- Updated and added tests.
- Fixed logout and token revocation in the mock OpenID Connect provider to actually terminate login sessions.
- Handle a race condition in Lagosta where null user data was accessed that was just deleted due to logout.
- Handle errors from the Krill logout endpoint in Lagosta.
Tim Bruijnzeels