new release: 0.10.4-stable

Bumps [@patternfly/patternfly](https://github.com/patternfly/patternfly) from 4.35.2 to 4.42.2.
- [Release notes](https://github.com/patternfly/patternfly/releases)
- [Changelog](https://github.com/patternfly/patternfly/blob/master/RELEASE-NOTES.md)
- [Commits](https://github.com/patternfly/patternfly/compare/prerelease-v4.35.2...prerelease-v4.42.2)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.10.3-stable
+current_version = 0.10.4-stable
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-(?P<release>.*)
@@ -28,3 +28,5 @@ values =
 [bumpversion:file:.github/workflows/release.yml]
 
 [bumpversion:file:passbook/__init__.py]
+
+[bumpversion:file:proxy/pkg/version.go]

.github/workflows/release.yml

@@ -18,11 +18,11 @@ jobs:
       - name: Building Docker Image
         run: docker build
           --no-cache
-          -t beryju/passbook:0.10.3-stable
+          -t beryju/passbook:0.10.4-stable
           -t beryju/passbook:latest
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/passbook:0.10.3-stable
+        run: docker push beryju/passbook:0.10.4-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/passbook:latest
   build-proxy:
@@ -48,11 +48,11 @@ jobs:
           cd proxy
           docker build \
           --no-cache \
-          -t beryju/passbook-proxy:0.10.3-stable \
+          -t beryju/passbook-proxy:0.10.4-stable \
           -t beryju/passbook-proxy:latest \
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/passbook-proxy:0.10.3-stable
+        run: docker push beryju/passbook-proxy:0.10.4-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/passbook-proxy:latest
   build-static:
@@ -77,11 +77,11 @@ jobs:
         run: docker build
           --no-cache
           --network=$(docker network ls | grep github | awk '{print $1}')
-          -t beryju/passbook-static:0.10.3-stable
+          -t beryju/passbook-static:0.10.4-stable
           -t beryju/passbook-static:latest
           -f static.Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/passbook-static:0.10.3-stable
+        run: docker push beryju/passbook-static:0.10.4-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/passbook-static:latest
   test-release:
@@ -114,5 +114,5 @@ jobs:
           SENTRY_PROJECT: passbook
           SENTRY_URL: https://sentry.beryju.org
         with:
-          tagName: 0.10.3-stable
+          tagName: 0.10.4-stable
           environment: beryjuorg-prod

.pylintrc

@@ -1,9 +1,16 @@
 [MASTER]
 
 disable=arguments-differ,no-self-use,fixme,locally-disabled,too-many-ancestors,too-few-public-methods,import-outside-toplevel,bad-continuation,signature-differs,similarities,cyclic-import
+
 load-plugins=pylint_django,pylint.extensions.bad_builtin
+
 extension-pkg-whitelist=lxml
+
+# Allow constants to be shorter than normal (and lowercase, for settings.py)
 const-rgx=[a-zA-Z0-9_]{1,40}$
+
 ignored-modules=django-otp
-jobs=12
 ignore=migrations
+max-attributes=12
+
+jobs=12

Pipfile.lock

@@ -74,17 +74,17 @@
         },
         "boto3": {
             "hashes": [
-                "sha256:25c716b7c01d4664027afc6a6418a06459e311a610c7fd39a030a1ced1b72ce4"
+                "sha256:44073b1b1823ffc9edcf9027afbca908dad6bd5000f512ca73f929f6a604ae24"
             ],
             "index": "pypi",
-            "version": "==1.14.63"
+            "version": "==1.15.1"
         },
         "botocore": {
             "hashes": [
-                "sha256:40f13f6c9c29c307a9dc5982739e537ddce55b29787b90c3447b507e3283bcd6",
-                "sha256:aa88eafc6295132f4bc606f1df32b3248e0fa611724c0a216aceda767948ac75"
+                "sha256:6bdf60281c2e80360fe904851a1a07df3dcfe066fe88dc7fba2b5e626ac05c8c",
+                "sha256:d6bdf51c8880aa9974e6b61d2f7d9d1debe407287e2e9e60f36c789fe8ba6790"
             ],
-            "version": "==1.17.63"
+            "version": "==1.18.1"
         },
         "cachetools": {
             "hashes": [
@@ -355,14 +355,6 @@
             "index": "pypi",
             "version": "==0.3.0"
         },
-        "docutils": {
-            "hashes": [
-                "sha256:6c4f696463b79f1fb8ba0c594b63840ebd41f059e92b31957c46b74a4599b6d0",
-                "sha256:9e4d7ecfc600058e07ba661411a2b7de2fd0fafa17d1a7f7361cd47b1175c827",
-                "sha256:a2aeea129088da402665e92e0b25b04b073c04b2dce4ab65caaa38b7ce2e1a99"
-            ],
-            "version": "==0.15.2"
-        },
         "drf-yasg": {
             "hashes": [
                 "sha256:5572e9d5baab9f6b49318169df9789f7399d0e3c7bdac8fdb8dfccf1d5d2b1ca",

SECURITY.md

@@ -6,7 +6,8 @@ As passbook is currently in a pre-stable, only the latest "stable" version is su
 
 | Version  | Supported          |
 | -------- | ------------------ |
-| 0.8.15   | :white_check_mark: |
+| 0.9.x    | :white_check_mark: |
+| 0.10.x   | :white_check_mark: |
 
 ## Reporting a Vulnerability
 

docker-compose.yml

@@ -23,7 +23,7 @@ services:
     labels:
       - traefik.enable=false
   server:
-    image: beryju/passbook:${PASSBOOK_TAG:-0.10.3-stable}
+    image: beryju/passbook:${PASSBOOK_TAG:-0.10.4-stable}
     command: server
     environment:
       PASSBOOK_REDIS__HOST: redis
@@ -41,7 +41,7 @@ services:
     env_file:
       - .env
   worker:
-    image: beryju/passbook:${PASSBOOK_TAG:-0.10.3-stable}
+    image: beryju/passbook:${PASSBOOK_TAG:-0.10.4-stable}
     command: worker
     networks:
       - internal
@@ -55,7 +55,7 @@ services:
     env_file:
       - .env
   static:
-    image: beryju/passbook-static:${PASSBOOK_TAG:-0.10.3-stable}
+    image: beryju/passbook-static:${PASSBOOK_TAG:-0.10.4-stable}
     networks:
       - internal
     labels:

docs/flow/flows.md

@@ -39,7 +39,6 @@ This designates a flow for unenrollment. This flow can contain any amount of ver
 This designates a flow for recovery. This flow normally contains an [**identification**](stages/identification/index.md) stage to find the user. It can also contain any amount of verification stages, such as [**email**](stages/email/index.md) or [**captcha**](stages/captcha/index.md).
 Afterwards, use the [**prompt**](stages/prompt/index.md) stage to ask the user for a new password and the [**user_write**](stages/user_write.md) stage to update the password.
 
-### Change Password
+### Setup
 
-This designates a flow for password changes. This flow can contain any amount of verification stages, such as [**email**](stages/email/index.md) or [**captcha**](stages/captcha/index.md).
-Afterwards, use the [**prompt**](stages/prompt/index.md) stage to ask the user for a new password and the [**user_write**](stages/user_write.md) stage to update the password.
+This designates a flow for general setup. This designation doesn't have any constraints in what you can do. For example, by default this designation is used to configure Factors, like change a password and setup TOTP.

docs/installation/docker-compose.md

@@ -11,9 +11,9 @@ This installation method is for test-setups and small-scale productive setups.
 
 Download the latest `docker-compose.yml` from [here](https://raw.githubusercontent.com/BeryJu/passbook/master/docker-compose.yml). Place it in a directory of your choice.
 
-To optionally enable error-reporting, run `echo PASSBOOK_ERROR_REPORTING=true >> .env`
+To optionally enable error-reporting, run `echo PASSBOOK_ERROR_REPORTING__ENABLED=true >> .env`
 
-To optionally deploy a different version run `echo PASSBOOK_TAG=0.10.3-stable >> .env`
+To optionally deploy a different version run `echo PASSBOOK_TAG=0.10.4-stable >> .env`
 
 If this is a fresh passbook install run the following commands to generate a password:
 

docs/installation/kubernetes.md

@@ -11,7 +11,7 @@ This installation automatically applies database migrations on startup. After th
 image:
   name: beryju/passbook
   name_static: beryju/passbook-static
-  tag: 0.10.3-stable
+  tag: 0.10.4-stable
 
 nameOverride: ""
 

docs/integrations/services/sentry/index.md

@@ -15,27 +15,31 @@ From https://sentry.io
 
 The following placeholders will be used:
 
--   `sentry.company` is the FQDN of the Sentry install.
--   `passbook.company` is the FQDN of the passbook install.
+- `sentry.company` is the FQDN of the Sentry install.
+- `passbook.company` is the FQDN of the passbook install.
 
-Create an application in passbook. Create an OpenID provider with the following parameters:
+Create an application in passbook. Create a SAML Provider with the following values
 
--   Client Type: `Confidential`
--   Response types: `code (Authorization Code Flow)`
--   JWT Algorithm: `RS256`
--   Redirect URIs: `https://sentry.company/auth/sso/`
--   Scopes: `openid email`
+- ACS URL: `https://sentry.company/saml/acs/<sentry organisation name>/`
+- Audience: `https://sentry.company/saml/metadata/<sentry organisation name>/`
+- Issuer: `passbook`
+- Service Provider Binding: `Post`
+- Property Mapping: Select all Autogenerated Mappings
 
 ## Sentry
 
 **This guide assumes you've installed Sentry using [getsentry/onpremise](https://github.com/getsentry/onpremise)**
 
-- Add `sentry-auth-oidc` to `onpremise/sentry/requirements.txt` (Create the file if it doesn't exist yet)
-- Add the following block to your `onpremise/sentry/sentry.conf.py`:
-```
-OIDC_ISSUER = "passbook"
-OIDC_CLIENT_ID = "<Client ID from passbook>"
-OIDC_CLIENT_SECRET = "<Client Secret from passbook>"
-OIDC_SCOPE = "openid email"
-OIDC_DOMAIN = "https://passbook.company/application/oidc/"
-```
+Navigate to Settings -> Auth, and click on Configure next to SAML2
+
+![](./auth.png)
+
+In passbook, get the Metadata URL by right-clicking `Download Metadata` and selecting Copy Link Address, and paste that URL into Sentry.
+
+On the next screen, input these Values
+
+IdP User ID: `urn:oid:0.9.2342.19200300.100.1.1`
+User Email: `urn:oid:0.9.2342.19200300.100.1.3`
+First Name: `urn:oid:2.5.4.3`
+
+After confirming, Sentry will authenticate with passbook, and you should be redirected back to a page confirming your settings.

docs/integrations/services/sonarr/index.md

@@ -0,0 +1,37 @@
+# Sonarr Integration
+
+!!! note
+    These instructions apply to all projects in the *arr Family. If you use multiple of these projects, you can assign them to the same Outpost.
+
+## What is Sonarr
+
+From https://github.com/Sonarr/Sonarr
+
+!!! note ""
+    Sonarr is a PVR for Usenet and BitTorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.
+
+
+## Preparation
+
+The following placeholders will be used:
+
+- `sonarr.company` is the FQDN of the Sonarr install.
+- `passbook.company` is the FQDN of the passbook install.
+
+Create an application in passbook. Create a Proxy Provider with the following values
+
+- Internal host
+
+    If Sonarr is running in docker, and you're deploying the passbook proxy on the same host, set the value to `http://sonarr:8989`, where sonarr is the name of your container.
+
+    If Sonarr is running on a different server than where you are deploying the passbook proxy, set the value to `http://sonarr.company:8989`.
+
+- External host
+
+    Set this to the external URL you will be accessing Sonarr from.
+
+## Deployment
+
+Create an outpost deployment for the provider you've created above, as described [here](../../../outposts/outposts.md). Deploy this Outpost either on the same host or a different host that can access Sonarr.
+
+The outpost will connect to passbook and configure itself.

docs/integrations/services/tower-awx/index.md

@@ -16,14 +16,15 @@ From https://docs.ansible.com/ansible/2.5/reference_appendices/tower.html
 
 The following placeholders will be used:
 
--   `awx.company` is the FQDN of the AWX/Tower install.
--   `passbook.company` is the FQDN of the passbook install.
+- `awx.company` is the FQDN of the AWX/Tower install.
+- `passbook.company` is the FQDN of the passbook install.
 
 Create an application in passbook and note the slug, as this will be used later. Create a SAML provider with the following parameters:
 
--   ACS URL: `https://awx.company/sso/complete/saml/`
--   Audience: `awx`
--   Issuer: `https://awx.company/sso/metadata/saml/`
+- ACS URL: `https://awx.company/sso/complete/saml/`
+- Audience: `awx`
+- Service Provider Binding: Post
+- Issuer: `https://awx.company/sso/metadata/saml/`
 
 You can of course use a custom signing certificate, and adjust durations.
 

docs/integrations/services/ubuntu-landscape/index.md

@@ -0,0 +1,58 @@
+# Ubuntu Landscape Integration
+
+## What is Ubuntu Landscape
+
+From https://en.wikipedia.org/wiki/Landscape_(software)
+
+!!! note ""
+
+    Landscape is a systems management tool developed by Canonical. It can be run on-premises or in the cloud depending on the needs of the user. It is primarily designed for use with Ubuntu derivatives such as Desktop, Server, and Core.
+
+!!! warning
+
+    This requires passbook 0.10.3 or newer.
+
+## Preparation
+
+The following placeholders will be used:
+
+ - `landscape.company` is the FQDN of the Landscape server.
+ - `passbook.company` is the FQDN of the passbook install.
+
+Landscape uses the OpenID-Connect Protocol for single-sign on.
+
+## passbook Setup
+
+Create an OAuth2/OpenID-Connect Provider with the default settings. Set the Redirect URIs to `https://landscape.company/login/handle-openid`. Select all Autogenerated Scopes.
+
+Keep Note of the Client ID and the Client Secret.
+
+Create an application and assign access policies to the application. Set the application's provider to the provider you've just created.
+
+## Landscape Setup
+
+On the Landscape Server, edit the file `/etc/landscape/service.conf` and add the following snippet under the `[landscape]` section:
+
+```
+oidc-issuer = https://passbook.company/application/o/<slug of the application you've created>/
+oidc-client-id = <client ID of the provider you've created>
+oidc-client-secret = <client Secret of the provider you've created>
+```
+
+Afterwards, run `sudo lsctl restart` to restart the Landscape services.
+
+## Appendix
+
+To make an OpenID-Connect User admin, you have to insert some rows into the database.
+
+First login with your passbook user, and make sure the user is created successfully.
+
+Run `sudo -u postgres psql landscape-standalone-main` on the Landscape server to open a PostgreSQL Prompt.
+Then run `select * from person;` to get a list of all users. Take note of the ID given to your new user.
+
+Run the following commands to make this user an administrator:
+
+```sql
+INSERT INTO person_account VALUES (<user id>, 1);
+INSERT INTO person_access VALUES (<user id>, 1, 1);
+```

docs/integrations/services/vmware-vcenter/index.md

@@ -47,7 +47,7 @@ Under *Sources*, click *Edit* and ensure that "Autogenerated Active Directory Ma
 Under *Providers*, create an OAuth2/OpenID Provider with these settings:
 
  - Client Type: Confidential
- - Response Type: code
+ - Response Type: code (ADFS Compatibility Mode, sends id_token as access_token)
  - JWT Algorithm: RS256
  - Redirect URI: `https://vcenter.company/ui/login/oauth2/authcode`
  - Post Logout Redirect URIs: `https://vcenter.company/ui/login`

docs/outposts/deploy-docker-compose.md

@@ -15,6 +15,6 @@ services:
       - 4443:4443
     environment:
       PASSBOOK_HOST: https://your-passbook.tld
-      PASSBOOK_INSECURE: 'true'
+      PASSBOOK_INSECURE: 'false'
       PASSBOOK_TOKEN: token-generated-by-passbook
 ```

docs/outposts/upgrading.md

@@ -0,0 +1,9 @@
+# Upgrading an Outpost
+
+In the Outpost Overview list, you'll see if any deployed outposts are out of date.
+
+![](./upgrading_outdated.png)
+
+To upgrade the Outpost to the latest version, simple adjust the docker tag of the outpost the the new version.
+
+Since the configuration is managed by passbook, that's all you have to do.

e2e/test_provider_oauth2_oidc.py

@@ -33,6 +33,7 @@ from passbook.providers.oauth2.models import (
 )
 
 LOGGER = get_logger()
+APPLICATION_SLUG = "grafana"
 
 
 @skipUnless(platform.startswith("linux"), "requires local docker")
@@ -69,6 +70,12 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
                 "GF_AUTH_GENERIC_OAUTH_API_URL": (
                     self.url("passbook_providers_oauth2:userinfo")
                 ),
+                "GF_AUTH_SIGNOUT_REDIRECT_URL": (
+                    self.url(
+                        "passbook_providers_oauth2:end-session",
+                        application_slug=APPLICATION_SLUG,
+                    )
+                ),
                 "GF_LOG_LEVEL": "debug",
             },
         }
@@ -97,7 +104,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         )
         provider.save()
         Application.objects.create(
-            name="Grafana", slug="grafana", provider=provider,
+            name="Grafana", slug=APPLICATION_SLUG, provider=provider,
         )
 
         self.driver.get("http://localhost:3000")
@@ -137,7 +144,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         )
         provider.save()
         Application.objects.create(
-            name="Grafana", slug="grafana", provider=provider,
+            name="Grafana", slug=APPLICATION_SLUG, provider=provider,
         )
 
         self.driver.get("http://localhost:3000")
@@ -171,6 +178,72 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
             USER().email,
         )
 
+    def test_authorization_logout(self):
+        """test OpenID Provider flow with logout"""
+        sleep(1)
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-implicit-consent"
+        )
+        provider = OAuth2Provider.objects.create(
+            name="grafana",
+            client_type=ClientTypes.CONFIDENTIAL,
+            client_id=self.client_id,
+            client_secret=self.client_secret,
+            rsa_key=CertificateKeyPair.objects.first(),
+            redirect_uris="http://localhost:3000/login/generic_oauth",
+            authorization_flow=authorization_flow,
+            response_type=ResponseTypes.CODE,
+        )
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+            )
+        )
+        provider.save()
+        Application.objects.create(
+            name="Grafana", slug=APPLICATION_SLUG, provider=provider,
+        )
+
+        self.driver.get("http://localhost:3000")
+        self.driver.find_element(By.CLASS_NAME, "btn-service--oauth").click()
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.driver.find_element(By.XPATH, "//a[contains(@href, '/profile')]").click()
+        self.assertEqual(
+            self.driver.find_element(By.CLASS_NAME, "page-header__title").text,
+            USER().name,
+        )
+        self.assertEqual(
+            self.driver.find_element(By.CSS_SELECTOR, "input[name=name]").get_attribute(
+                "value"
+            ),
+            USER().name,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.CSS_SELECTOR, "input[name=email]"
+            ).get_attribute("value"),
+            USER().email,
+        )
+        self.assertEqual(
+            self.driver.find_element(
+                By.CSS_SELECTOR, "input[name=login]"
+            ).get_attribute("value"),
+            USER().email,
+        )
+        self.driver.find_element(By.CSS_SELECTOR, "[href='/logout']").click()
+        self.wait_for_url(
+            self.url(
+                "passbook_providers_oauth2:end-session",
+                application_slug=APPLICATION_SLUG,
+            )
+        )
+        self.driver.find_element(By.ID, "logout").click()
+
     def test_authorization_consent_explicit(self):
         """test OpenID Provider flow (default authorization flow with explicit consent)"""
         sleep(1)
@@ -195,7 +268,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         )
         provider.save()
         app = Application.objects.create(
-            name="Grafana", slug="grafana", provider=provider,
+            name="Grafana", slug=APPLICATION_SLUG, provider=provider,
         )
 
         self.driver.get("http://localhost:3000")
@@ -271,7 +344,7 @@ class TestProviderOAuth2OIDC(SeleniumTestCase):
         )
         provider.save()
         app = Application.objects.create(
-            name="Grafana", slug="grafana", provider=provider,
+            name="Grafana", slug=APPLICATION_SLUG, provider=provider,
         )
 
         negative_policy = ExpressionPolicy.objects.create(

e2e/test_provider_proxy.py

@@ -77,7 +77,7 @@ class TestProviderProxy(SeleniumTestCase):
         # Wait until outpost healthcheck succeeds
         healthcheck_retries = 0
         while healthcheck_retries < 50:
-            if outpost.health:
+            if outpost.deployment_health:
                 break
             healthcheck_retries += 1
             sleep(0.5)

helm/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
-appVersion: "0.10.3-stable"
+appVersion: "0.10.4-stable"
 description: A Helm chart for passbook.
 name: passbook
-version: "0.10.3-stable"
+version: "0.10.4-stable"
 icon: https://github.com/BeryJu/passbook/blob/master/docs/images/logo.svg
 dependencies:
   - name: postgresql

helm/values.yaml

@@ -4,7 +4,7 @@
 image:
   name: beryju/passbook
   name_static: beryju/passbook-static
-  tag: 0.10.3-stable
+  tag: 0.10.4-stable
 
 nameOverride: ""
 

mkdocs.yml

@@ -32,6 +32,7 @@ nav:
     - Proxy: providers/proxy.md
   - Outposts:
     - Overview: outposts/outposts.md
+    - Upgrading: outposts/upgrading.md
     - Deploy on docker-compose: outposts/deploy-docker-compose.md
     - Deploy on Kubernetes: outposts/deploy-kubernetes.md
   - Expressions:
@@ -53,6 +54,8 @@ nav:
         - Sentry: integrations/services/sentry/index.md
         - Ansible Tower/AWX: integrations/services/tower-awx/index.md
         - VMware vCenter: integrations/services/vmware-vcenter/index.md
+        - Ubuntu Landscape: integrations/services/ubuntu-landscape/index.md
+        - Sonarr: integrations/services/sonarr/index.md
   - Upgrading:
     - to 0.9: upgrading/to-0.9.md
     - to 0.10: upgrading/to-0.10.md

passbook/__init__.py

@@ -1,2 +1,2 @@
 """passbook"""
-__version__ = "0.10.3-stable"
+__version__ = "0.10.4-stable"

passbook/admin/fields.py

@@ -53,6 +53,8 @@ class YAMLField(forms.JSONField):
             )
         if isinstance(converted, str):
             return YAMLString(converted)
+        if converted is None:
+            return {}
         return converted
 
     def bound_data(self, data, initial):

passbook/admin/middleware.py

@@ -1,26 +0,0 @@
-"""passbook admin Middleware to impersonate users"""
-
-from passbook.core.models import User
-
-
-def impersonate(get_response):
-    """Middleware to impersonate users"""
-
-    def middleware(request):
-        """Middleware to impersonate users"""
-
-        # User is superuser and has __impersonate ID set
-        if request.user.is_superuser and "__impersonate" in request.GET:
-            request.session["impersonate_id"] = request.GET["__impersonate"]
-        # user wants to stop impersonation
-        elif "__unimpersonate" in request.GET and "impersonate_id" in request.session:
-            del request.session["impersonate_id"]
-
-        # Actually impersonate user
-        if request.user.is_superuser and "impersonate_id" in request.session:
-            request.user = User.objects.get(pk=request.session["impersonate_id"])
-
-        response = get_response(request)
-        return response
-
-    return middleware

passbook/admin/settings.py

@@ -1,5 +0,0 @@
-"""passbook admin settings"""
-
-MIDDLEWARE = [
-    "passbook.admin.middleware.impersonate",
-]

passbook/admin/templates/administration/outpost/list.html

@@ -3,6 +3,7 @@
 {% load i18n %}
 {% load humanize %}
 {% load passbook_utils %}
+{% load admin_reflection %}
 
 {% block head %}
 {{ block.super }}
@@ -32,7 +33,7 @@
         <div class="pf-c-toolbar">
             <div class="pf-c-toolbar__content">
                 <div class="pf-c-toolbar__bulk-select">
-                    <a href="{% url 'passbook_admin:flow-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                    <a href="{% url 'passbook_admin:outpost-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
                 </div>
                 {% include 'partials/pagination.html' %}
             </div>
@@ -43,6 +44,7 @@
                     <th role="columnheader" scope="col">{% trans 'Name' %}</th>
                     <th role="columnheader" scope="col">{% trans 'Providers' %}</th>
                     <th role="columnheader" scope="col">{% trans 'Health' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Version' %}</th>
                     <th role="cell"></th>
                 </tr>
             </thead>
@@ -50,7 +52,7 @@
                 {% for outpost in object_list %}
                 <tr role="row">
                     <th role="columnheader">
-                        <a href="{% url 'passbook_outposts:setup' outpost_pk=outpost.pk %}">{{ outpost.name }}</a>
+                        <span>{{ outpost.name }}</span>
                     </th>
                     <td role="cell">
                         <span>
@@ -58,7 +60,7 @@
                         </span>
                     </td>
                     <td role="cell">
-                        {% with health=outpost.health %}
+                        {% with health=outpost.deployment_health %}
                         {% if health %}
                             <i class="fas fa-check pf-m-success"></i> {{ health|naturaltime }}
                         {% else %}
@@ -66,10 +68,28 @@
                         {% endif %}
                         {% endwith %}
                     </td>
+                    <td role="cell">
+                        <span>
+                            {% with ver=outpost.deployment_version %}
+                            {% if ver.outdated %}
+                                {% if ver.version == "" %}
+                                <i class="fas fa-times pf-m-danger"></i> -
+                                {% else %}
+                                <i class="fas fa-times pf-m-danger"></i> {% blocktrans with is=ver.version should=ver.should %}{{ is }}, should be {{ should }}{% endblocktrans %}
+                                {% endif %}
+                            {% else %}
+                            <i class="fas fa-check pf-m-success"></i> {{ ver.version }}
+                            {% endif %}
+                            {% endwith %}
+                        </span>
+                    </td>
                     <td>
                         <a class="pf-c-button pf-m-secondary" href="{% url 'passbook_admin:outpost-update' pk=outpost.pk %}?back={{ request.get_full_path }}">{% trans 'Edit' %}</a>
                         <a class="pf-c-button pf-m-danger" href="{% url 'passbook_admin:outpost-delete' pk=outpost.pk %}?back={{ request.get_full_path }}">{% trans 'Delete' %}</a>
-                        <a href="https://passbook.beryju.org/outposts/outposts/#deploy">{% trans 'Deploy' %}</a>
+                        {% get_htmls outpost as htmls %}
+                        {% for html in htmls %}
+                        {{ html|safe }}
+                        {% endfor %}
                     </td>
                 </tr>
                 {% endfor %}

passbook/admin/templates/administration/user/list.html

@@ -55,7 +55,7 @@
                         <a class="pf-c-button pf-m-secondary" href="{% url 'passbook_admin:user-update' pk=user.pk %}?back={{ request.get_full_path }}">{% trans 'Edit' %}</a>
                         <a class="pf-c-button pf-m-danger" href="{% url 'passbook_admin:user-delete' pk=user.pk %}?back={{ request.get_full_path }}">{% trans 'Delete' %}</a>
                         <a class="pf-c-button pf-m-tertiary" href="{% url 'passbook_admin:user-password-reset' pk=user.pk %}?back={{ request.get_full_path }}">{% trans 'Reset Password' %}</a>
-                        <a class="pf-c-button pf-m-tertiary" href="{% url 'passbook_core:overview' %}?__impersonate={{ user.pk }}">{% trans 'Impersonate' %}</a>
+                        <a class="pf-c-button pf-m-tertiary" href="{% url 'passbook_core:impersonate-init' user_id=user.pk %}">{% trans 'Impersonate' %}</a>
                     </td>
                 </tr>
                 {% endfor %}

passbook/admin/views/outposts.py

@@ -1,4 +1,7 @@
 """passbook Outpost administration"""
+from dataclasses import asdict
+from typing import Any, Dict
+
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
@@ -12,7 +15,7 @@ from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 from passbook.admin.views.utils import DeleteMessageView
 from passbook.lib.views import CreateAssignPermView
 from passbook.outposts.forms import OutpostForm
-from passbook.outposts.models import Outpost
+from passbook.outposts.models import Outpost, OutpostConfig
 
 
 class OutpostListView(LoginRequiredMixin, PermissionListMixin, ListView):
@@ -41,6 +44,13 @@ class OutpostCreateView(
     success_url = reverse_lazy("passbook_admin:outposts")
     success_message = _("Successfully created Outpost")
 
+    def get_initial(self) -> Dict[str, Any]:
+        return {
+            "_config": asdict(
+                OutpostConfig(passbook_host=self.request.build_absolute_uri("/"))
+            )
+        }
+
 
 class OutpostUpdateView(
     SuccessMessageMixin, LoginRequiredMixin, PermissionRequiredMixin, UpdateView
@@ -53,7 +63,7 @@ class OutpostUpdateView(
 
     template_name = "generic/update.html"
     success_url = reverse_lazy("passbook_admin:outposts")
-    success_message = _("Successfully updated Certificate-Key Pair")
+    success_message = _("Successfully updated Outpost")
 
 
 class OutpostDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView):
@@ -64,4 +74,4 @@ class OutpostDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessa
 
     template_name = "generic/delete.html"
     success_url = reverse_lazy("passbook_admin:outposts")
-    success_message = _("Successfully deleted Certificate-Key Pair")
+    success_message = _("Successfully deleted Outpost")

passbook/audit/migrations/0002_auto_20200918_2116.py

@@ -0,0 +1,33 @@
+# Generated by Django 3.1.1 on 2020-09-18 21:16
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_audit", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="event",
+            name="action",
+            field=models.TextField(
+                choices=[
+                    ("LOGIN", "login"),
+                    ("LOGIN_FAILED", "login_failed"),
+                    ("LOGOUT", "logout"),
+                    ("AUTHORIZE_APPLICATION", "authorize_application"),
+                    ("SUSPICIOUS_REQUEST", "suspicious_request"),
+                    ("SIGN_UP", "sign_up"),
+                    ("PASSWORD_RESET", "password_reset"),
+                    ("INVITE_CREATED", "invitation_created"),
+                    ("INVITE_USED", "invitation_used"),
+                    ("IMPERSONATION_STARTED", "impersonation_started"),
+                    ("IMPERSONATION_ENDED", "impersonation_ended"),
+                    ("CUSTOM", "custom"),
+                ]
+            ),
+        ),
+    ]

passbook/audit/models.py

@@ -6,15 +6,16 @@ from uuid import UUID, uuid4
 
 from django.conf import settings
 from django.contrib.auth.models import AnonymousUser
-from django.contrib.contenttypes.models import ContentType
 from django.core.exceptions import ValidationError
 from django.db import models
+from django.db.models.base import Model
 from django.http import HttpRequest
 from django.utils.translation import gettext as _
 from django.views.debug import SafeExceptionReporterFilter
 from guardian.shortcuts import get_anonymous_user
 from structlog import get_logger
 
+from passbook.core.middleware import SESSION_IMPERSONATE_ORIGINAL_USER
 from passbook.lib.utils.http import get_client_ip
 
 LOGGER = get_logger()
@@ -36,6 +37,19 @@ def cleanse_dict(source: Dict[Any, Any]) -> Dict[Any, Any]:
     return final_dict
 
 
+def model_to_dict(model: Model) -> Dict[str, Any]:
+    """Convert model to dict"""
+    name = str(model)
+    if hasattr(model, "name"):
+        name = model.name
+    return {
+        "app": model._meta.app_label,
+        "model_name": model._meta.model_name,
+        "pk": model.pk,
+        "name": name,
+    }
+
+
 def sanitize_dict(source: Dict[Any, Any]) -> Dict[Any, Any]:
     """clean source of all Models that would interfere with the JSONField.
     Models are replaced with a dictionary of {
@@ -48,18 +62,7 @@ def sanitize_dict(source: Dict[Any, Any]) -> Dict[Any, Any]:
         if isinstance(value, dict):
             final_dict[key] = sanitize_dict(value)
         elif isinstance(value, models.Model):
-            model_content_type = ContentType.objects.get_for_model(value)
-            name = str(value)
-            if hasattr(value, "name"):
-                name = value.name
-            final_dict[key] = sanitize_dict(
-                {
-                    "app": model_content_type.app_label,
-                    "model_name": model_content_type.model,
-                    "pk": value.pk,
-                    "name": name,
-                }
-            )
+            final_dict[key] = sanitize_dict(model_to_dict(value))
         elif isinstance(value, UUID):
             final_dict[key] = value.hex
         else:
@@ -79,6 +82,8 @@ class EventAction(Enum):
     PASSWORD_RESET = "password_reset"  # noqa # nosec
     INVITE_CREATED = "invitation_created"
     INVITE_USED = "invitation_used"
+    IMPERSONATION_STARTED = "impersonation_started"
+    IMPERSONATION_ENDED = "impersonation_ended"
     CUSTOM = "custom"
 
     @staticmethod
@@ -140,6 +145,12 @@ class Event(models.Model):
                 self.user = request.user
         if user:
             self.user = user
+        # Check if we're currently impersonating, and add that user
+        if hasattr(request, "session"):
+            if SESSION_IMPERSONATE_ORIGINAL_USER in request.session:
+                self.context["on_behalf_of"] = model_to_dict(
+                    request.session[SESSION_IMPERSONATE_ORIGINAL_USER]
+                )
         # User 255.255.255.255 as fallback if IP cannot be determined
         self.client_ip = get_client_ip(request) or "255.255.255.255"
         # If there's no app set, we get it from the requests too

passbook/core/middleware.py

@@ -0,0 +1,26 @@
+"""passbook admin Middleware to impersonate users"""
+
+from typing import Callable
+
+from django.http import HttpRequest, HttpResponse
+
+SESSION_IMPERSONATE_USER = "passbook_impersonate_user"
+SESSION_IMPERSONATE_ORIGINAL_USER = "passbook_impersonate_original_user"
+
+
+class ImpersonateMiddleware:
+    """Middleware to impersonate users"""
+
+    get_response: Callable[[HttpRequest], HttpResponse]
+
+    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
+        self.get_response = get_response
+
+    def __call__(self, request: HttpRequest) -> HttpResponse:
+        # No permission checks are done here, they need to be checked before
+        # SESSION_IMPERSONATE_USER is set.
+
+        if SESSION_IMPERSONATE_USER in request.session:
+            request.user = request.session[SESSION_IMPERSONATE_USER]
+
+        return self.get_response(request)

passbook/core/migrations/0010_auto_20200917_1021.py

@@ -0,0 +1,24 @@
+# Generated by Django 3.1.1 on 2020-09-17 10:21
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_core", "0009_group_is_superuser"),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name="user",
+            options={
+                "permissions": (
+                    ("reset_user_password", "Reset Password"),
+                    ("impersonate", "Can impersonate other users"),
+                ),
+                "verbose_name": "User",
+                "verbose_name_plural": "Users",
+            },
+        ),
+    ]

passbook/core/models.py

@@ -98,7 +98,10 @@ class User(GuardianUserMixin, AbstractUser):
 
     class Meta:
 
-        permissions = (("reset_user_password", "Reset Password"),)
+        permissions = (
+            ("reset_user_password", "Reset Password"),
+            ("impersonate", "Can impersonate other users"),
+        )
         verbose_name = _("User")
         verbose_name_plural = _("Users")
 
@@ -157,7 +160,7 @@ class Application(PolicyBindingModel):
         if self.meta_launch_url:
             return self.meta_launch_url
         if self.provider:
-            return self.provider.launch_url
+            return self.get_provider().launch_url
         return None
 
     def get_provider(self) -> Optional[Provider]:

passbook/core/templates/base/skeleton.html

@@ -21,13 +21,13 @@
         {% endblock %}
     </head>
     <body>
-        {% if 'impersonate_id' in request.session %}
+        {% if 'passbook_impersonate_user' in request.session %}
         <div class="pf-c-banner pf-m-warning pf-c-alert pf-m-sticky">
             <div class="pf-l-flex pf-m-justify-content-center pf-m-justify-content-space-between-on-lg pf-m-nowrap" style="height: 100%;">
                 <div class=""></div>
                 <div class="pf-u-display-none pf-u-display-block-on-lg">
                     {% blocktrans with user=user %}You're currently impersonating {{ user }}.{% endblocktrans %}
-                    <a href="?__unimpersonate=True" id="acceptMessage">{% trans 'Stop impersonation' %}</a>
+                    <a href="{% url 'passbook_core:impersonate-end' %}?back={{ request.get_full_path }}" id="acceptMessage">{% trans 'Stop impersonation' %}</a>
                 </div>
                 <div class=""></div>
             </div>

passbook/core/templates/overview/index.html

@@ -7,6 +7,7 @@
 <style>
     img.app-icon {
         max-height: 72px;
+        width: auto !important;
     }
 </style>
 {% endblock %}

passbook/core/tests/test_impersonation.py

@@ -0,0 +1,55 @@
+"""impersonation tests"""
+from django.shortcuts import reverse
+from django.test.testcases import TestCase
+
+from passbook.core.models import User
+
+
+class TestImpersonation(TestCase):
+    """impersonation tests"""
+
+    def setUp(self) -> None:
+        super().setUp()
+        self.other_user = User.objects.create(username="to-impersonate")
+        self.pbadmin = User.objects.get(username="pbadmin")
+
+    def test_impersonate_simple(self):
+        """test simple impersonation and un-impersonation"""
+        self.client.force_login(self.pbadmin)
+
+        self.client.get(
+            reverse(
+                "passbook_core:impersonate-init", kwargs={"user_id": self.other_user.pk}
+            )
+        )
+
+        response = self.client.get(reverse("passbook_core:overview"))
+        self.assertIn(self.other_user.username, response.content.decode())
+        self.assertNotIn(self.pbadmin.username, response.content.decode())
+
+        self.client.get(reverse("passbook_core:impersonate-end"))
+
+        response = self.client.get(reverse("passbook_core:overview"))
+        self.assertNotIn(self.other_user.username, response.content.decode())
+        self.assertIn(self.pbadmin.username, response.content.decode())
+
+    def test_impersonate_denied(self):
+        """test impersonation without permissions"""
+        self.client.force_login(self.other_user)
+
+        self.client.get(
+            reverse(
+                "passbook_core:impersonate-init", kwargs={"user_id": self.pbadmin.pk}
+            )
+        )
+
+        response = self.client.get(reverse("passbook_core:overview"))
+        self.assertIn(self.other_user.username, response.content.decode())
+        self.assertNotIn(self.pbadmin.username, response.content.decode())
+
+    def test_un_impersonate_empty(self):
+        """test un-impersonation without impersonating first"""
+        self.client.force_login(self.other_user)
+
+        response = self.client.get(reverse("passbook_core:impersonate-end"))
+        self.assertRedirects(response, reverse("passbook_core:overview"))

passbook/core/urls.py

@@ -1,11 +1,22 @@
 """passbook URL Configuration"""
 from django.urls import path
 
-from passbook.core.views import overview, user
+from passbook.core.views import impersonate, overview, user
 
 urlpatterns = [
     # User views
     path("-/user/", user.UserSettingsView.as_view(), name="user-settings"),
     # Overview
     path("", overview.OverviewView.as_view(), name="overview"),
+    # Impersonation
+    path(
+        "-/impersonation/<int:user_id>/",
+        impersonate.ImpersonateInitView.as_view(),
+        name="impersonate-init",
+    ),
+    path(
+        "-/impersonation/end/",
+        impersonate.ImpersonateEndView.as_view(),
+        name="impersonate-end",
+    ),
 ]

passbook/core/views/impersonate.py

@@ -0,0 +1,56 @@
+"""passbook impersonation views"""
+
+from django.http import HttpRequest, HttpResponse
+from django.shortcuts import get_object_or_404, redirect
+from django.views import View
+from structlog import get_logger
+
+from passbook.audit.models import Event, EventAction
+from passbook.core.middleware import (
+    SESSION_IMPERSONATE_ORIGINAL_USER,
+    SESSION_IMPERSONATE_USER,
+)
+from passbook.core.models import User
+
+LOGGER = get_logger()
+
+
+class ImpersonateInitView(View):
+    """Initiate Impersonation"""
+
+    def get(self, request: HttpRequest, user_id: int) -> HttpResponse:
+        """Impersonation handler, checks permissions"""
+        if not request.user.has_perm("impersonate"):
+            LOGGER.debug(
+                "User attempted to impersonate without permissions", user=request.user
+            )
+            return HttpResponse("Unauthorized", status=401)
+
+        user_to_be = get_object_or_404(User, pk=user_id)
+
+        request.session[SESSION_IMPERSONATE_ORIGINAL_USER] = request.user
+        request.session[SESSION_IMPERSONATE_USER] = user_to_be
+
+        Event.new(EventAction.IMPERSONATION_STARTED).from_http(request)
+
+        return redirect("passbook_core:overview")
+
+
+class ImpersonateEndView(View):
+    """End User impersonation"""
+
+    def get(self, request: HttpRequest) -> HttpResponse:
+        """End Impersonation handler"""
+        if (
+            SESSION_IMPERSONATE_USER not in request.session
+            or SESSION_IMPERSONATE_ORIGINAL_USER not in request.session
+        ):
+            LOGGER.debug("Can't end impersonation", user=request.user)
+            return redirect("passbook_core:overview")
+
+        del request.session[SESSION_IMPERSONATE_USER]
+        del request.session[SESSION_IMPERSONATE_ORIGINAL_USER]
+
+        Event.new(EventAction.IMPERSONATION_ENDED).from_http(request)
+
+        return redirect("passbook_core:overview")

passbook/flows/planner.py

@@ -177,6 +177,6 @@ class FlowPlanner:
                         marker = ReevaluateMarker(binding=binding, user=user)
                     plan.markers.append(marker)
         LOGGER.debug(
-            "f(plan): Finished building", flow=self.flow, duration_s=span.timestamp,
+            "f(plan): Finished building", flow=self.flow,
         )
         return plan

passbook/flows/templates/flows/denied_shell.html

@@ -0,0 +1,57 @@
+{% extends 'login/base.html' %}
+
+{% load static %}
+{% load i18n %}
+{% load passbook_utils %}
+
+{% block card_title %}
+{% trans 'Permission denied' %}
+{% endblock %}
+
+{% block title %}
+{% trans 'Permission denied' %}
+{% endblock %}
+
+{% block card %}
+    <form method="POST" class="pf-c-form">
+        {% csrf_token %}
+        {% include 'partials/form.html' %}
+        <div class="pf-c-form__group">
+            <p>
+                <i class="pf-icon pf-icon-error-circle-o"></i>
+                {% trans 'Request has been denied.' %}
+            </p>
+            {% if error %}
+            <hr>
+            <p>
+                {{ error }}
+            </p>
+            {% endif %}
+            {% if policy_result %}
+            <hr>
+            <em>
+                {% trans 'Explanation:' %}
+            </em>
+            <ul class="pf-c-list">
+                {% for source_result in policy_result.source_results %}
+                <li>
+                    {% blocktrans with name=source_result.source_policy.name result=source_result.passing %}
+                    Policy '{{ name }}' returned result '{{ result }}'
+                    {% endblocktrans %}
+                    {% if source_result.messages %}
+                    <ul class="pf-c-list">
+                        {% for message in source_result.messages %}
+                            <li>{{ message }}</li>
+                        {% endfor %}
+                    </ul>
+                    {% endif %}
+                </li>
+                {% endfor %}
+            </ul>
+            {% endif %}
+        </div>
+        {% if 'back' in request.GET %}
+        <a href="{% back %}" class="btn btn-primary btn-block btn-lg">{% trans 'Back' %}</a>
+        {% endif %}
+    </form>
+{% endblock %}

passbook/flows/views.py

@@ -187,9 +187,11 @@ class FlowExecutorView(View):
         is a superuser."""
         LOGGER.debug("f(exec): Stage invalid", flow_slug=self.flow.slug)
         self.cancel()
-        response = AccessDeniedResponse(self.request)
+        response = AccessDeniedResponse(
+            self.request, template="flows/denied_shell.html"
+        )
         response.error_message = error_message
-        return response
+        return to_stage_response(self.request, response)
 
     def cancel(self):
         """Cancel current execution and return a redirect"""

passbook/lib/sentry.py

@@ -5,6 +5,7 @@ from celery.exceptions import CeleryError
 from django.core.exceptions import DisallowedHost, ValidationError
 from django.db import InternalError, OperationalError, ProgrammingError
 from django_redis.exceptions import ConnectionInterrupted
+from ldap3.core.exceptions import LDAPException
 from redis.exceptions import ConnectionError as RedisConnectionError
 from redis.exceptions import RedisError
 from rest_framework.exceptions import APIException
@@ -39,6 +40,7 @@ def before_send(event, hint):
         SentryIgnoredException,
         WebSocketException,
         CeleryError,
+        LDAPException,
     )
     if "exc_info" in hint:
         _, exc_value, _ = hint["exc_info"]

passbook/outposts/channels.py

@@ -83,7 +83,11 @@ class OutpostConsumer(JsonWebsocketConsumer):
     def receive_json(self, content: Data):
         msg = from_dict(WebsocketMessage, content)
         if msg.instruction == WebsocketMessageInstruction.HELLO:
-            cache.set(self.outpost.health_cache_key, time(), timeout=60)
+            cache.set(self.outpost.state_cache_prefix("health"), time(), timeout=60)
+            if "version" in msg.args:
+                cache.set(
+                    self.outpost.state_cache_prefix("version"), msg.args["version"]
+                )
         elif msg.instruction == WebsocketMessageInstruction.ACK:
             return
 

passbook/outposts/forms.py

@@ -4,8 +4,8 @@ from django import forms
 from django.utils.translation import gettext_lazy as _
 
 from passbook.admin.fields import CodeMirrorWidget, YAMLField
-from passbook.core.models import Provider
 from passbook.outposts.models import Outpost
+from passbook.providers.proxy.models import ProxyProvider
 
 
 class OutpostForm(forms.ModelForm):
@@ -13,7 +13,7 @@ class OutpostForm(forms.ModelForm):
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        self.fields["providers"].queryset = Provider.objects.all().select_subclasses()
+        self.fields["providers"].queryset = ProxyProvider.objects.all()
 
     class Meta:
 

passbook/outposts/models.py

@@ -1,7 +1,7 @@
 """Outpost models"""
 from dataclasses import asdict, dataclass
 from datetime import datetime
-from typing import Iterable, Optional
+from typing import Any, Dict, Iterable, Optional
 from uuid import uuid4
 
 from dacite import from_dict
@@ -9,12 +9,19 @@ from django.contrib.postgres.fields import ArrayField
 from django.core.cache import cache
 from django.db import models, transaction
 from django.db.models.base import Model
+from django.http import HttpRequest
+from django.utils import version
 from django.utils.translation import gettext_lazy as _
 from guardian.models import UserObjectPermission
 from guardian.shortcuts import assign_perm
+from packaging.version import InvalidVersion, parse
 
+from passbook import __version__
 from passbook.core.models import Provider, Token, TokenIntents, User
 from passbook.lib.config import CONFIG
+from passbook.lib.utils.template import render_to_string
+
+OUR_VERSION = parse(__version__)
 
 
 @dataclass
@@ -91,20 +98,37 @@ class Outpost(models.Model):
         """Dump config into json"""
         self._config = asdict(value)
 
-    @property
-    def health_cache_key(self) -> str:
-        """Key by which the outposts health status is saved"""
-        return f"outpost_{self.uuid.hex}_health"
+    def state_cache_prefix(self, suffix: str) -> str:
+        """Key by which the outposts status is saved"""
+        return f"outpost_{self.uuid.hex}_state_{suffix}"
 
     @property
-    def health(self) -> Optional[datetime]:
+    def deployment_health(self) -> Optional[datetime]:
         """Get outpost's health status"""
-        key = self.health_cache_key
+        key = self.state_cache_prefix("health")
         value = cache.get(key, None)
         if value:
             return datetime.fromtimestamp(value)
         return None
 
+    @property
+    def deployment_version(self) -> Dict[str, Any]:
+        """Get deployed outposts version, and if the version is behind ours.
+        Returns a dict with keys version and outdated."""
+        key = self.state_cache_prefix("version")
+        value = cache.get(key, None)
+        if not value:
+            return {"version": "", "outdated": False, "should": OUR_VERSION}
+        try:
+            outpost_version = parse(value)
+            return {
+                "version": value,
+                "outdated": outpost_version < OUR_VERSION,
+                "should": OUR_VERSION,
+            }
+        except InvalidVersion:
+            return {"version": version, "outdated": False, "should": OUR_VERSION}
+
     @property
     def user(self) -> User:
         """Get/create user with access to all required objects"""
@@ -149,5 +173,12 @@ class Outpost(models.Model):
                 objects.append(provider)
         return objects
 
+    def html_deployment_view(self, request: HttpRequest) -> Optional[str]:
+        """return template and context modal to view token and other config info"""
+        return render_to_string(
+            "outposts/deployment_modal.html",
+            {"outpost": self, "full_url": request.build_absolute_uri("/")},
+        )
+
     def __str__(self) -> str:
         return f"Outpost {self.name}"

passbook/outposts/templates/outposts/deployment_modal.html

@@ -0,0 +1,43 @@
+{% load i18n %}
+{% load static %}
+<button class="pf-c-button pf-m-tertiary" data-target="modal" data-modal="saml-{{ provider.pk }}">{% trans 'View Deployment Info' %}</button>
+
+<div class="pf-c-backdrop" id="saml-{{ provider.pk }}" hidden>
+    <div class="pf-l-bullseye">
+        <div class="pf-c-modal-box pf-m-lg" role="dialog">
+            <button data-modal-close class="pf-c-button pf-m-plain" type="button" aria-label="Close dialog">
+                <i class="fas fa-times" aria-hidden="true"></i>
+            </button>
+            <div class="pf-c-modal-box__header">
+                <h1 class="pf-c-title pf-m-2xl" id="modal-title">{% trans 'Outpost Deployment Info' %}</h1>
+            </div>
+            <div class="pf-c-modal-box__body" id="modal-description">
+                <p><a href="https://passbook.beryju.org/outposts/outposts/#deploy">{% trans 'View deployment documentation' %}</a></p>
+                <form class="pf-c-form">
+                    <div class="pf-c-form__group">
+                        <label class="pf-c-form__label" for="help-text-simple-form-name">
+                            <span class="pf-c-form__label-text">PASSBOOK_HOST</span>
+                        </label>
+                        <input class="pf-c-form-control" readonly type="text" value="{{ full_url }}" />
+                    </div>
+                    <div class="pf-c-form__group">
+                        <label class="pf-c-form__label" for="help-text-simple-form-name">
+                            <span class="pf-c-form__label-text">PASSBOOK_TOKEN</span>
+                        </label>
+                        <input class="pf-c-form-control" readonly type="text" value="{{ outpost.token.token_uuid.hex }}" />
+                    </div>
+                    <h3>{% trans 'If your passbook Instance is using a self-signed certificate, set this value.' %}</h3>
+                    <div class="pf-c-form__group">
+                        <label class="pf-c-form__label" for="help-text-simple-form-name">
+                            <span class="pf-c-form__label-text">PASSBOOK_INSECURE</span>
+                        </label>
+                        <input class="pf-c-form-control" readonly type="text" value="true" />
+                    </div>
+                </form>
+            </div>
+            <footer class="pf-c-modal-box__footer pf-m-align-left">
+                <button data-modal-close class="pf-c-button pf-m-primary" type="button">{% trans 'Close' %}</button>
+            </footer>
+        </div>
+    </div>
+</div>

passbook/policies/http.py

@@ -18,10 +18,9 @@ class AccessDeniedResponse(TemplateResponse):
     error_message: Optional[str] = None
     policy_result: Optional[PolicyResult] = None
 
-    def __init__(self, request: HttpRequest) -> None:
-        # For some reason pyright complains about keyword argument usage here
-        # pyright: reportGeneralTypeIssues=false
-        super().__init__(request=request, template="policies/denied.html")
+    # pyright: reportGeneralTypeIssues=false
+    def __init__(self, request: HttpRequest, template="policies/denied.html") -> None:
+        super().__init__(request, template)
         self.title = _("Access denied")
 
     def resolve_context(

passbook/policies/templates/policies/denied.html

@@ -19,7 +19,7 @@
         <div class="pf-c-form__group">
             <p>
                 <i class="pf-icon pf-icon-error-circle-o"></i>
-                {% trans 'Access denied' %}
+                {% trans 'Request has been denied.' %}
             </p>
             {% if error %}
             <hr>

passbook/providers/oauth2/api.py

@@ -22,7 +22,6 @@ class OAuth2ProviderSerializer(ModelSerializer):
             "jwt_alg",
             "rsa_key",
             "redirect_uris",
-            "post_logout_redirect_uris",
             "sub_mode",
             "property_mappings",
         ]

passbook/providers/oauth2/forms.py

@@ -41,7 +41,6 @@ class OAuth2ProviderForm(forms.ModelForm):
             "jwt_alg",
             "rsa_key",
             "redirect_uris",
-            "post_logout_redirect_uris",
             "sub_mode",
             "property_mappings",
         ]

passbook/providers/oauth2/migrations/0004_remove_oauth2provider_post_logout_redirect_uris.py

@@ -0,0 +1,16 @@
+# Generated by Django 3.1.1 on 2020-09-18 21:16
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_providers_oauth2", "0003_auto_20200916_2129"),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name="oauth2provider", name="post_logout_redirect_uris",
+        ),
+    ]

passbook/providers/oauth2/models.py

@@ -71,7 +71,7 @@ class ResponseTypes(models.TextChoices):
 
     CODE = "code", _("code (Authorization Code Flow)")
     CODE_ADFS = (
-        "code_adfs",
+        "code#adfs",
         _("code (ADFS Compatibility Mode, sends id_token as access_token)"),
     )
     ID_TOKEN = "id_token", _("id_token (Implicit Flow)")
@@ -157,12 +157,6 @@ class OAuth2Provider(Provider):
         verbose_name=_("Redirect URIs"),
         help_text=_("Enter each URI on a new line."),
     )
-    post_logout_redirect_uris = models.TextField(
-        blank=True,
-        default="",
-        verbose_name=_("Post Logout Redirect URIs"),
-        help_text=_("Enter each URI on a new line."),
-    )
 
     include_claims_in_id_token = models.BooleanField(
         default=True,
@@ -269,12 +263,11 @@ class OAuth2Provider(Provider):
     @property
     def launch_url(self) -> Optional[str]:
         """Guess launch_url based on first redirect_uri"""
-        if not self.redirect_uris:
+        if self.redirect_uris == "":
             return None
-        main_url = self.redirect_uris[0]
+        main_url = self.redirect_uris.split("\n")[0]
         launch_url = urlparse(main_url)
-        launch_url.path = ""
-        return launch_url.geturl()
+        return main_url.replace(launch_url.path, "")
 
     def form(self) -> Type[ModelForm]:
         from passbook.providers.oauth2.forms import OAuth2ProviderForm
@@ -300,6 +293,7 @@ class OAuth2Provider(Provider):
                 "providers/oauth2/setup_url_modal.html",
                 {
                     "provider": self,
+                    "issuer": self.get_issuer(request),
                     "authorize": request.build_absolute_uri(
                         reverse("passbook_providers_oauth2:authorize",)
                     ),
@@ -346,7 +340,6 @@ class BaseGrantModel(models.Model):
         abstract = True
 
 
-# pylint: disable=too-many-instance-attributes
 class AuthorizationCode(ExpiringModel, BaseGrantModel):
     """OAuth2 Authorization Code"""
 
@@ -373,7 +366,6 @@ class AuthorizationCode(ExpiringModel, BaseGrantModel):
 
 
 @dataclass
-# plyint: disable=too-many-instance-attributes
 class IDToken:
     """The primary extension that OpenID Connect makes to OAuth 2.0 to enable End-Users to be
     Authenticated is the ID Token data structure. The ID Token is a security token that contains

passbook/providers/oauth2/templates/providers/oauth2/end_session.html

@@ -0,0 +1,38 @@
+{% extends 'login/base_full.html' %}
+
+{% load static %}
+{% load i18n %}
+{% load passbook_utils %}
+
+{% block title %}
+{% trans 'End session' %}
+{% endblock %}
+
+{% block card_title %}
+{% blocktrans with application=application.name %}
+You've logged out of {{ application }}.
+{% endblocktrans %}
+{% endblock %}
+
+{% block card %}
+<form method="POST" class="pf-c-form">
+    <p>
+        {% blocktrans with application=application.name %}
+            You've logged out of {{ application }}. You can go back to the overview to launch another application, or log out of your passbook account.
+        {% endblocktrans %}
+    </p>
+
+    <a id="pb-back-home" href="{% url 'passbook_core:overview' %}" class="pf-c-button pf-m-primary">{% trans 'Go back to overview' %}</a>
+
+    <a id="logout" href="{% url 'passbook_flows:default-invalidation' %}" class="pf-c-button pf-m-secondary">{% trans 'Log out of passbook' %}</a>
+
+    {% if application.get_launch_url %}
+    <a href="{{ application.get_launch_url }}" class="pf-c-button pf-m-secondary">
+        {% blocktrans with application=application.name %}
+            Log back into {{ application }}
+        {% endblocktrans %}
+    </a>
+    {% endif %}
+
+</form>
+{% endblock %}

passbook/providers/oauth2/templates/providers/oauth2/setup_url_modal.html

@@ -13,6 +13,19 @@
             </div>
             <div class="pf-c-modal-box__body" id="modal-description">
                 <form class="pf-c-form">
+                    <div class="pf-c-form__group">
+                        <label class="pf-c-form__label" for="help-text-simple-form-name">
+                            <span class="pf-c-form__label-text">{% trans 'OpenID Configuration URL' %}</span>
+                        </label>
+                        <input class="pf-c-form-control" readonly type="text" value="{{ provider_info }}" />
+                    </div>
+                    <div class="pf-c-form__group">
+                        <label class="pf-c-form__label" for="help-text-simple-form-name">
+                            <span class="pf-c-form__label-text">{% trans 'OpenID Configuration Issuer' %}</span>
+                        </label>
+                        <input class="pf-c-form-control" readonly type="text" value="{{ issuer }}" />
+                    </div>
+                    <hr>
                     <div class="pf-c-form__group">
                         <label class="pf-c-form__label" for="help-text-simple-form-name">
                             <span class="pf-c-form__label-text">{% trans 'Authorize URL' %}</span>
@@ -31,13 +44,6 @@
                         </label>
                         <input class="pf-c-form-control" readonly type="text" value="{{ userinfo }}" />
                     </div>
-                    <hr>
-                    <div class="pf-c-form__group">
-                        <label class="pf-c-form__label" for="help-text-simple-form-name">
-                            <span class="pf-c-form__label-text">{% trans 'OpenID Configuration URL' %}</span>
-                        </label>
-                        <input class="pf-c-form-control" readonly type="text" value="{{ provider_info }}" />
-                    </div>
                 </form>
             </div>
             <footer class="pf-c-modal-box__footer pf-m-align-left">

passbook/providers/oauth2/urls.py

@@ -20,12 +20,16 @@ urlpatterns = [
         csrf_exempt(protected_resource_view([SCOPE_OPENID])(UserInfoView.as_view())),
         name="userinfo",
     ),
-    path("end-session/", EndSessionView.as_view(), name="end-session",),
     path(
         "introspect/",
         csrf_exempt(TokenIntrospectionView.as_view()),
         name="token-introspection",
     ),
+    path(
+        "<slug:application_slug>/end-session/",
+        EndSessionView.as_view(),
+        name="end-session",
+    ),
     path("<slug:application_slug>/jwks/", JWKSView.as_view(), name="jwks"),
     path(
         "<slug:application_slug>/.well-known/openid-configuration",

passbook/providers/oauth2/views/authorize.py

@@ -57,7 +57,6 @@ ALLOWED_PROMPT_PARAMS = {PROMPT_NONE, PROMPT_CONSNET}
 
 
 @dataclass
-# pylint: disable=too-many-instance-attributes
 class OAuthAuthorizationParams:
     """Parameteres required to authorize an OAuth Client"""
 
@@ -164,8 +163,15 @@ class OAuthAuthorizationParams:
             raise AuthorizeError(self.redirect_uri, "invalid_request", self.grant_type)
 
         # Response type parameter validation.
-        if is_open_id and self.response_type != self.provider.response_type:
-            raise AuthorizeError(self.redirect_uri, "invalid_request", self.grant_type)
+        if is_open_id:
+            actual_response_type = self.provider.response_type
+            if "#" in self.provider.response_type:
+                hash_index = actual_response_type.index("#")
+                actual_response_type = actual_response_type[:hash_index]
+            if self.response_type != actual_response_type:
+                raise AuthorizeError(
+                    self.redirect_uri, "invalid_request", self.grant_type
+                )
 
         # PKCE validation of the transformation method.
         if self.code_challenge:

passbook/providers/oauth2/views/provider.py

@@ -32,7 +32,10 @@ class ProviderInfoView(View):
                 reverse("passbook_providers_oauth2:userinfo")
             ),
             "end_session_endpoint": self.request.build_absolute_uri(
-                reverse("passbook_providers_oauth2:end-session")
+                reverse(
+                    "passbook_providers_oauth2:end-session",
+                    kwargs={"application_slug": provider.application.slug},
+                )
             ),
             "introspection_endpoint": self.request.build_absolute_uri(
                 reverse("passbook_providers_oauth2:token-introspection")
@@ -63,7 +66,9 @@ class ProviderInfoView(View):
         provider: OAuth2Provider = get_object_or_404(
             OAuth2Provider, pk=application.provider_id
         )
-        response = JsonResponse(self.get_info(provider))
+        response = JsonResponse(
+            self.get_info(provider), json_dumps_params={"indent": 2}
+        )
         response["Access-Control-Allow-Origin"] = "*"
 
         return response

passbook/providers/oauth2/views/session.py

@@ -1,45 +1,22 @@
 """passbook OAuth2 Session Views"""
-from urllib.parse import parse_qs, urlencode, urlsplit, urlunsplit
+from typing import Any, Dict
 
-from django.contrib.auth.views import LogoutView
-from django.http import HttpRequest, HttpResponse
 from django.shortcuts import get_object_or_404
+from django.views.generic.base import TemplateView
 
 from passbook.core.models import Application
-from passbook.providers.oauth2.models import OAuth2Provider
-from passbook.providers.oauth2.utils import client_id_from_id_token
 
 
-class EndSessionView(LogoutView):
+class EndSessionView(TemplateView):
     """Allow the client to end the Session"""
 
-    def dispatch(
-        self, request: HttpRequest, application_slug: str, *args, **kwargs
-    ) -> HttpResponse:
+    template_name = "providers/oauth2/end_session.html"
 
-        application = get_object_or_404(Application, slug=application_slug)
-        provider: OAuth2Provider = get_object_or_404(
-            OAuth2Provider, pk=application.provider_id
+    def get_context_data(self, **kwargs: Any) -> Dict[str, Any]:
+        context = super().get_context_data(**kwargs)
+
+        context["application"] = get_object_or_404(
+            Application, slug=self.kwargs["application_slug"]
         )
 
-        id_token_hint = request.GET.get("id_token_hint", "")
-        post_logout_redirect_uri = request.GET.get("post_logout_redirect_uri", "")
-        state = request.GET.get("state", "")
-
-        if id_token_hint:
-            client_id = client_id_from_id_token(id_token_hint)
-            try:
-                provider = OAuth2Provider.objects.get(client_id=client_id)
-                if post_logout_redirect_uri in provider.post_logout_redirect_uris:
-                    if state:
-                        uri = urlsplit(post_logout_redirect_uri)
-                        query_params = parse_qs(uri.query)
-                        query_params["state"] = state
-                        uri = uri._replace(query=urlencode(query_params, doseq=True))
-                        self.next_page = urlunsplit(uri)
-                    else:
-                        self.next_page = post_logout_redirect_uri
-            except OAuth2Provider.DoesNotExist:
-                pass
-
-        return super().dispatch(request, *args, **kwargs)
+        return context

passbook/providers/oauth2/views/token.py

@@ -26,7 +26,6 @@ LOGGER = get_logger()
 
 
 @dataclass
-# pylint: disable=too-many-instance-attributes
 class TokenParams:
     """Token params"""
 

passbook/providers/proxy/api.py

@@ -55,6 +55,7 @@ class ProxyProviderSerializer(ModelSerializer):
             "internal_host",
             "external_host",
             "certificate",
+            "skip_path_regex",
         ]
 
 
@@ -93,6 +94,7 @@ class ProxyOutpostConfigSerializer(ModelSerializer):
             "oidc_configuration",
             "cookie_secret",
             "certificate",
+            "skip_path_regex",
         ]
 
     @swagger_serializer_method(serializer_or_field=OpenIDConnectConfigurationSerializer)

passbook/providers/proxy/forms.py

@@ -35,6 +35,7 @@ class ProxyProviderForm(forms.ModelForm):
             "internal_host",
             "external_host",
             "certificate",
+            "skip_path_regex",
         ]
         widgets = {
             "name": forms.TextInput(),

passbook/providers/proxy/migrations/0006_proxyprovider_skip_path_regex.py

@@ -0,0 +1,22 @@
+# Generated by Django 3.1.1 on 2020-09-19 09:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_providers_proxy", "0005_auto_20200914_1536"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="proxyprovider",
+            name="skip_path_regex",
+            field=models.TextField(
+                blank=True,
+                default="",
+                help_text="Regular expression for which authentication is not required. Each new line is interpreted as a new Regular Expression.",
+            ),
+        ),
+    ]

passbook/providers/proxy/models.py

@@ -49,6 +49,17 @@ class ProxyProvider(OutpostModel, OAuth2Provider):
 
     cookie_secret = models.TextField(default=get_cookie_secret)
 
+    skip_path_regex = models.TextField(
+        default="",
+        blank=True,
+        help_text=_(
+            (
+                "Regular expression for which authentication is not required. "
+                "Each new line is interpreted as a new Regular Expression."
+            )
+        ),
+    )
+
     certificate = models.ForeignKey(
         CertificateKeyPair, on_delete=models.SET_NULL, null=True, blank=True,
     )

passbook/providers/saml/models.py

@@ -107,8 +107,7 @@ class SAMLProvider(Provider):
     def launch_url(self) -> Optional[str]:
         """Guess launch_url based on acs URL"""
         launch_url = urlparse(self.acs_url)
-        launch_url.path = ""
-        return launch_url.geturl()
+        return self.acs_url.replace(launch_url.path, "")
 
     def form(self) -> Type[ModelForm]:
         from passbook.providers.saml.forms import SAMLProviderForm
@@ -130,7 +129,7 @@ class SAMLProvider(Provider):
             return None
 
     def html_metadata_view(self, request: HttpRequest) -> Optional[str]:
-        """return template and context modal with to view Metadata without downloading it"""
+        """return template and context modal to view Metadata without downloading it"""
         from passbook.providers.saml.views import DescriptorDownloadView
 
         try:
@@ -161,7 +160,8 @@ class SAMLPropertyMapping(PropertyMapping):
         return SAMLPropertyMappingForm
 
     def __str__(self):
-        return f"SAML Property Mapping {self.saml_name}"
+        name = self.friendly_name if self.friendly_name != "" else self.saml_name
+        return f"SAML Property Mapping {self.name} ({name})"
 
     class Meta:
 

passbook/root/settings.py

@@ -12,6 +12,7 @@ https://docs.djangoproject.com/en/2.1/ref/settings/
 
 import importlib
 import os
+import sys
 from json import dumps
 
 import structlog
@@ -35,7 +36,7 @@ def j_print(event: str, log_level: str = "info", **kwargs):
         "logger": __name__,
     }
     data.update(**kwargs)
-    print(dumps(data))
+    print(dumps(data), file=sys.stderr)
 
 
 LOGGER = structlog.get_logger()
@@ -179,6 +180,7 @@ MIDDLEWARE = [
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "passbook.core.middleware.ImpersonateMiddleware",
     "django_prometheus.middleware.PrometheusAfterMiddleware",
 ]
 

passbook/sources/ldap/models.py

@@ -1,6 +1,8 @@
 """passbook LDAP Models"""
+from datetime import datetime
 from typing import Optional, Type
 
+from django.core.cache import cache
 from django.db import models
 from django.forms import ModelForm
 from django.utils.translation import gettext_lazy as _
@@ -8,6 +10,7 @@ from ldap3 import Connection, Server
 
 from passbook.core.models import Group, PropertyMapping, Source
 from passbook.lib.models import DomainlessURLValidator
+from passbook.lib.utils.template import render_to_string
 
 
 class LDAPSource(Source):
@@ -59,6 +62,20 @@ class LDAPSource(Source):
 
         return LDAPSourceForm
 
+    def state_cache_prefix(self, suffix: str) -> str:
+        """Key by which the ldap source status is saved"""
+        return f"source_ldap_{self.pk}_state_{suffix}"
+
+    @property
+    def ui_additional_info(self) -> str:
+        last_sync = cache.get(self.state_cache_prefix("last_sync"), None)
+        if last_sync:
+            last_sync = datetime.fromtimestamp(last_sync)
+
+        return render_to_string(
+            "ldap/source_list_status.html", {"source": self, "last_sync": last_sync}
+        )
+
     _connection: Optional[Connection] = None
 
     @property

passbook/sources/ldap/tasks.py

@@ -1,4 +1,8 @@
 """LDAP Sync tasks"""
+from time import time
+
+from django.core.cache import cache
+
 from passbook.root.celery import CELERY_APP
 from passbook.sources.ldap.connector import Connector
 from passbook.sources.ldap.models import LDAPSource
@@ -14,8 +18,10 @@ def sync():
 @CELERY_APP.task()
 def sync_single(source_pk):
     """Sync a single source"""
-    source = LDAPSource.objects.get(pk=source_pk)
+    source: LDAPSource = LDAPSource.objects.get(pk=source_pk)
     connector = Connector(source)
     connector.sync_users()
     connector.sync_groups()
     connector.sync_membership()
+    cache_key = source.state_cache_prefix("last_sync")
+    cache.set(cache_key, time(), timeout=60 * 60)

passbook/sources/ldap/templates/ldap/source_list_status.html

@@ -0,0 +1,8 @@
+{% load humanize %}
+{% load i18n %}
+
+{% if last_sync %}
+<i class="fas fa-check pf-m-success"></i> {% blocktrans with last_sync=last_sync|naturaltime %}Synced {{ last_sync }}.{% endblocktrans %}
+{% else %}
+<i class="fas fa-times pf-m-danger"></i> Not synced yet/Sync in Progress
+{% endif %}

passbook/stages/password/api.py

@@ -15,6 +15,8 @@ class PasswordStageSerializer(ModelSerializer):
             "pk",
             "name",
             "backends",
+            "change_flow",
+            "failed_attempts_before_cancel",
         ]
 
 

passbook/stages/password/forms.py

@@ -14,10 +14,7 @@ def get_authentication_backends():
             "django.contrib.auth.backends.ModelBackend",
             _("passbook-internal Userdatabase"),
         ),
-        (
-            "passbook.sources.ldap.auth.LDAPBackend",
-            _("passbook LDAP (Only needed when User-Sync is not enabled."),
-        ),
+        ("passbook.sources.ldap.auth.LDAPBackend", _("passbook LDAP"),),
     ]
 
 
@@ -51,7 +48,7 @@ class PasswordStageForm(forms.ModelForm):
     class Meta:
 
         model = PasswordStage
-        fields = ["name", "backends", "change_flow"]
+        fields = ["name", "backends", "change_flow", "failed_attempts_before_cancel"]
         widgets = {
             "name": forms.TextInput(),
             "backends": FilteredSelectMultiple(

passbook/stages/password/migrations/0003_passwordstage_failed_attempts_before_cancel.py

@@ -0,0 +1,21 @@
+# Generated by Django 3.1.1 on 2020-09-18 23:48
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_stages_password", "0002_passwordstage_change_flow"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="passwordstage",
+            name="failed_attempts_before_cancel",
+            field=models.IntegerField(
+                default=5,
+                help_text="How many attempts a user has before the flow is canceled. To lock the user out, use a reputation policy and a user_write stage.",
+            ),
+        ),
+    ]

passbook/stages/password/models.py

@@ -22,6 +22,15 @@ class PasswordStage(Stage):
         models.TextField(),
         help_text=_("Selection of backends to test the password against."),
     )
+    failed_attempts_before_cancel = models.IntegerField(
+        default=5,
+        help_text=_(
+            (
+                "How many attempts a user has before the flow is canceled. "
+                "To lock the user out, use a reputation policy and a user_write stage."
+            )
+        ),
+    )
 
     change_flow = models.ForeignKey(
         Flow,

passbook/stages/password/stage.py

@@ -17,9 +17,11 @@ from passbook.flows.planner import PLAN_CONTEXT_PENDING_USER
 from passbook.flows.stage import StageView
 from passbook.lib.utils.reflection import path_to_class
 from passbook.stages.password.forms import PasswordForm
+from passbook.stages.password.models import PasswordStage
 
 LOGGER = get_logger()
 PLAN_CONTEXT_AUTHENTICATION_BACKEND = "user_backend"
+SESSION_INVALID_TRIES = "user_invalid_tries"
 
 
 def authenticate(
@@ -71,6 +73,20 @@ class PasswordStageView(FormView, StageView):
             kwargs["recovery_flow"] = recovery_flow.first()
         return kwargs
 
+    def form_invalid(self, form: PasswordForm) -> HttpResponse:
+        if SESSION_INVALID_TRIES not in self.request.session:
+            self.request.session[SESSION_INVALID_TRIES] = 0
+        self.request.session[SESSION_INVALID_TRIES] += 1
+        current_stage: PasswordStage = self.executor.current_stage
+        if (
+            self.request.session[SESSION_INVALID_TRIES]
+            > current_stage.failed_attempts_before_cancel
+        ):
+            LOGGER.debug("User has exceeded maximum tries")
+            del self.request.session[SESSION_INVALID_TRIES]
+            return self.executor.stage_invalid()
+        return super().form_invalid(form)
+
     def form_valid(self, form: PasswordForm) -> HttpResponse:
         """Authenticate against django's authentication backend"""
         if PLAN_CONTEXT_PENDING_USER not in self.executor.plan.context:

passbook/stages/password/tests.py

@@ -131,6 +131,37 @@ class TestPasswordStage(TestCase):
         )
         self.assertEqual(response.status_code, 200)
 
+    def test_invalid_password_lockout(self):
+        """Test with a valid pending user and invalid password (trigger logout counter)"""
+        plan = FlowPlan(
+            flow_pk=self.flow.pk.hex, stages=[self.stage], markers=[StageMarker()]
+        )
+        plan.context[PLAN_CONTEXT_PENDING_USER] = self.user
+        session = self.client.session
+        session[SESSION_KEY_PLAN] = plan
+        session.save()
+
+        for _ in range(self.stage.failed_attempts_before_cancel):
+            response = self.client.post(
+                reverse(
+                    "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
+                ),
+                # Form data
+                {"password": self.password + "test"},
+            )
+            self.assertEqual(response.status_code, 200)
+
+        response = self.client.post(
+            reverse(
+                "passbook_flows:flow-executor", kwargs={"flow_slug": self.flow.slug}
+            ),
+            # Form data
+            {"password": self.password + "test"},
+        )
+        self.assertEqual(response.status_code, 200)
+        # To ensure the plan has been cancelled, check SESSION_KEY_PLAN
+        self.assertNotIn(SESSION_KEY_PLAN, self.client.session)
+
     @patch(
         "passbook.flows.views.to_stage_response", TO_STAGE_RESPONSE_MOCK,
     )

passbook/stages/user_write/migrations/0002_auto_20200918_1653.py

@@ -0,0 +1,27 @@
+# Generated by Django 3.1.1 on 2020-09-18 16:53
+
+from django.apps.registry import Apps
+from django.db import migrations
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+
+def remove_unintended_attributes(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    User = apps.get_model("passbook_core", "User")
+    for user in User.objects.using(db_alias).all():
+        if "password_repeat" in user.attributes:
+            del user.attributes["password_repeat"]
+        if "password" in user.attributes:
+            del user.attributes["password"]
+        user.save()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("passbook_stages_user_write", "0001_initial"),
+    ]
+
+    operations = [
+        migrations.RunPython(remove_unintended_attributes),
+    ]

passbook/stages/user_write/stage.py

@@ -36,6 +36,14 @@ class UserWriteStageView(StageView):
                 "Created new user", flow_slug=self.executor.flow.slug,
             )
         user = self.executor.plan.context[PLAN_CONTEXT_PENDING_USER]
+        # Before we change anything, check if the user is the same as in the request
+        # and we're updating a password. In that case we need to update the session hash
+        should_update_seesion = False
+        if (
+            any(["password" in x for x in data.keys()])
+            and self.request.user.pk == user.pk
+        ):
+            should_update_seesion = True
         for key, value in data.items():
             setter_name = f"set_{key}"
             # Check if user has a setter for this key, like set_password
@@ -46,13 +54,17 @@ class UserWriteStageView(StageView):
             # User has this key already
             elif hasattr(user, key):
                 setattr(user, key, value)
-            # Otherwise we just save it as custom attribute
+            # Otherwise we just save it as custom attribute, but only if the value is prefixed with
+            # `attribute_`, to prevent accidentally saving values
             else:
-                user.attributes[key] = value
+                if not key.startswith("attribute_"):
+                    LOGGER.debug("discarding key", key=key)
+                    continue
+                user.attributes[key.replace("attribute_", "", 1)] = value
         user.save()
         user_write.send(sender=self, request=request, user=user, data=data)
         # Check if the password has been updated, and update the session auth hash
-        if any(["password" in x for x in data.keys()]):
+        if should_update_seesion:
             update_session_auth_hash(self.request, user)
             LOGGER.debug("Updated session hash", user=user)
         LOGGER.debug(

passbook/stages/user_write/tests.py

@@ -86,7 +86,7 @@ class TestUserWriteStage(TestCase):
         plan.context[PLAN_CONTEXT_PROMPT] = {
             "username": "test-user-new",
             "password": new_password,
-            "some-custom-attribute": "test",
+            "attribute_some-custom-attribute": "test",
         }
         session = self.client.session
         session[SESSION_KEY_PLAN] = plan

passbook/static/static/package.json

@@ -2,7 +2,7 @@
   "license": "MIT",
   "dependencies": {
     "@fortawesome/fontawesome-free": "^5.14.0",
-    "@patternfly/patternfly": "^4.35.2",
+    "@patternfly/patternfly": "^4.42.2",
     "codemirror": "^5.57.0"
   }
 }

passbook/static/static/yarn.lock

@@ -7,10 +7,10 @@
   resolved "https://registry.yarnpkg.com/@fortawesome/fontawesome-free/-/fontawesome-free-5.14.0.tgz#a371e91029ebf265015e64f81bfbf7d228c9681f"
   integrity sha512-OfdMsF+ZQgdKHP9jUbmDcRrP0eX90XXrsXIdyjLbkmSBzmMXPABB8eobUJtivaupucYaByz6WNe1PI1JuYm3qA==
 
-"@patternfly/patternfly@^4.35.2":
-  version "4.35.2"
-  resolved "https://registry.yarnpkg.com/@patternfly/patternfly/-/patternfly-4.35.2.tgz#a8d7cf49b5da714e175efd0faabef295697da8d0"
-  integrity sha512-gOebIesqY28/ngVz0k/k0szca247002x+x+GBfCNgbnOXoiEfqYViI5C7YuHB8iNVuvf/YwBdfj65k/h6FMB3w==
+"@patternfly/patternfly@^4.42.2":
+  version "4.42.2"
+  resolved "https://registry.yarnpkg.com/@patternfly/patternfly/-/patternfly-4.42.2.tgz#236d87bd85f00cb7a16d0c2956638ecedc3fa6ef"
+  integrity sha512-VLDhNko4D09sKcnzWEzMr8T8z9btqAYpuK0ntWMsAwi+/C9XsKyaxPioxuEsm7PeuW6OU0neEzSDYMSUnwrMBQ==
 
 codemirror@^5.57.0:
   version "5.57.0"

proxy/Dockerfile

@@ -7,6 +7,10 @@ COPY . .
 RUN go build -o /work/proxy .
 
 # Copy binary to alpine
-FROM gcr.io/distroless/base-debian10
+FROM gcr.io/distroless/base-debian10:debug
+
 COPY --from=builder /work/proxy /
+
+HEALTHCHECK CMD [ "wget", "spider", "http://localhost:4180/pbprox/ping" ]
+
 ENTRYPOINT ["/proxy"]

proxy/cmd/server.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"fmt"
 	"math/rand"
 	"net/url"
 	"os"
@@ -10,20 +11,33 @@ import (
 	"github.com/BeryJu/passbook/proxy/pkg/server"
 )
 
+const helpMessage = `passbook proxy
+
+Required environment variables:
+ - PASSBOOK_HOST: URL to connect to (format "http://passbook.company")
+ - PASSBOOK_TOKEN: Token to authenticate with
+ - PASSBOOK_INSECURE: Skip SSL Certificate verification`
+
 // RunServer main entrypoint, runs the full server
 func RunServer() {
 	pbURL, found := os.LookupEnv("PASSBOOK_HOST")
 	if !found {
-		panic("env PASSBOOK_HOST not set!")
+		fmt.Println("env PASSBOOK_HOST not set!")
+		fmt.Println(helpMessage)
+		os.Exit(1)
 	}
 	pbToken, found := os.LookupEnv("PASSBOOK_TOKEN")
 	if !found {
-		panic("env PASSBOOK_TOKEN not set!")
+		fmt.Println("env PASSBOOK_TOKEN not set!")
+		fmt.Println(helpMessage)
+		os.Exit(1)
 	}
 
 	pbURLActual, err := url.Parse(pbURL)
 	if err != nil {
-		panic(err)
+		fmt.Println(err)
+		fmt.Println(helpMessage)
+		os.Exit(1)
 	}
 
 	rand.Seed(time.Now().UnixNano())

proxy/go.mod

@@ -29,12 +29,16 @@ require (
 	github.com/recws-org/recws v1.2.1
 	github.com/sirupsen/logrus v1.6.0
 	github.com/spf13/afero v1.4.0 // indirect
+	github.com/spf13/cast v1.3.1 // indirect
+	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/spf13/viper v1.7.1 // indirect
 	github.com/stretchr/testify v1.6.1
 	go.mongodb.org/mongo-driver v1.4.1 // indirect
 	golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de // indirect
 	golang.org/x/net v0.0.0-20200904194848-62affa334b73 // indirect
-	golang.org/x/sys v0.0.0-20200917061948-648f2a039071 // indirect
-	golang.org/x/tools v0.0.0-20200917050209-655488c8ae71 // indirect
+	golang.org/x/sys v0.0.0-20200918174421-af09f7315aff // indirect
+	golang.org/x/tools v0.0.0-20200918232735-d647fc253266 // indirect
 	gopkg.in/ini.v1 v1.61.0 // indirect
+	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
 )

proxy/go.sum

@@ -830,8 +830,8 @@ golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200917061948-648f2a039071 h1:t0H7WMwCt9t0LnLSYz5zdZ/OiAtROxc5cHb5iHt3Xyw=
-golang.org/x/sys v0.0.0-20200917061948-648f2a039071/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200918174421-af09f7315aff h1:1CPUrky56AcgSpxz/KfgzQWzfG09u5YOL8MvPYBlrL8=
+golang.org/x/sys v0.0.0-20200918174421-af09f7315aff/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -898,8 +898,8 @@ golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200817023811-d00afeaade8f h1:33yHANSyO/TeglgY9rBhUpX43wtonTXoFOsMRtNB6qE=
 golang.org/x/tools v0.0.0-20200817023811-d00afeaade8f/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200917050209-655488c8ae71 h1:HfjhL52L9Q15ZudgTl0s5+wcqOKViwBgZJQLxgKn20E=
-golang.org/x/tools v0.0.0-20200917050209-655488c8ae71/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
+golang.org/x/tools v0.0.0-20200918232735-d647fc253266 h1:k7tVuG0g1JwmD3Jh8oAl1vQ1C3jb4Hi/dUl1wWDBJpQ=
+golang.org/x/tools v0.0.0-20200918232735-d647fc253266/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7 h1:9zdDQZ7Thm29KFXgAX/+yaf3eVbP7djjWp/dXAppNCc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

proxy/pkg/server/api.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/BeryJu/passbook/proxy/pkg/client"
@@ -37,7 +38,7 @@ type APIController struct {
 	lastBundleHash string
 	logger         *log.Entry
 
-	wsConn recws.RecConn
+	wsConn *recws.RecConn
 }
 
 func getCommonOptions() *options.Options {
@@ -85,9 +86,12 @@ func doGlobalSetup(config map[string]interface{}) {
 }
 
 func getTLSTransport() http.RoundTripper {
-	_, set := os.LookupEnv("PASSBOOK_INSECURE")
+	value, set := os.LookupEnv("PASSBOOK_INSECURE")
+	if !set {
+		value = "false"
+	}
 	tlsTransport, err := httptransport.TLSTransport(httptransport.TLSClientOptions{
-		InsecureSkipVerify: set,
+		InsecureSkipVerify: strings.ToLower(value) == "true",
 	})
 	if err != nil {
 		panic(err)

proxy/pkg/server/api_bundle.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"strings"
 
 	"github.com/BeryJu/passbook/proxy/pkg/client/crypto"
 	"github.com/BeryJu/passbook/proxy/pkg/models"
@@ -50,6 +51,9 @@ func (pb *providerBundle) prepareOpts(provider *models.ProxyOutpostConfig) *opti
 	providerOpts.OIDCJwksURL = *provider.OidcConfiguration.JwksURI
 	providerOpts.ProfileURL = *provider.OidcConfiguration.UserinfoEndpoint
 
+	skipRegexes := strings.Split(provider.SkipPathRegex, "\n")
+	providerOpts.SkipAuthRegex = skipRegexes
+
 	providerOpts.UpstreamServers = []options.Upstream{
 		{
 			ID:   "default",

proxy/pkg/server/api_ws.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/BeryJu/passbook/proxy/pkg"
 	"github.com/go-openapi/strfmt"
 	"github.com/gorilla/websocket"
 	"github.com/recws-org/recws"
@@ -22,20 +23,33 @@ func (ac *APIController) initWS(pbURL url.URL, outpostUUID strfmt.UUID) {
 		"Authorization": []string{ac.token},
 	}
 
-	_, set := os.LookupEnv("PASSBOOK_INSECURE")
+	value, set := os.LookupEnv("PASSBOOK_INSECURE")
+	if !set {
+		value = "false"
+	}
 
-	ws := recws.RecConn{
-		// KeepAliveTimeout: 10 * time.Second,
+	ws := &recws.RecConn{
 		NonVerbose: true,
 		TLSClientConfig: &tls.Config{
-			InsecureSkipVerify: set,
+			InsecureSkipVerify: strings.ToLower(value) == "true",
 		},
 	}
 	ws.Dial(fmt.Sprintf(pathTemplate, scheme, pbURL.Host, outpostUUID.String()), header)
 
-	ac.logger.WithField("outpost", outpostUUID.String()).Debug("connecting to passbook")
+	ac.logger.WithField("component", "ws").WithField("outpost", outpostUUID.String()).Debug("connecting to passbook")
 
 	ac.wsConn = ws
+	// Send hello message with our version
+	msg := websocketMessage{
+		Instruction: WebsocketInstructionHello,
+		Args: map[string]interface{}{
+			"version": pkg.VERSION,
+		},
+	}
+	err := ws.WriteJSON(msg)
+	if err != nil {
+		ac.logger.WithField("component", "ws").WithError(err).Warning("Failed to hello to passbook")
+	}
 }
 
 // Shutdown Gracefully stops all workers, disconnects from websocket
@@ -52,11 +66,15 @@ func (ac *APIController) Shutdown() {
 
 func (ac *APIController) startWSHandler() {
 	for {
+		if !ac.wsConn.IsConnected() {
+			continue
+		}
 		var wsMsg websocketMessage
 		err := ac.wsConn.ReadJSON(&wsMsg)
 		if err != nil {
-			ac.logger.Println("read:", err)
-			return
+			ac.logger.WithField("loop", "ws-handler").Println("read:", err)
+			ac.wsConn.CloseAndReconnect()
+			continue
 		}
 		if wsMsg.Instruction != WebsocketInstructionAck {
 			ac.logger.Debugf("%+v\n", wsMsg)
@@ -64,7 +82,7 @@ func (ac *APIController) startWSHandler() {
 		if wsMsg.Instruction == WebsocketInstructionTriggerUpdate {
 			err := ac.UpdateIfRequired()
 			if err != nil {
-				ac.logger.WithError(err).Debug("Failed to update")
+				ac.logger.WithField("loop", "ws-handler").WithError(err).Debug("Failed to update")
 			}
 		}
 	}
@@ -72,14 +90,21 @@ func (ac *APIController) startWSHandler() {
 
 func (ac *APIController) startWSHealth() {
 	for ; true; <-time.Tick(time.Second * 10) {
+		if !ac.wsConn.IsConnected() {
+			continue
+		}
 		aliveMsg := websocketMessage{
 			Instruction: WebsocketInstructionHello,
-			Args:        make(map[string]interface{}),
+			Args: map[string]interface{}{
+				"version": pkg.VERSION,
+			},
 		}
 		err := ac.wsConn.WriteJSON(aliveMsg)
+		ac.logger.WithField("loop", "ws-health").Debug("hello'd")
 		if err != nil {
-			ac.logger.Println("write:", err)
-			return
+			ac.logger.WithField("loop", "ws-health").Println("write:", err)
+			ac.wsConn.CloseAndReconnect()
+			continue
 		}
 	}
 }

proxy/pkg/server/server.go

@@ -82,6 +82,10 @@ func (s *Server) ServeHTTPS() {
 }
 
 func (s *Server) handler(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path == "/pbprox/ping" {
+		w.WriteHeader(204)
+		return
+	}
 	handler, ok := s.Handlers[r.Host]
 	if !ok {
 		// If we only have one handler, host name switching doesn't matter

proxy/pkg/version.go

@@ -0,0 +1,3 @@
+package pkg
+
+const VERSION = "0.10.4-stable"

swagger.yaml

@@ -5846,6 +5846,8 @@ definitions:
           - PASSWORD_RESET
           - INVITE_CREATED
           - INVITE_USED
+          - IMPERSONATION_STARTED
+          - IMPERSONATION_ENDED
           - CUSTOM
       date:
         title: Date
@@ -6230,6 +6232,11 @@ definitions:
         type: string
         format: uuid
         x-nullable: true
+      skip_path_regex:
+        title: Skip path regex
+        description: Regular expression for which authentication is not required.
+          Each new line is interpreted as a new Regular Expression.
+        type: string
   Policy:
     type: object
     properties:
@@ -6626,7 +6633,7 @@ definitions:
         type: string
         enum:
           - code
-          - code_adfs
+          - code#adfs
           - id_token
           - id_token token
           - code token
@@ -6651,10 +6658,6 @@ definitions:
         description: Enter each URI on a new line.
         type: string
         minLength: 1
-      post_logout_redirect_uris:
-        title: Post Logout Redirect URIs
-        description: Enter each URI on a new line.
-        type: string
       sub_mode:
         title: Sub mode
         description: Configure what data should be used as unique User Identifier.
@@ -6699,6 +6702,11 @@ definitions:
         type: string
         format: uuid
         x-nullable: true
+      skip_path_regex:
+        title: Skip path regex
+        description: Regular expression for which authentication is not required.
+          Each new line is interpreted as a new Regular Expression.
+        type: string
   SAMLProvider:
     required:
       - name
@@ -7430,6 +7438,20 @@ definitions:
           title: Backends
           type: string
           minLength: 1
+      change_flow:
+        title: Change flow
+        description: Flow used by an authenticated user to change their password.
+          If empty, user will be unable to change their password.
+        type: string
+        format: uuid
+        x-nullable: true
+      failed_attempts_before_cancel:
+        title: Failed attempts before cancel
+        description: How many attempts a user has before the flow is canceled. To
+          lock the user out, use a reputation policy and a user_write stage.
+        type: integer
+        maximum: 2147483647
+        minimum: -2147483648
   Prompt:
     required:
       - field_key