c93c6ee6f9
root: replace boj/redistore with vendored version of rbcervilla/redisstore ( #6988 )
...
* root: replace boj/redistore with vendored version of rbcervilla/redisstore
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* setup env for go tests
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-09-26 18:56:37 +02:00
9e29789c09
root: fix config loading for outposts ( #6640 )
...
* root: fix config loading for outposts
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix error handling
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* improve check to see if outpost is embedded or not
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* also fix oauth url fetching
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-08-26 19:40:48 +02:00
a2714ab1f1
outposts: make metrics compliant with Prometheus best-practices ( #6398 )
...
web/outpost: make metrics compliant with Prometheus best-practices
Today, all NewHistogramVec store values in nanoseconds without changing
the default histogram bucket, which are made for seconds, making them
a bit useless. In addition, some metrics names are not self-explanatoryand
and do not comply with Prometheus best practices.
This commit tries to fix all of this "issues".
NOTE: I kept old metrics in order to avoid breaking changes with
existing dashboards and metrics.
Signed-off-by: Alexandre NICOLAIE <xunleii@users.noreply.github.com >
2023-07-27 18:51:08 +02:00
fd2677af1f
root: bump api generator ( #5139 )
...
* root: bump api generator
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* bump api diff too
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* bump go api client
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* simplify go api generation
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-04-01 18:10:52 +02:00
ec42b597ab
providers/proxy: send token request internally, with overwritten host header ( #4675 )
...
* send token request internally, with overwritten host header
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-02-13 16:34:47 +01:00
21e29744c2
providers/proxy: different cookie name based on hashed client id ( #4666 )
2023-02-12 16:34:57 +01:00
7d4ce41e12
providers/proxy: outpost wide logout implementation ( #4605 )
...
* initial outpost wide logout implementation
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* handle deserialize error
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* update docs
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix file cleanup, add tests
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix tests
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-02-02 21:18:59 +01:00
43854dc828
outposts/proxy: fix panic due to IsSet misbehaving
...
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-01-19 18:22:55 +01:00
c11367553e
providers/proxy: fix issuer for embedded outpost ( #4480 )
...
fix issuer for embedded outpost
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-01-19 15:39:30 +01:00
9b2ceb0d44
outposts/proxy: make logged user more consistent, set FlushInterval
...
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-01-14 23:58:15 +01:00
0ddcefce80
outposts/proxy: cache basic and bearer credentials for one minute
...
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-01-14 22:12:48 +01:00
4c45d35507
outposts/proxy: fix error handling, remove requirement for profile/etc scopes
...
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-01-14 21:44:28 +01:00
cd12e177ea
providers/proxy: add initial header token auth ( #4421 )
...
* initial implementation
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* check for openid/profile claims
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* include jwks sources in proxy provider
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add web ui for jwks
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* only show sources with JWKS data configured
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix introspection tests
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* start basic
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add basic auth
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add docs, update admonitions
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add client_id to api, add tab for auth
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* update locale
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-01-13 16:22:03 +01:00
b3da1d223c
providers/proxy: correctly set id_token_hint if possible
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-12-12 19:02:37 +00:00
0cc83c23c4
providers/proxy: fix duplicate proxy set default
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-08-18 21:13:45 +01:00
514c48a986
internal: fix routing for requests with querystring signature to embedded outpost
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-08-18 20:43:01 +02:00
201bea6d30
internal: add X-authentik-logout signature to trigger logouts when URLs are not exposed
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-08-07 18:50:24 +02:00
393d7ec486
providers/proxy: no exposed urls ( #3151 )
...
* test any callback
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* cleanup
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* dont detect callback in per-server handler
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* use full redirect uri with both path and query param
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* update tests
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* correctly route to embedded outpost for callback signature
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix allowed redirects
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-07-30 17:51:01 +02:00
41eb44137e
internal: remove pkg/errors
2022-07-05 20:26:33 +00:00
8447e9b9c2
providers/proxy: envoy v2 ( #3029 )
...
* add path prefix
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* use prefix correctly
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* only set redirect if session doesn't have a redirect yet
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-06-03 10:32:52 +02:00
3eb466ff4b
lifecycle: cleanup prometheus ( #2972 )
...
* remove high cardinality labels
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* retry worker number for prometheus multiprocess id
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* revert to pid, use subdirectories
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* cleanup more
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* use worker id based off of https://github.com/benoitc/gunicorn/issues/1352
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix missing app label
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* tests/e2e: remove static names
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-05-29 21:45:25 +02:00
a286f999e2
api: migrate to openapi generator v6 ( #2968 )
...
* migrate to openapi generator v6
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* bump api
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-05-26 15:15:30 +02:00
a52638d898
internal: fix typo in session name constant
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-05-20 10:10:29 +02:00
421b003218
internal: set path on cookie for proxy
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
#2305
2022-05-11 10:08:38 +02:00
62a939b91d
internal: bump api client to v3
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-03-03 10:40:07 +01:00
4343246a41
*: rename akprox to outpost.goauthentik.io ( #2266 )
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-02-08 20:25:38 +01:00
ebb5711c32
providers/proxy: add support for X-Original-URI in nginx, better handle missing headers and report errors to authentik
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-01-27 18:14:02 +01:00
7f47f93e4e
internal: cleanup log messages
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-01-19 19:01:24 +01:00
14c7d8c4f4
internal: route traffic to proxy providers based on cookie domain when multiple domain-level providers exist
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
#2079
2022-01-18 23:19:43 +01:00
ececfc3a30
internal: fix comment formatting for TODOs
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-01-07 09:51:41 +01:00
cac5c7b3ea
outposts/proxy: make templates more re-usable
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-12-20 22:20:23 +01:00
c843f18743
lib: add additional celery logger to sentry ignore
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-12-20 21:04:45 +01:00
7a73ddfb60
outposts/proxy: match skipPathRegex against full URL on domain auth
...
closes #1955
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-12-18 15:50:42 +01:00
7d6e88061f
outposts: check if hub from context is set and fallback
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-12-16 11:19:57 +01:00
f8aab40e3e
internal: cleanup duplicate and redundant code, properly set sentry SDK scope settings
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-12-16 11:00:19 +01:00
5f0f4284a2
web/admin: fix rendering for applications on view page
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-12-13 15:27:28 +01:00
85a417d22e
outposts/proxy: re-add rs256 support
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-12-02 15:17:32 +01:00
e917e756cc
outposts/proxy: make logging fields more consistent
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-12-02 09:58:50 +01:00
8b7f698c7b
outposts/proxy: continue compiling additional regexes even when one fails
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-11-28 15:06:26 +01:00
c98bdbacc5
providers/proxy: return list of configured scope names so outpost requests custom scopes
...
closes #1762
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-11-10 23:06:21 +01:00
4d51ec906d
internal/proxyv2: improve error handling when configuring app
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-10-13 21:48:11 +02:00
22a7c25526
internal: call GetStore on application to improve logging
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-10-12 13:33:20 +02:00
a6a6b3bd06
outposts: add outpost_name label to metrics
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-09-16 10:04:17 +02:00
48ad3dccda
outposts/proxy: remove deprecated rs256
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-09-16 09:57:47 +02:00
9a79bab43d
outposts/proxy: fix redirect URL error due to callback url not being joined correctly
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-09-10 16:19:29 +02:00
e5944567e8
outposts/proxy: fix url not being substituted for sign_out
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-09-09 11:00:58 +02:00
b9c605bf1a
outpost/proxy: fix double slash when trailing slash in authentik_host
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-09-08 22:03:41 +02:00
2983adc719
outpost/proxyv2: fix redirect to localhost
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-09-08 21:07:16 +02:00
3c1b70c355
outposts/proxyv2 ( #1365 )
...
* outposts/proxyv2: initial commit
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
add rs256
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
more stuff
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
add forward auth an sign_out
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
match cookie name
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
re-add support for rs256 for backwards compat
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
add error handler
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
ensure unique user-agent is used
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
set cookie duration based on id_token expiry
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
build proxy v2
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
add ssl
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
add basic auth and custom header support
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
add application cert loading
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
implement whitelist
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
add redis
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
migrate embedded outpost to v2
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
remove old proxy
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
providers/proxy: make token expiration configurable
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
add metrics
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
fix tests
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* providers/proxy: only allow one redirect URI
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix docker build for proxy
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* remove default port offset
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* add AUTHENTIK_HOST_BROWSER
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* tests: fix e2e/integration tests not using proper tags
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* remove references of old port
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix user_attributes not being loaded correctly
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* cleanup dependencies
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* cleanup
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2021-09-08 18:04:56 +00:00
