40a7135c0c
core: app entitlements ( #12090 )
...
* core: initial app entitlements
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* base off of pbm
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add tests and oauth2
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add to proxy
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* rewrite to use bindings
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* make policy bindings form and list more customizable
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix tests
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* double fix
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* refine permissions
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add missing rbac modal to app entitlements
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* separate scope for app entitlements
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* include entitlements mapping in proxy
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix tests
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add API validation to prevent policies from being bound to entitlements
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* make preview
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add initial docs
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* remove duplicate docs
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2024-12-18 14:32:44 +01:00
95d26563e7
providers/oauth2: don't handle api scope as special scope ( #9910 )
...
* providers/oauth2: don't handle api scope as special scope
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* make default scope selection less magic
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* ensure missing folder exists
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix duplicate name
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2024-06-01 17:16:56 +09:00
509b502d3c
providers/oauth2: offline access ( #8026 )
...
* improve scope check (log when application requests non-configured scopes)
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add offline_access special scope
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* ensure scope is set
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* update tests for refresh tokens
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* special handling of scopes for github compat
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix spec
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* attempt to fix oidc tests
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* remove hardcoded slug
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* check scope from authorization code instead of request
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix injection for consent stage checking incorrectly
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2024-01-04 19:57:11 +01:00
80f4fccd35
providers/oauth2: OpenID conformance ( #4758 )
...
* don't open inspector by default when debug is enabled
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* encode error in fragment when using hybrid grant_type
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* require nonce for all response_types that get an id_token from the authorization endpoint
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* don't set empty family_name
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* only set at_hash when response has token
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* cleaner way to get login time
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* remove authentication requirement from authentication flow
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* use wrapper
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix auth_time not being handled correctly
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* minor cleanup
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* add test files
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* fix tests
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* remove USER_LOGIN_AUTHENTICATED
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* rework prompt=login handling
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
* also set last login uid for max_age check to prevent double login when max_age and prompt=login is set
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io >
2023-02-23 15:26:41 +01:00
a520a60c82
blueprints: lowercase system blueprints' models
...
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-08-08 20:38:42 +02:00
d1004e3798
blueprints: webui ( #3356 )
2022-08-03 00:05:49 +02:00
a023eee9bf
blueprints: migrate from managed ( #3338 )
...
* test all bundled blueprints
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix empty title
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix default blueprints
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* add script to generate dev config
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* migrate managed to blueprints
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* add more to blueprint instance
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* migrated away from ObjectManager
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix lint errors
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* migrate things
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* migrate tests
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix some tests
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix a bit more
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix more tests
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* whops
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix missing name
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* *sigh*
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* fix more tests
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* add tasks
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* scheduled
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* run discovery on start
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
* oops this test should stay
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org >
2022-08-01 23:05:58 +02:00
