311 Commits (5fe40bc7bd200788e34d8bcf4ce1dfd1da5bbad2)

Author	SHA1	Message	Date
Jeff Mitchell	13545e3171	Revert "internal/cmd/config: allow explicit origin list w/implicit CORS toggle (#1247)" (#1248) ... This reverts commit 579fc621ec.	5 years ago
Chris Marchesi	579fc621ec	internal/cmd/config: allow explicit origin list w/implicit CORS toggle (#1247) ... This ensures that cors_allowed_origins can be set when cors_enabled is not explicitly specified and allowed to be its default (currently true). The current behavior is to clobber this value when cors_enabled is not explicitly set, ultimately setting it to the default of "serve://boundary" only.	5 years ago
Michael Gaffney	21033a6174	Refactor: multiple rename to fix the spelling of subtype (#1227) ... The definition of 'subtype' is 'a secondary or subordinate type'. The 'T' should not be capitalized (unless it is referring to a type of submarine, which its not).	5 years ago
Jeff Mitchell	7ee8ddba6a	True up some spelling	5 years ago
Jeff Mitchell	6f34da8923	Add cleanup of dead connections no longer reported by a worker (#1220)	5 years ago
Alexey Dubkov	a33d1922a1	Fix cmd help for groups: rename user to member (#1212)	5 years ago
denniskniep	5ba8377106	Remove text in oidc command on json format (#1213) ... Fixes #1193 Fixes that the openid connect authenticate command formatted as json returns disturbing text. Therefore it can not be piped and parsed by another tool	5 years ago
Jeff Mitchell	c22631fbca	Fix `boundary database init` respecting format flag (#1204) ... The output was ready for json format but the flag wasn't included.	5 years ago
Jeff Mitchell	22d5c88a0b	Add Output Fields support (#1192)	5 years ago
Jeff Mitchell	f32e7f9144	Add ability for the controller/worker name to be read from env/file (#1181)	5 years ago
Michael Gaffney	f130563da7	Run make fmt	5 years ago
Jim	2437cdcc8d	OIDC: add support for account claim maps (#1186)	5 years ago
Dylan Scott	4ae5003763	PR #1001: Postgres Connection Pooling Control (#1015)	5 years ago
s-christoff	9ceeb3bd65	Add -container-image flag (#1112)	5 years ago
Michael Gaffney	ecc9d6d649	Run make fmt	5 years ago
Todd Knight	5d17bd9eec	Error on `boundary database migrate` if the db hasn't been initialized (#1184)	5 years ago
Jim	8d317023f8	OIDC: make callback URL paths deterministic. (#1188)	5 years ago
Jim	25e657fa51	Ongoing OIDC: support to request additional OIDC scopes from the IdP (#1175)	5 years ago
Jeff Mitchell	4690225c1e	Update delete action behavior and JSON format output (#1155) ... This PR changes delete behavior: * On success, a 204 is returned rather than a 200 with an empty JSON object * The CLI now passes through the 404 error if encountered instead of swallowing it It also updates formatting for JSON to use the response body, which means that the item (or items) in the JSON format are actually the format across the wire, instead of being reinterpreted by unmarshaling into the Go SDK and then remarshaling.	5 years ago
Jeff Mitchell	e6af51943d	Add read:self and delete:self to auth tokens and add logout command (#1162)	5 years ago
Jeff Mitchell	727d1c7085	Add "no-op" action and use it as default for scope permissions (#1138) ... Because of listing visibility, if no actions are assigned to a user for an individual resource, it's excluded from the list. This is fine and good. However, when we made a change in 0.2.0 to restrict the information returned from listing for the anonymous user for scopes and auth methods, it exposed the fact that because of the way this visibility works we had to add `read` to scopes by default -- thereby rather defeating the purpose of restricting what goes back to `u_anon` requests. The purpose of "no-op" is to never be used for real actions within the API, but as something that can be granted to specifically enable visibility for the targeted user. This makes the controls over list visibility much more granular.	5 years ago
Jim	75108cbc8b	Ongoing OIDC: return the primary account info along with the user. (#1145)	5 years ago
Jeff Mitchell	46d7613e2d	Remove extra s in item table output for auth methods and host catalogs	5 years ago
Jeff Mitchell	c54aedcf1a	By default, add Boundary Desktop's origin to allowed CORS origins (#1121) ... This also adds support for a flag to disable this behavior. Fixes #1093	5 years ago
Todd Knight	dc881e65d4	Fix alignment for `Is Primary For Scope` field and values for listing.	5 years ago
Jim	6c003c94f7	add "Is Primary" to auth method CLI output (#1115)	5 years ago
Todd Knight	072b950540	Filter inactive and private oidc auth methods from unauthenticated list requests (#1110)	5 years ago
Todd Knight	53ec3c44bc	Auth Method Listing matches other resources, remove repeated "Version" field. (#1107)	5 years ago
Jeff Mitchell	90b30bad25	Use 202 for token polling endpoint instead of 204 (#1103)	5 years ago
Todd Knight	71673ea161	Pass disable_discovered_config_validation in the API change-state call (#1100)	5 years ago
Jeff Mitchell	f05f37d0fa	Fix panic in non-generated API calls when printing as JSON (#1095) ... Fixes #992	5 years ago
Jim	dd0f34bc35	Add new OIDC auth method. (#1090) ... Co-authored-by: Todd Knight <T.Alan.Knight@gmail.com> Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com> Co-authored-by: Michael Gaffney <mgaffney@users.noreply.github.com>	5 years ago
Jeff Mitchell	6c48f6ea77	Use pointers for any Uber atomic values (#1044) ... BK clued me into the fact that for some types, similar alignment problems exist as with the normal atomic package (e.g. 64-bit types on 32-bit architectures) if they are not pointer values. So change the few places they weren't pointers to pointers. None of these are 64-bit, but it feels like best practice for using the library and should just standardize on it.	5 years ago
Jeff Mitchell	17ad2410cd	Add extra tags config test	5 years ago
Jeff Mitchell	b05ed0bf65	If the database is already initialized, use 0 as the return value (#1033) ... This matches the migrations code, which treats the operation as idempotent.	5 years ago
Jeff Mitchell	6605b4c9f8	Revamp authenticate (#1025)	5 years ago
Todd Knight	48ef25433f	Fix creation of initial Scope roles (#996) ... * Fix the creation of initial roles and users so the admin has permission to list/read resources. * Adding known permission issue to CHANGELOG.md.	5 years ago
Jeff Mitchell	3b452cb503	Fix initial user ID not being shown in some cases during init	5 years ago
Jeff Mitchell	9649a19d23	Update CLI error codes to be consistent with `connect` (#976)	5 years ago
Jeff Mitchell	519efa6dd1	Add -filter to CLI listing and website docs (#967) ... * Add -filter to CLI listing. This doesn't include docs/Changelog yet, that will come shortly. * Add changelog * Add website docs and fix a curl output bug	5 years ago
Jeff Mitchell	4738ceee5d	Add TLS certificate and worker tag reloading on SIGHUP (ICU-1142) (ICU-1143) (#959)	5 years ago
Jeff Mitchell	72aa110f72	CLI JSON updates (#962) ... See Changelog for details.	5 years ago
Jeff Mitchell	341e7aff0d	CLI Generation (#953)	5 years ago
Jeff Mitchell	1ce09069a5	Move worker selection above session creation (#929) ... This prevents a session being created when no workers are available to handle it.	5 years ago
Jeff Mitchell	0993747702	Change server default allowed origin (#931)	5 years ago
Jeff Mitchell	e9da3a871d	Switch on CORS by default if not specified (#928)	5 years ago
Jeff Mitchell	22462cdd84	Add read:self and cancel:self to sessions; add dev unpriv user (#923) ... * Sessions support for read:self and cancel:self permissions. This is automatic with fallback; no API change is needed. * Strips out values from listing if only self actions are allowed on the resource and the user ID is different. This prevents a default ACL of id=*;type=session;actions=read:self,cancel:self from causing all values to be visible when listing. * Adds an unprivileged user to development/testing instances. This user has only default permissions plus the ability to authorize sessions in the default target.	5 years ago
Jeff Mitchell	d279a906ce	Allow public_cluster_addr to use an env var or file (#907) ... Co-authored-by: Jeff Malnick <malnick@gmail.com>	5 years ago
Jeff Mitchell	b61dd0ef36	Update schema version check text	5 years ago
Todd Knight	568594d1b3	Release the shared lock using a non cancelled context (#918)	5 years ago
Louis Ruch	628a02ad15	Scope role grants (#913) ... * Add scope read grant to default roles * Update CHANGELOG.md Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago
Jeff Mitchell	61ec5b47e4	When running single-server mode, use public_cluster_addr if given (#904) ... When running single-server mode, use public_cluster_addr if given Right now you don't need to specify a controller address and we use the cluster listener address; this allows overriding it to the public_cluster_addr if one is given. If `controllers` is specified we allow it to be either the cluster listener or the public cluster address if one is specified before trying to parse and use it.	5 years ago
Jeff Mitchell	7cf74596bf	Update info output key name	5 years ago
Todd Knight	57d4bf2bfd	Removing dev migration feature and checks (#892)	5 years ago
Todd Knight	955ae41215	Support upgrading from old migration table name (#889)	5 years ago
Jeff Mitchell	6cd97a4a6e	Add support for recursive listing (#885)	5 years ago
Todd Knight	1f9fcad1cd	Adding Migrate Command (#872)	5 years ago
Jeff Mitchell	6b58a3317d	Add recursive listing to roles (#881) ... This also lays the framework for adding recursive listing to the rest of the resources.	5 years ago
Jeff Mitchell	526e24cd19	Goimports reordering	5 years ago
Jeff Mitchell	717a3b52ee	Add worker tagging (#862) ... This allows workers to have tags assigned to them, which can then be filtered to control which targets they are allowed to serve.	5 years ago
Todd Knight	595a86508e	Fix lockup when initalizing database. (#875)	5 years ago
Jeff Mitchell	46644300d9	Switch to execabs for os/exec in connect cmd (#873) ... * Switch to execabs for os/exec in connect cmd This is more of an abundance-of-caution change (e.g. defense in depth) but it doesn't seem like we should be using binaries from the current directory for `boundary connect` executions (unless given an explicit path). * Update changelog	5 years ago
Jeff Mitchell	dcb15cffbd	Add authorized actions output on resources (#870)	5 years ago
Todd Knight	ec6151d174	Organize DB Schema Migration Code and DB Init Checks (#842) ... Create Schema Manager and propagate contexts into the DB calls downstream. Add checks at controller startup and database init for correct schema version and schema migration dirty bit being set.	5 years ago
Jeff Mitchell	27919ab11b	Groundwork for returning authorized actions (#860) ... This returns authorized actions on targets to users when they perform an operation on a target, including listing. It also prevents users from seeing values in listing targets on which they have no permissions.	5 years ago
Michael Gaffney	94cb79bbdd	See how Boundary would look with gofumpt applied (#853) ... * See how Boundary would look with https://github.com/mvdan/gofumpt applied Results of running `gofumpt -w -s .` * Update tools file and Makefile for gofumpt Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	5 years ago
Louis Ruch	dbc796759b	ICU-934/Verify controller config block (#851) ... * Verify controller config block * update changelog	5 years ago
Jeff Mitchell	5b5602969f	Update go-keyring to use forked version (#846) ... This may help with #830.	5 years ago
Jeff Mitchell	6580d85388	Remove erronious IsGlobalUnicast check. (#845) ... Fixes the issue raised at https://www.boundaryproject.io/docs/configuration/worker#complete-configuration-example	5 years ago
Jeff Mitchell	e6c98f1454	Add logic to error on certain invalid listener configs (#838) ... This adds logic to error on certain invalid listener config: * If an address in the worker's "controller" set is unspecified or multicast or global unicast, error * If the controller's cluster address is unspecified, ensure public_cluster_addr is set This has been a source of some confusing behavior on some GitHub tickets and even on the team, so preventing it is probably a good idea. It also relaxes the restriction around controller address matching cluster address in single-server mode when using DNS names.	5 years ago
Jeff Mitchell	16f7dc1c96	Update connect unauthorized message to give a bit more detail	5 years ago
Jeff Mitchell	a6cca576a3	Attempt canceling sessions by the client (#831) ... * Attempt canceling sessions by the client In some circumstances (like a Ctrl-C), the client knows it's shutting down and the TOFU token will be lost. In this case it makes sense to cancel the session rather than have it time out. This introduces a command enum to the handshake message which can be used for the client to send commands to the worker -- in this case the only specified command is to cancel the session. It doesn't occur if the session is already timed out or if we can't authorize connections as this generally means the session is already invalid.	5 years ago
Jeff Mitchell	b809d3f12a	Add `kube` connect subcommand (#816)	5 years ago
Jeff Mitchell	9a84e50493	Minor linting	5 years ago
Jeff Mitchell	833f29e352	Switch connection limit for default target to -1 (#814) ... This makes the initial testing workflow less confusing for users	5 years ago
Jeff Mitchell	d4a6efb363	Pass endpoint to the client (#811) ... This allows us to automatically set TLS parameters, useful for `boundary connect http` and some other features to come.	5 years ago
Todd Knight	aa4157639c	Change Format of API Error (#784) ... This is a wire breaking change for json errors since we have removed and renamed a few fields, and changed part of the structure of the returned json error. * Remove redundant fields in Status, details.error_id, details.TraceId and details.request_id from API errors. * Added wrapped errors and "ops" field to indicate the internal operation of the errors returned by the API. * Added error cli error reporting of Op and wrapped errors.	5 years ago
Jeff Mitchell	589c79831f	Create internal capability for json errors for connect (#809) ... * Create internal capability for json errors for connect * Update error codes	5 years ago
Todd Knight	f6e50006fc	Generate postgres.gen.go using schema version directory structure (#808) ... * Reorganize the db migration .sql scripts into individual schema version directories and generate the sql httpfs fakeFile accordingly. * Created a /dev schema version directory to hold db schema updates that have not been finalized. * Add an 'allow-development-migrations' flag to allow `boundary database init` to be executed even when there are schema updates in /dev.	5 years ago
Jeff Malnick	af2d9dfe90	fix: do not print info in output that could be JSON or YAML format (#799) ... * fix: print err msg for no credentials found to stderr	5 years ago
Jeff Malnick	11c7c8dbe8	feat: make auth token staleness and duration configurable (#777) ... * feat: make auth token time to live and staleness configurable * docs: add configuration docs for auth token TTL and staleness Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	6 years ago
Jeff Malnick	a7fca44809	Fix authz flag (#787) ... * Fix authz flag * add changelog bug fix for authz flag Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>	6 years ago
Jim	af6ef1b687	Refactor existing sentinel errors (#774)	6 years ago
Jeff Mitchell	6d59ac1eda	Update synopsis for Connect command so it doesn't wrap on most terminals	6 years ago
Jeff Mitchell	e2e4631929	Add ability to set public cluster address (#761)	6 years ago
Jeff Mitchell	f063b8601c	Fix IPv4-only check when no port is specified (#752) ... We have behavior that causes "0.0.0.0" to only listen on IPv4, however, it also assumed there was a port suffixed. This changes it so that it also works with a port-less address.	6 years ago
Jeff Mitchell	813d21565f	Allow authorize-session to be invoked with target name (#737)	6 years ago
Jeff Mitchell	09b865ab28	Add `pass` cred storage support (#731) ... * Add `pass` cred storage support Make it the default on non-Windows/macOS Document the token storage behavior	6 years ago
Jim	547ae7c802	Fix database init when locale isn't english (#736) ... * use IsMissingTableError(error) * update changelog	6 years ago
Jeff Mitchell	1f48d97327	Support for Unix domain socket listeners (#705) ... The client already supports protocol-agnostic transport so handles unix:/// schemes.	6 years ago
Jeff Mitchell	97e8613eb7	Fix hyphenation of resource subcommand output (#689) ... * Fix hyphenation of resource subcommand output Fixes #686	6 years ago
Jeff Mitchell	f454fa9ef2	Don't return error code 1 if saving the value to the keyring (#668)	6 years ago
Sam Salisbury	bcfd9d038f	version command: fix version string (#662)	6 years ago
Jeff Mitchell	ef16b6177c	Update configuration docs (#661) ... * Update configuration docs * Fix public addr example	6 years ago
Jeff Mitchell	f7bd5e18f9	Fix spacing for scope output in account command	6 years ago
Jeff Mitchell	437f874d44	Fix spacing before Attributes when printing auth method	6 years ago
Jeff Mitchell	868a65ac3d	Don't show "Version v" on startup if empty (#653) ... We'll still show the SHA in this case	6 years ago
Jeff Mitchell	95404b2a56	Separate out protocol-specific functions (#610) ... Placing them into separate files slims down the main connect file and makes it more obvious where things need to be handled for future integrations.	6 years ago
Jeff Mitchell	a982fc9437	Remove proxy proto documentation for now (#606) ... We haven't tested it with the new lib yet. We can add this back whenever we get to testing it.	6 years ago
Jeff Mitchell	603b0582d7	Fix CLI help output and make more consistent (#605)	6 years ago