Wire ACME extensions#1666

Merged

hslatman merged 182 commits intomasterfrom

wire-acme-extensions

Aug 9, 2024

Commits on Jan 8, 2024

Add Wire authz and challenges (OIDC+DPOP)

stefanwire
authored and
hslatman
committed
update wire challenges' status on happy end

stefanwire
authored and
hslatman
committed
simplify OIDC verification

stefanwire
authored and
hslatman
committed
use json struct for challenge request payload otherwise it's a hell to craft from client side

beltram
authored and
hslatman
committed
acquire DPoP signing key from provisioner

stefanwire
authored and
hslatman
committed
better observability

beltram
authored and
hslatman
committed
avoid panic when OIDC config is not provided

stefanwire
authored and
hslatman
committed
print oidc options

beltram
authored and
hslatman
committed
fix: challenge is '.token' and not '.id'

beltram
authored and
hslatman
committed
avoid manipulating the key PEM format and take a plain PEM key as input

beltram
authored and
hslatman
committed
fix csr org validation in finalize

beltram
authored and
hslatman
committed
fix csr domain validation in finalize

beltram
authored and
hslatman
committed
(finalize) have both display name & domain in SANs

beltram
authored and
hslatman
committed
fix orderNames size

beltram
authored and
hslatman
committed
cleanup my mess

beltram
authored and
hslatman
committed
fix san validation

beltram
authored and
hslatman
committed
change uri prefix to impp:wireapp=

beltram
authored and
hslatman
committed
skip empty entries for uniqueSortedLowerNames

stefanwire
authored and
hslatman
committed
feat: adapt to dex and pass the 'keyauth' in payload instead of in id_token. Also have a different mapping for id_token claims name

beltram
authored and
hslatman
committed
feat: change from impp prefix to just im

beltram
authored and
hslatman
committed
fix: exclude displayName from SAN DNS

beltram
authored and
hslatman
committed
remove displayName validation, potentially harmful

beltram
authored and
hslatman
committed
forward displayName in CSR with custom OID

beltram
authored and
hslatman
committed
try using google oidc for demo purpose

beltram
authored and
hslatman
committed
fix google id token matching in oidc challenge

beltram
authored and
hslatman
committed
infer domain from google email address

beltram
authored and
hslatman
committed
adapt google demo for wire's special handle format "{firstname}_wire"

beltram
authored and
hslatman
committed
fix: add URI prefix to handle

beltram
authored and
hslatman
committed
fix: do not convert URIs to lowercase for comparison purpose

beltram
authored and
hslatman
committed
wip

beltram
authored and
hslatman
committed
fix: challenge target field was not mapped to db entity

beltram
authored and
hslatman
committed
add oidc target

beltram
authored and
hslatman
committed
simpler

beltram
authored and
hslatman
committed
passing expected issuer to rusty-jwt-cli

beltram
authored and
hslatman
committed
Replace field access by accessor functions

stefanwire
authored and
hslatman
committed
Reorganize parsing target

stefanwire
authored and
hslatman
committed
fix deviceId computing in dpop challenge

beltram
authored and
hslatman
committed
trying to pass access token to template

beltram
authored and
hslatman
committed
try silencing template data for dichotomies

beltram
authored and
hslatman
committed
try by storing everything in db

beltram
authored and
hslatman
committed
Add new Wire DB methods to `acme.DB` interface
hslatman
committed
have updateOrder also update the update joint table [order by account]

beltram
authored and
hslatman
committed
log more things

beltram
authored and
hslatman
committed
cheat by allowing also looking up for ready orders

beltram
authored and
hslatman
committed
Add `GetAllOrdersByAccountID` to `MockDB`
hslatman
committed
wip

beltram
authored and
hslatman
committed
fix dpop token json serialization to db

beltram
authored and
hslatman
committed
i'm tired

beltram
authored and
hslatman
committed
support for oidc id token

beltram
authored and
hslatman
committed
Make `MockDB` implement `acme.DB` interface again
hslatman
committed
fix: verify custom display_name extension is present

beltram
authored and
hslatman
committed
fix: PR review

beltram
authored and
hslatman
committed
fix: invalid OID for display name in CSR

beltram
authored and
hslatman
committed
fix: access token verification in DPoP challenge. Was previously verifying 'cnf.kid' against backend key whereas it must be against client's key

beltram
authored and
hslatman
committed
client jwk was there the whole time

beltram
authored and
hslatman
committed
print kid for debugging

beltram
authored and
hslatman
committed
b64 encode the kid since apparently it wasn't

beltram
authored and
hslatman
committed
fix: could not reuse a signing key otherwise it would create in accounts & orders and fail the OIDC challenge. The OIDC challenge was not retryable

beltram
authored and
hslatman
committed
fix: oups

beltram
authored and
hslatman
committed
fix: same issue as with oidc challenge

beltram
authored and
hslatman
committed
feat: remove custom hardcoded OIDC challenge for Google

beltram
authored and
hslatman
committed
feat: update the protocol by including team & handle in the client dpop token, verifying the handle in the dpop challenge

beltram
authored and
hslatman
committed
feat: remove query parameters from OIDC issuerUrl so that it allows us to use it to carry the OAuth ClientId in the Challenge.target field without at the same time undermining the idToken verificat…

beltram
authored and
hslatman
committed
feat: try using the new ClientId & Handle format (i.e. plain URIs)

beltram
authored and
hslatman
committed
feat: change the separator between user-id & device-id in a client-id. Use '!' instead of ':'

beltram
authored and
hslatman
committed
Make it compile with Go 1.20 again
hslatman
committed
Fix tests for new ACME orders with Wire IDs
hslatman
committed
Fix the integration test
hslatman
committed

Commits on Jan 10, 2024

Commits on Jan 11, 2024

Commits on Jan 16, 2024

Commits on Jan 17, 2024

Commits on Jan 18, 2024

Add check for empty deviceID in target URI template evaluation
hslatman
committed

Commits on Jan 19, 2024

fix: use 2 separate identifiers for Wire
beltram
committed

Commits on Jan 23, 2024

Update acme/order.go

beltram
and
hslatman
authored
use switch statement
beltram
committed

Commits on Feb 6, 2024

Commits on Feb 7, 2024

Merge pull request #1691 from smallstep/herman/wire-acme-improvements
hslatman
authored

Commits on Feb 13, 2024

Merge branch 'master' into wire-acme-extensions
hslatman
committed

Commits on Feb 15, 2024

Merge branch 'master' into wire-acme-extensions
hslatman
committed

Commits on Feb 22, 2024

Merge branch 'master' into wire-acme-extensions
hslatman
committed

Commits on Mar 4, 2024

Commits on Mar 5, 2024

Merge branch 'master' into wire-acme-extensions
hslatman
committed

Commits on Mar 6, 2024

Commits on Mar 8, 2024

Commits on Mar 12, 2024

Commits on Mar 27, 2024

Commits on Apr 22, 2024

Merge branch 'master' into wire-acme-extensions
hslatman
committed

Commits on Aug 2, 2024

Commits on Aug 6, 2024

Merge branch 'master' into wire-acme-extensions
hslatman
committed