Harshavardhana
dd2542e96c
add codespell action ( #18818 )
...
Original work here, #18474 , refixed and updated.
2024-01-17 23:03:17 -08:00
Adrian Najera
96c2304ae8
allow MINIO_STS_DURATION to increase the IDP token expiration ( #18396 )
...
Share link duration is based on the IDP token expiration,
for the share link to last longer, you may now use
MINIO_STS_DURATION environment variable.
2023-11-15 20:42:31 -08:00
Adrian Najera
06f59ad631
fix: expiration time for share link when using OpenID ( #18297 )
2023-10-30 10:21:34 -07:00
Aditya Manthramurthy
cbc0ef459b
Fix policy package import name ( #18031 )
...
We do not need to rename the import of minio/pkg/v2/policy as iampolicy
any more.
2023-09-14 14:50:16 -07:00
Aditya Manthramurthy
1c99fb106c
Update to minio/pkg/v2 ( #17967 )
2023-09-04 12:57:37 -07:00
Aditya Manthramurthy
bde533a9c7
fix: OpenID config initialization ( #17544 )
...
This is due to a regression in the handling of the enable key in OpenID
configuration.
2023-06-29 23:38:26 -07:00
guangwu
87b6fb37d6
chore: pkg imported more than once ( #17444 )
2023-06-26 09:21:29 -07:00
Aditya Manthramurthy
f3248a4b37
Redact all secrets from config viewing APIs ( #17380 )
...
This change adds a `Secret` property to `HelpKV` to identify secrets
like passwords and auth tokens that should not be revealed by the server
in its configuration fetching APIs. Configuration reporting APIs now do
not return secrets.
2023-06-23 07:45:27 -07:00
Aditya Manthramurthy
5a1612fe32
Bump up madmin-go and pkg deps ( #17469 )
2023-06-19 17:53:08 -07:00
jiuker
e94e6adf91
fix: return proper error if OIDC Discoverydoc fails to respond ( #17242 )
2023-05-19 02:13:33 -07:00
Aditya Manthramurthy
09c733677a
Add test for fixed post policy exploit ( #16855 )
2023-03-20 01:06:45 -07:00
Aditya Manthramurthy
58266c9e2c
Add enable flag for LDAP IDP config ( #16805 )
2023-03-16 11:58:59 -07:00
ferhat elmas
714283fae2
cleanup ignored static analysis ( #16767 )
2023-03-06 08:56:10 -08:00
Aditya Manthramurthy
8cde38404d
Add metrics for custom auth plugin ( #16701 )
2023-02-27 09:55:18 -08:00
Harshavardhana
d65debb6bc
fix: comply with RFC6750 UserInfo endpoint requirements ( #16592 )
2023-02-10 22:20:25 +05:30
Harshavardhana
5996c8c4d5
feat: allow offline disks on a fresh start ( #16541 )
2023-02-06 09:26:09 -08:00
Harshavardhana
aa8b9572b9
remove double ENABLED help output ( #16528 )
2023-02-03 05:52:52 -08:00
Aditya Manthramurthy
a469e6768d
Add LDAP DNS SRV record lookup support ( #16201 )
2022-12-12 11:27:27 -08:00
Aditya Manthramurthy
e06127566d
Add IAM API to attach/detach policies for LDAP ( #16182 )
2022-12-09 13:08:33 -08:00
jiuker
8edc2faaa9
reuse sha256 in config GetSettings ( #16188 )
2022-12-08 03:03:24 -08:00
Javier Adriel
04ae9058ed
Populate end_session_endpoint ( #16183 )
2022-12-06 16:56:37 -08:00
Aditya Manthramurthy
a30cfdd88f
Bump up madmin-go to v2 ( #16162 )
2022-12-06 13:46:50 -08:00
Klaus Post
a713aee3d5
Run staticcheck on CI ( #16170 )
2022-12-05 11:18:50 -08:00
Aditya Manthramurthy
87cbd41265
feat: Allow at most one claim based OpenID IDP ( #16145 )
2022-11-29 15:40:49 -08:00
Aditya Manthramurthy
76d822bf1e
Add LDAP policy entities API ( #15908 )
2022-11-07 14:35:09 -08:00
Harshavardhana
7be65f66b8
support HS256 series of JWT signature for OpenID connect ( #15993 )
2022-11-03 16:41:53 -07:00
Aditya Manthramurthy
2d16e74f38
Add LDAP IDP Configuration APIs ( #15840 )
2022-10-19 11:00:10 -07:00
Aditya Manthramurthy
85fc7cea97
Pass role ARN for OIDC providers to console ( #15862 )
2022-10-15 12:57:03 -07:00
hellivan
b0b573052a
fix: unrecognized openid config parameters ( #15847 )
2022-10-12 12:19:44 -07:00
Aditya Manthramurthy
64cf887b28
use LDAP config from minio/pkg to share with console ( #15810 )
2022-10-07 22:12:36 -07:00
Abirdcfly
d4e0f13bb3
chore: remove duplicate word in comments ( #15607 )
...
Signed-off-by: Abirdcfly <fp544037857@gmail.com>
Signed-off-by: Abirdcfly <fp544037857@gmail.com>
2022-08-30 08:26:43 -07:00
Harshavardhana
1823ab6808
LDAP/OpenID must be initialized IAM Init() ( #15491 )
...
This allows for LDAP/OpenID to be non-blocking,
allowing for unreachable Identity targets to be
initialized in IAM.
2022-08-08 16:16:27 -07:00
Harshavardhana
b0d70a0e5e
support additional claim info in Auditing STS calls ( #15381 )
...
Bonus: Adds a missing AuditLog from AssumeRoleWithCertificate API
Fixes #9529
2022-07-22 11:12:03 -07:00
Aditya Manthramurthy
2393a13f86
Allow site replication config with multiple IDPs ( #15361 )
...
Fixes a bug that did not let site replication be configured when
multiple IDPs are configured.
2022-07-21 19:52:23 -07:00
Aditya Manthramurthy
af9bc7ea7d
Add external IDP management Admin API for OpenID ( #15152 )
2022-07-05 18:18:04 -07:00
Harshavardhana
8856a2d77b
finalize startup-banner and remove unnecessary logs ( #15202 )
2022-06-29 16:32:04 -07:00
Aditya Manthramurthy
7f629df4d5
Add generic function to retrieve config value with metadata ( #15083 )
...
`config.ResolveConfigParam` returns the value of a configuration for any
subsystem based on checking env, config store, and default value. Also returns info
about which config source returned the value.
This is useful to return info about config params overridden via env in the user
APIs. Currently implemented only for OpenID subsystem, but will be extended for
others subsequently.
2022-06-17 11:39:21 -07:00
Harshavardhana
9d07cde385
use crypto/sha256 only for FIPS 140-2 compliance ( #14983 )
...
It would seem like the PR #11623 had chewed more
than it wanted to, non-fips build shouldn't really
be forced to use slower crypto/sha256 even for
presumed "non-performance" codepaths. In MinIO
there are really no "non-performance" codepaths.
This assumption seems to have had an adverse
effect in certain areas of CPU usage.
This PR ensures that we stick to sha256-simd
on all non-FIPS builds, our most common build
to ensure we get the best out of the CPU at
any given point in time.
2022-05-27 06:00:19 -07:00
Aditya Manthramurthy
464b9d7c80
Add support for Identity Management Plugin ( #14913 )
...
- Adds an STS API `AssumeRoleWithCustomToken` that can be used to
authenticate via the Id. Mgmt. Plugin.
- Adds a sample identity manager plugin implementation
- Add doc for plugin and STS API
- Add an example program using go SDK for AssumeRoleWithCustomToken
2022-05-26 17:58:09 -07:00
Harshavardhana
fd46a1c3b3
fix: some races when accessing ldap/openid config globally ( #14978 )
2022-05-25 18:32:53 -07:00
Aditya Manthramurthy
e55104a155
Reorganize OpenID config ( #14871 )
...
- Split into multiple files
- Remove JSON unmarshaler for Config and providerCfg types (unused)
2022-05-05 13:40:06 -07:00
Klaus Post
111745c564
Add "enable" to config help ( #14866 )
...
Most help sections were missing "enable", which means it
is filtered out with `mc admin config get --json`.
Add it where missing.
2022-05-05 04:17:04 -07:00
Harshavardhana
c3f689a7d9
JWKS should be parsed before usage ( #14842 )
...
fixes #14811
2022-04-30 15:23:53 -07:00
Aditya Manthramurthy
0e502899a8
Add support for multiple OpenID providers with role policies ( #14223 )
...
- When using multiple providers, claim-based providers are not allowed. All
providers must use role policies.
- Update markdown config to allow `details` HTML element
2022-04-28 18:27:09 -07:00
Sidhartha Mani
fe1fbe0005
standardize config help defaults ( #14788 )
2022-04-26 20:11:37 -07:00
Harshavardhana
43eb5a001c
re-use transport for AdminInfo() call ( #14571 )
...
avoids creating new transport for each `isServerResolvable`
request, instead re-use the available global transport and do
not try to forcibly close connections to avoid TIME_WAIT
build upon large clusters.
Never use httpClient.CloseIdleConnections() since that can have
a drastic effect on existing connections on the transport pool.
Remove it everywhere.
2022-03-17 16:20:10 -07:00
Aditya Manthramurthy
ce97313fda
Add extra LDAP configuration validation ( #14535 )
...
- The result now contains suggestions on fixing common configuration issues.
- These suggestions will subsequently be exposed in console/mc
2022-03-16 19:57:36 -07:00
Aditya Manthramurthy
b7ed3b77bd
Indicate required fields in LDAP configuration correctly ( #14526 )
2022-03-10 19:03:38 -08:00
hellivan
5307e18085
use keycloak_realm properly for keycloak user lookups ( #14401 )
...
In case a user-defined a value for the MINIO_IDENTITY_OPENID_KEYCLOAK_REALM
environment variable, construct the path properly.
2022-02-24 10:16:53 -08:00
hellivan
0913eb6655
fix: openid config provider not initialized correctly ( #14399 )
...
Up until now `InitializeProvider` method of `Config` struct was
implemented on a value receiver which is why changes on `provider`
field where never reflected to method callers. In order to fix this
issue, the method was implemented on a pointer receiver.
2022-02-23 23:42:37 -08:00
