boundary

Commit Graph

Author	SHA1	Message	Date
Jeff Mitchell	d7e44f6822	Bump nodeenrollment to remove multierrors (#3809 )	3 years ago
Timothy Messier	88bb253554	fix(cli): Remove websocket message size limit (#3808 ) When the boundary client establishes a connection to the websocket used to communicate with a worker, it was configured with a max websocket message size of 32KiB. This was the default behavior for v1.8.7 of nhooyr/websocket. However, there are cases where the worker can send messages to the client that are larger than 32KiB. When this happens the client returns an error and terminates the connection. Notably this seems to only currently impact sessions made to SSH Targets, although it could theoretically impact any target type depending on the details of how the worker performs the writing of the messages. The issue can be reproduced by attempting to scp a large enough file from an SSH Target to the client. In this case the connection gets terminated and results in a partial transfer of the file. This message size limit appears to be unnecessary, and the default behavior is changing in v1.8.8 of nhooyr/websocket to make the message size unlimited. Since this version is not yet released, this commit switches the dependency to a fork with a version that is v1.8.7 plus the patch to disable the limit. Once v1.8.8 is release this dependency can be set back. See: https://github.com/nhooyr/websocket/pull/254 https://github.com/nhooyr/websocket/pull/256	3 years ago
Jeff Mitchell	fc0d43459c	Bump password dep to fix issue entering password in Windows CLI (#3800 )	3 years ago
irenarindos	24771ff355	update go.mod	3 years ago
Jim	6c54988e58	chore: update cap/ldap dep (#3748 ) cap/ldap updated it's upstream dep on go-ldap	3 years ago
Jim	0d19892e03	fix (events): convert multierror to stdlib error (#3743 ) * fix (events): convert multierror to stdlib error multierror errors will be converted to a stdlib error (because multierror doesn't support json marshaling). * refact (errors): convert from multierror to stdlib errors.Join(...) * refact: convert from pkg/errors to stdlib error wrapping	3 years ago
Irena Rindos	c3d3000a3e	chore: update go-eventlogger (#3735 )	3 years ago
Jim	457b618f6e	chore: update azurevaultkey wrapper dependency. (#3706 ) This update brings in PR #155 which adds support for azure workload identity authentication	3 years ago
Irena Rindos	6f10a0ac87	chore: update go-eventlogger (#3707 ) * chore: update go-eventlogger	3 years ago
Jim	5f66f2fa8e	chore: update cap/ldap dependency (#3699 )	3 years ago
Jim	a16033b73a	fix (kms): move oplog DEK into its own internal kms (#3665 ) * fix (auth/ldap): fix which DEK is used for oplog during authenticate * chore: update go-kms-wrapping dep for new extras/kms changes The latest version supports setting a table name prefix for a kms which is needed to fix our oplog DEK problem * chore: update extras/kms dep This latest version supports an optional TableNamePrefix which is required to fix our existing oplog DEK issue. * fix (oplog): schema oplog DEK fix These changes will allow use to store the oplog DEK in it's own set of tables, so they won't get deleted when a scope is deleted * fix (kms): move oplog DEK into its own internal kms * tests: update tests to be compatible with oplog fix * tests: remove migration tests which are incompatible with oplog fix These tests no longer work because they are missing the required schema changes for the oplog fix	3 years ago
Jim	dc89ca28a1	feat: add API support for additional LDAP auth method fields. (#3679 ) * feat (auth/ldap): add Repo support for max page size and deref aliases (#3670) * chore: update cap/ldap dependency This latest version of cap/ldap adds support for MaxPageSize and DerefAliases * feat (auth/ldap): add MaxPageSize and DerefAliases to storage proto * feat (api/authmethods): add new ldap fields. Add support for maximum_page_size and dereference_aliases * feat (auth/ldap): schema changes to support new LDAP attributes * feat (auth/ldap): add Repo support for max page size and deref aliases * feat (handlers/ldap): add support for new fields (#3674) Added API support for new ldap fields: MaximumPageSize and DereferenceAliases * chore: add CHANGELOG entry for new api auth ldap fields	3 years ago
Jim	d5411a26f6	chore: update protobuf dep (#3669 )	3 years ago
Jim	97c5e7dbc6	chore: update cap dependency (#3495 )	3 years ago
Irena Rindos	39e6fcfeba	chore: update cap dependency (#3456 )	3 years ago
Irena Rindos	d776f6702e	chore: update nodeenrollemnt version (#3439 )	3 years ago
Irena Rindos	0fcf0e21d9	chore(server): Update worker auth repository to handle dupe nodes (#3410 ) * chore(server): Update worker auth repository to use nodee DuplicateRecordError	3 years ago
Jim	7de0a299e4	chore: update gldap dep to fix intermittent shutdown/stop error (#3350 ) Occasionally, we see an error from the gldap test directory reported during the shutdown/close of the directories listener. This update should fix that issue.	3 years ago
Louis Ruch	6eb1c9919f	chore: update sdk/api deps	3 years ago
Jim	d6c6d428ff	chore: update go-dbw dep, required a few other deps as well. (#3284 )	3 years ago
Louis Ruch	99a4c1f781	chore: update sdk/api deps	3 years ago
Timothy Messier	75ef443ae1	chore: Update api and sdk tags	3 years ago
Jim	9ea00088bd	chore: update go-kms-wrapping dep (#3260 )	3 years ago
Johan Brandhorst-Satzkorn	0c8177590f	Upgrade grpc-gateway dependency (#3257 ) * proto: correct classification of authz token The target authorization token had the invalid classification "private". Fortunately, classification is a fail-closed system, so this won't have exposed users authorization tokens, but we should still use the correct classification. Use "secret". * scripts: add Go script to remove gotags comments The new version of grpc-gateway includes our gotags comments in the generate swagger documentation. This script removes all mentions of these. * Upgrade grpc-gateway dependency Mainly we need this to fix generation of our docs side API docs, but it also includes a nice fix for the new Download RPC, i.e. it now contains the correct response schema (a binary stream).	3 years ago
Jim	d4e537c88d	chore: updgrade pgx direct deps to v5 (#3258 )	3 years ago
Johan Brandhorst-Satzkorn	c765db2bb8	Upgrade go-secure-stdlib dependencies (#3256 )	3 years ago
Jim	536551dc0c	fix: update go-dbw dep and refactor conversion of pgx errors (#3242 )	3 years ago
Johan Brandhorst-Satzkorn	59f78ac1f8	config: allow wasm execution under UI CSP The wasm-unsafe-eval option is necessary for the asciinema player on the Admin UI	3 years ago
Timothy Messier	9302705d1b	chore: Update go-kms-wrapping dep This is necessary to get the SigInfoSigner.	3 years ago
Jeff Mitchell	e8559d142a	Fix worker auth rotation test (#3243 ) Most of the changes here are changes or enhancements that are useful for tests. The crux of the issue was that I had pulled up one var to the package level so it could be read from tests, but that var was not being reset between tests. It's not even used in tests anymore, so I put it back to function-local.	3 years ago
Jeff Mitchell	5b98aecaba	Bump deps (#3240 ) These are deps either maintained by the Boundary team or approved by members of the team. A few specific notes on some of the non-HC and non-DB ones: github.com/fatih/color: fixes some windows issues github.com/zalando/go-keyring: fixes a windows crash	3 years ago
Jeff Mitchell	c8f37ca4dc	Perform mod tidy	3 years ago
Jeff Mitchell	4c024858c4	Bump nodeenrollment dep	3 years ago
Jeff Mitchell	5716a30813	Update nodeenrollment to fix TLS issue; add debug (#3231 ) * Add more logging to worker auth rotation and test flags This makes it much easier to figure out when and why rotation is happening and control it for tests/debugging. * Update auth rotation logic Because we were looking at validity period of client certs, which may not have matched the actual rotation interval, it was possible (mostly in test scenarios) for the rotation to happen multiple times on the roots before we actually hit the worker rotation interval. This changes how the interval is calculated by looking at the difference between not-after values on the certs to understand the rotation interval being used by the controller. We then use that as the starting point for calculating a next-rotation time.	3 years ago
Jeff Mitchell	33ccb121c8	Bump nodeenrollment version	3 years ago
Jim	af1092e8e8	feat (boundary/dev): add connection info for dev ldap server when running via `boundary dev` (#3193 ) * chore (dev/ldap): update gldap dependency This update fixes the dup entries returned when searching for users and/or groups * feat (boundary/dev): add connection info for dev ldap server	3 years ago
Jim	667ea285be	feature (boundary dev): add support for dev ldap auth method (#3192 )	3 years ago
Jeff Mitchell	c4b987849b	Bump go-bexpr dep to v0.1.12 (#3186 ) This normalizes behavior around missing map keys. See https://github.com/hashicorp/go-bexpr/pull/38 for more information.	3 years ago
Jeff Mitchell	bc47a60f2f	Update sdk dep	3 years ago
Jeff Mitchell	8ae839f9ee	Update api dep	3 years ago
Jeff Mitchell	163ce184b8	KMS-PKI Workers (#3101 ) This adds a new mechanism for worker authentication that uses the third-party arbitration of the original KMS flow by leveraging recently-added capabilities in nodeenrollment to support a registration wrapper. This allows for workers to be registered to the system with just a name and a matching wrapper, while at the same time allowing these workers to be used for private Vault access and multi-hop as they contain per-worker encryption keys and support rotation. Nodes using this mode will generate and rotate credentials in-memory (using another recently added nodeenrollment capability) so will have a new set of keys on every startup. This has the side effect of ensuring that there is never a conflict or re-use of these credentials. Note that the normal test worker flow was using the now-deprecated KMS method; there is still a test that uses this (explicitly) but all other tests using test workers that did not specify a specific PKI flow now actually use this mechanism. This means there is fairly decent test coverage in a general sense, plus the specific tests updated/added for this feature. This also adds a new KMS type that can be used to have distinct KMSes for upstream authentication vs. accepting from downstream.	3 years ago
dependabot[bot]	788c9f10e0	chore(deps): bump github.com/opencontainers/runc from 1.1.2 to 1.1.5 (#3123 ) Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.1.2 to 1.1.5. - [Release notes](https://github.com/opencontainers/runc/releases) - [Changelog](https://github.com/opencontainers/runc/blob/v1.1.5/CHANGELOG.md) - [Commits](https://github.com/opencontainers/runc/compare/v1.1.2...v1.1.5) --- updated-dependencies: - dependency-name: github.com/opencontainers/runc dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 years ago
Jim	63a2b62b85	chore (deps): update GKW and protobuf; and run "make gen" (#3111 )	3 years ago
Jim	e357f6df7f	chore: update go version to 1.20 (#3105 ) * chore: update go version to 1.20	3 years ago
Jeff Mitchell	164e6cf212	Update nodeenrollment to 0.1.19 (#3090 )	3 years ago
Jim	5243209d96	chore (sdk/api) fix dep references to point to main (#3088 )	3 years ago
Jim	86192f75eb	feature (auth/ldap): add LDAP auth method along with associated accounts and managed groups (#2912 ) * feature (auth): required schema changes for auth ldap method (#2669) chore (auth/ldap): move schema changes to next avail migration number * feature (auth/ldap): define AuthMethod and all its value objects (#2703) * feature (auth/ldap): storage protos * feature (auth/ldap): define AuthMethod and all its value objects * feature (auth/ldap): add repo and reading an auth method (#2718) * feature (auth/ldap): add Repository.CreateAuthMethod(...) and Repository.DeleteAuthMethod(...) (#2724) * feature (auth/ldap): add Repository.UpdateAuthMethod(...) (#2739) * feature (auth/ldap): add Account * feature (auth/ldap): add AuthMethod.EnableGroups * fix (auth/ldap): refactor AuthMethod.oplog to enforce proper constraints * feature (auth/ldap): add Account repo functions * refactor (auth/ldap): remove entry attributes from account Realized the entry attributes could have absolutely anything in them (including binary data) and since we absolutely don't have to have them there's just no reason to take on the risk. * feature (auth/ldap): add AuthMethod.UseTokenGroups * feature (auth/ldap): add Authenticate(...) * refactor (auth/ldap): ensure options take a context as the 1st parameter * feature (auth/ldap): add Account attribute maps * chore (auth/ldap): make fmt deltas * feature (auth/ldap): add managed groups (#2760) * tests (auth/ldap): add missing unit test to Repository.DeleteAccount(...) Add bits to test the delete operation when you're not able to generate oplog metadata * feature (auth/ldap): add managed groups fixup! feature (auth/ldap): add managed groups (#2760) * feature (auth/ldap): service proto definition (#2761) * feature (handlers/authmethods): add handlers for ldap auth method operations (#2794) * feature (auth/ldap): add Account attribute maps * chore (auth/ldap): update cap/ldap to latest version * feature (auth/ldap): add ldap api generation definitions * feature (authmethods): add ldap repo NewService(...) * feature (authmethods/ldap): add proper mask_mapping to protobufs * feature (authmethods): add support to get an ldap auth method * refactor (auth/ldap): export TestGenerateCA(...) * feature (authmethods): add support to create an ldap auth method * feature (authmethods): add support to delete an ldap auth method * feature (authmethods): add support to list ldap auth methods * refactor (auth/ldap): make urls optional for NewAuthMethod(...) * refactor (auth/ldap): export ldap.TestInvalidPem * chore: make fmt changes * fix (auth/ldap): properly handle group search config Add constraints and tests to ensure when an ldap AuthMethod.EnableGroups is true, and UseTokenGroups is false; that there's a GroupDn configured for finding a user's associated groups * feature (authmethods): add support to update an ldap auth methods * chore (db/ldap): tmp mv migrations so there's no conflict with ongoing work * feature (verifier): add ldap auth method to verifier bits * fix (controller): prevent panic when controller stops when there's no listener * feature (authmethods): add support to authenticate via ldap auth methods * chore (migrations): fix whitespace in stmt * chore: fmt fixup * tests (auth/ldap): invalid err msg * feature (cli/authmethods): add support for ldap auth-methods CRUD and authenticate (#2810) * feature (authmethods): add CLI support for ldap auth methods CRUD * tests (api/auth): ldap auth method classification tests * feature (authmethods): add CLI support for ldap auth authenticate * feature (auth/ldap): set request timeouts for ldap server connections * feature (handlers/authmethods): handle u_anon listing properly. * feature (account/handers): ldap account and managed group CRUDL APIs (#2852) * feature (auth/ldap) add repository Listing of ManagedGroupMemberAccount * feature (controller/handlers): add ldapRepoFn to accounts service * feature (auth/ldap) register ldap managed group subtype * feature (account/handlers): ldap account CRUDL APIs * feature (controller/handlers): add ldapRepo to managed groups service * feature (account/handlers): ldap managed group CRUDL APIs * docs (domain): add LDAP accounts, auth-methods and managed groups (#2857) * feature (ldap/cli) add ldap accounts and managed groups CRUDL commands (#2856) * fix (handlers/authmethods): fix ldap authorized actions (#2892) * feature (cli/ldap/authenticate): use primary auth method if none is provided (#2890) * fix (auth/ldap): support setting the state attribute * feature (cli/ldap/authenticate): use primary auth method if none is provided * feature (wh/ldap) add tests for new ldap auth method and accounts (#2919) * refactor (migrations/ldap): mv to correct directory * chore: add copyright headers * fix (api/authmethods/ldap): renumber new LdapAuthMethodAttributes field * fix (auth/ldap): allow the auth method state to be updated (#2951) * chore: update sdk and api versions for llb - this is tmp until merging * tests (managed groups): add required errContains for new test	3 years ago
Jim	2e29894ca7	chore: upgrade deps (#3055 )	3 years ago
Jim	a2692e0a68	update the deps (#3054 )	3 years ago
mickael-hc	7e87f0f0a1	update dependencies (#2972 ) * deps: update ory/dockertest * deps: update /x/net	3 years ago

1 2 3 4 5 ...

325 Commits (1afcefcd7b58de0cefa10db7c70ddfcbe1cd0d53)