Merge branch 'master' into conformance_tests_improvements

2026-05-22 18:43:53 -07:00 · 2019-12-20 09:56:59 +01:00
parent 42d61191c4 ac242a8bc7
commit f98332595e
241 changed files with 46456 additions and 10473 deletions
@@ -0,0 +1,2 @@
+[*.yml]
+indent_size = 2
@@ -0,0 +1,79 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-16.04
+    env:
+      GOFLAGS: -mod=readonly
+
+    services:
+      postgres:
+        image: postgres:10.8
+        ports:
+          - 5432
+        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
+
+      etcd:
+        image: gcr.io/etcd-development/etcd:v3.2.9
+        ports:
+          - 2379
+        env:
+          ETCD_LISTEN_CLIENT_URLS: http://0.0.0.0:2379
+          ETCD_ADVERTISE_CLIENT_URLS: http://0.0.0.0:2379
+        options: --health-cmd "ETCDCTL_API=3 etcdctl --endpoints http://localhost:2379 endpoint health" --health-interval 10s --health-timeout 5s --health-retries 5
+
+      keystone:
+        image: openio/openstack-keystone:pike
+        ports:
+          - 5000
+          - 35357
+        options: --health-cmd "curl --fail http://localhost:5000/v3" --health-interval 10s --health-timeout 5s --health-retries 5
+
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@v1
+        with:
+          go-version: 1.13
+
+      - name: Checkout code
+        uses: actions/checkout@v1
+
+      - name: Setup MySQL database
+        run: mysql -u root -proot -e 'CREATE DATABASE dex;'
+
+      - name: Run tests
+        run: make testall
+        env:
+          DEX_MYSQL_DATABASE: dex
+          DEX_MYSQL_USER: root
+          DEX_MYSQL_PASSWORD: root
+          DEX_MYSQL_HOST: 127.0.0.1
+          DEX_MYSQL_PORT: 3306
+          DEX_POSTGRES_DATABASE: postgres
+          DEX_POSTGRES_USER: postgres
+          DEX_POSTGRES_PASSWORD: postgres
+          DEX_POSTGRES_HOST: localhost
+          DEX_POSTGRES_PORT: ${{ job.services.postgres.ports[5432] }}
+          DEX_ETCD_ENDPOINTS: http://localhost:${{ job.services.etcd.ports[2379] }}
+          DEX_LDAP_TESTS: 1
+          DEX_KEYSTONE_URL: http://localhost:${{ job.services.keystone.ports[5000] }}
+          DEX_KEYSTONE_ADMIN_URL: http://localhost:${{ job.services.keystone.ports[35357] }}
+          DEX_KEYSTONE_ADMIN_USER: demo
+          DEX_KEYSTONE_ADMIN_PASS: DEMO_PASS
+
+      - name: Run Kubernetes tests
+        run: ./scripts/test-k8s.sh
+
+      - name: Run linter
+        run: make lint
+
+      # Ensure proto generation doesn't depend on external packages.
+      - name: Verify proto
+        run: make verify-proto
@@ -1,3 +1,4 @@
 bin
 dist
 _output
+.idea
@@ -0,0 +1,35 @@
+run:
+    skip-dirs:
+        - vendor
+
+linters-settings:
+    golint:
+        min-confidence: 0.1
+    goimports:
+        local-prefixes: github.com/dexidp/dex
+
+linters:
+    enable-all: true
+    disable:
+        - funlen
+        - maligned
+        - wsl
+
+        # TODO: fix me
+        - unparam
+        - golint
+        - goconst
+        - staticcheck
+        - nakedret
+        - errcheck
+        - gosec
+        - gochecknoinits
+        - gochecknoglobals
+        - prealloc
+        - scopelint
+        - lll
+        - dupl
+        - gocritic
+        - gocyclo
+        - gocognit
+        - godox
@@ -6,7 +6,7 @@ dist: xenial

 matrix:
  include:
-    - go: '1.12.x'
+    - go: '1.13.x'

 env:
  global:
@@ -1,11 +1,11 @@
-FROM golang:1.12.9-alpine
+FROM golang:1.13-alpine

 RUN apk add --no-cache --update alpine-sdk

 COPY . /go/src/github.com/dexidp/dex
 RUN cd /go/src/github.com/dexidp/dex && make release-binary

-FROM alpine:3.9
+FROM alpine:3.10
 # Dex connectors, such as GitHub and Google logins require root certificates.
 # Proper installations should manage those certificates, but it's a bad user
 # experience when this doesn't work out of the box.
@@ -0,0 +1,60 @@
+# Authentication through Google
+
+## Overview
+
+Dex is able to use Google's OpenID Connect provider as an authentication source.
+
+The connector uses the same authentication flow as the OpenID Connect provider but adds Google specific features such as Hosted domain support and reading groups using a service account.
+
+## Configuration
+
+```yaml
+connectors:
+- type: google
+  id: google
+  name: Google
+  config:
+
+    # Connector config values starting with a "$" will read from the environment.
+    clientID: $GOOGLE_CLIENT_ID
+    clientSecret: $GOOGLE_CLIENT_SECRET
+
+    # Dex's issuer URL + "/callback"
+    redirectURI: http://127.0.0.1:5556/callback
+
+    # Google supports whitelisting allowed domains when using G Suite
+    # (Google Apps). The following field can be set to a list of domains
+    # that can log in:
+    #
+    # hostedDomains:
+    #  - example.com
+
+    # The Google connector supports whitelisting allowed groups when using G Suite
+    # (Google Apps). The following field can be set to a list of groups
+    # that can log in:
+    #
+    # groups:
+    #  - admins@example.com
+
+    # Google does not support the OpenID Connect groups claim and only supports
+    # fetching a user's group membership with a service account.
+    # This service account requires an authentication JSON file and the email
+    # of a G Suite admin to impersonate:
+    #
+    #serviceAccountFilePath: googleAuth.json
+    #adminEmail: super-user@example.com
+```
+
+## Fetching groups from Google
+To allow Dex to fetch group information from Google, you will need to configure a service account for Dex to use.
+This account needs Domain-Wide Delegation and permission to access the `https://www.googleapis.com/auth/admin.directory.group.readonly` API scope.
+
+To get group fetching set up:
+
+1. Follow the [instructions](https://developers.google.com/admin-sdk/directory/v1/guides/delegation) to set up a service account with Domain-Wide Delegation
+  - During service account creation, a JSON key file will be created that contains authentication information for the service account. This needs storing in a location accessible by Dex and you will set the `serviceAccountFilePath` to point at it.
+  - When delegating the API scopes to the service account, delegate the `https://www.googleapis.com/auth/admin.directory.group.readonly` scope and only this scope. If you delegate more scopes to the service account, it will not be able to access the API.
+2. Enable the [Admin SDK](https://console.developers.google.com/apis/library/admin.googleapis.com/)
+3. Add the `serviceAccountFilePath` and `adminEmail` configuration options to your Dex config.
+  - `serviceAccountFilePath` should point to the location of the service account JSON key file
+  - `adminEmail` should be the email of a G Suite super user. The service account you created earlier will impersonate this user when making calls to the admin API. A valid user should be able to retrieve a list of groups when [testing the API](https://developers.google.com/admin-sdk/directory/v1/reference/groups/list#try-it).
@@ -13,7 +13,7 @@ The connector executes two primary queries:

 The dex repo contains a basic LDAP setup using [OpenLDAP][openldap].

-First start the LDAP server using the example script. This will run the OpenLDAP daemon and seed it with a initial set of users.
+First start the LDAP server using the example script. This will run the OpenLDAP daemon and seed it with an initial set of users.

 ```
 ./scripts/slapd.sh
@@ -89,7 +89,7 @@ connectors:
    # server provides access for anonymous auth.
    # Please note that if the bind password contains a `$`, it has to be saved in an
    # environment variable which should be given as the value to `bindPW`.
-    bindDN: uid=seviceaccount,cn=users,dc=example,dc=com
+    bindDN: uid=serviceaccount,cn=users,dc=example,dc=com
    bindPW: password

    # The attribute to display in the provided password prompt. If unset, will
@@ -10,7 +10,7 @@ Prominent examples of OpenID Connect providers include Google Accounts, Salesfor

 This connector does not support the "groups" claim. Progress for this is tracked in [issue #1065][issue-1065].

-When using refresh tokens, changes to the upstream claims aren't propegated to the id_token returned by dex. If a user's email changes, the "email" claim returned by dex won't change unless the user logs in again. Progress for this is tracked in [issue #863][issue-863].
+When using refresh tokens, changes to the upstream claims aren't propagated to the id_token returned by dex. If a user's email changes, the "email" claim returned by dex won't change unless the user logs in again. Progress for this is tracked in [issue #863][issue-863].

 ## Configuration

@@ -36,7 +36,7 @@ connectors:

    # Some providers require passing client_secret via POST parameters instead
    # of basic auth, despite the OAuth2 RFC discouraging it. Many of these
-    # cases are caught internally, but some may need to uncommented the
+    # cases are caught internally, but some may need to uncomment the
    # following field.
    #
    # basicAuthUnsupported: true
@@ -56,11 +56,18 @@ connectors:
    #  - email
    #  - groups

-    # Some providers return claims without "email_verified", when they had no usage of emails verification in enrollement process
+    # Some providers return claims without "email_verified", when they had no usage of emails verification in enrollment process
    # or if they are acting as a proxy for another IDP etc AWS Cognito with an upstream SAML IDP
    # This can be overridden with the below option
    # insecureSkipEmailVerified: true 

+    # Groups claims (like the rest of oidc claims through dex) only refresh when the id token is refreshed
+    # meaning the regular refresh flow doesn't update the groups claim. As such by default the oidc connector
+    # doesn't allow groups claims. If you are okay with having potentially stale group claims you can use
+    # this option to enable groups claims through the oidc connector on a per-connector basis.
+    # This can be overridden with the below option
+    # insecureEnableGroups: true
+
    # When enabled, the OpenID Connector will query the UserInfo endpoint for additional claims. UserInfo claims
    # take priority over claims returned by the IDToken. This option should be used when the IDToken doesn't contain
    # all the claims requested.
@@ -14,6 +14,10 @@ __The connector doesn't support refresh tokens__ since the SAML 2.0 protocol doe

 The connector doesn't support signed AuthnRequests or encrypted attributes.

+## Group Filtering
+
+The SAML Connector supports providing a whitelist of SAML Groups to filter access based on, and when the `groupsattr` is set with a scope including groups, Dex will check for membership based on configured groups in the `allowedGroups` config setting for the SAML connector.
+
 ## Configuration

 ```yaml
@@ -44,6 +48,10 @@ connectors:
    emailAttr: email
    groupsAttr: groups # optional

+    # List of groups to filter access based on membership
+    # allowedGroups
+    #   - Admins
+
    # CA's can also be provided inline as a base64'd blob.
    #
    # caData: ( RAW base64'd PEM encoded CA )
@@ -156,6 +156,9 @@ Once the example app is running, choose the GitHub option and grant access to de

 The default redirect uri is http://127.0.0.1:5555/callback and can be changed with the `--redirect-uri` flag and should correspond with your configmap.

+Please note the redirect uri is different from the one you filled when creating `GitHub OAuth2 client credentials`. 
+When you login, GitHub first redirects to dex (https://dex.example.com:32000/callback), then dex redirects to the redirect uri of exampl-app.
+
 The printed ID Token can then be used as a bearer token to authenticate against the API server.

 ```
@@ -92,7 +92,7 @@ OpenID Connect servers have a discovery mechanism for OAuth2 endpoints, scopes
 supported, and indications of various other OpenID Connect features.

 ```
-$ curl http://127.0.0.1:5556/.well-known/openid-configuration
+$ curl http://127.0.0.1:5556/dex/.well-known/openid-configuration
 {
  "issuer": "http://127.0.0.1:5556",
  "authorization_endpoint": "http://127.0.0.1:5556/auth",
@@ -123,7 +123,7 @@ https://tools.ietf.org/html/rfc7517) Set of public keys that will look
 something like this:

 ```
-$ curl http://127.0.0.1:5556/keys
+$ curl http://127.0.0.1:5556/dex/keys
 {
  "keys": [
    {
@@ -11,7 +11,7 @@ in with GitHub.

 ## The problem

-When dex is federaing to an upstream identity provider (IDP), we want to ensure
+When dex is federating to an upstream identity provider (IDP), we want to ensure
 claims being passed onto clients remain fresh. This includes data such as Google
 accounts display names, LDAP group membership, account deactivations. Changes to
 these on an upstream IDP should always be reflected in the claims dex passes to
@@ -14,11 +14,13 @@ Steps:
   ```yaml
   frontend:
     dir: /path/to/custom/web
+     issuer: my-dex
     extra:
       tos_footer_link: "https://example.com/terms"
       client_logo_url: "../theme/client-logo.png"
       foo: "bar"
   ```
 5. Set the `frontend.dir` value to your own `web` directory.
+6. Write the issuer in the `issuer` directory in order to modify the Dex title and the `Log in to <<dex>>` tag.

 To test your templates simply run Dex with a valid configuration and go through a login flow.
@@ -1,4 +1,5 @@
 Rithu John <rithujohn191@gmail.com> (@rithujohn191)
 Stephan Renatus <srenatus@chef.io> (@srenatus)
 Joel Speed <Joel.speed@hotmail.co.uk> (@JoelSpeed)
-Nandor Kracser <bonifaido@gmail.com> (@bonifaido)
+Nandor Kracser <nandor@banzaicloud.com> (@bonifaido)
+Mark Sagi-Kazar <mark@banzaicloud.com> (@sagikazarmark)
@@ -2,7 +2,6 @@ PROJ=dex
 ORG_PATH=github.com/dexidp
 REPO_PATH=$(ORG_PATH)/$(PROJ)
 export PATH := $(PWD)/bin:$(PATH)
-THIS_DIRECTORY:=$(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))

 VERSION ?= $(shell ./scripts/git-version)

@@ -18,6 +17,9 @@ export GOBIN=$(PWD)/bin

 LD_FLAGS="-w -X $(REPO_PATH)/version.Version=$(VERSION)"

+# Dependency versions
+GOLANGCI_VERSION = 1.21.0
+
 build: bin/dex bin/example-app bin/grpc-client

 bin/dex:
@@ -45,14 +47,19 @@ test:
 testrace:
 	@go test -v --race ./...

-vet:
-	@go vet ./...
+bin/golangci-lint: bin/golangci-lint-${GOLANGCI_VERSION}
+	@ln -sf golangci-lint-${GOLANGCI_VERSION} bin/golangci-lint
+bin/golangci-lint-${GOLANGCI_VERSION}:
+	curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | BINARY=golangci-lint bash -s -- v${GOLANGCI_VERSION}
+	@mv bin/golangci-lint $@

-fmt:
-	@./scripts/gofmt ./...
+.PHONY: lint
+lint: bin/golangci-lint ## Run linter
+	bin/golangci-lint run

-lint: bin/golint
-	@./bin/golint -set_exit_status $(shell go list ./...)
+.PHONY: fix
+fix: bin/golangci-lint ## Fix lint violations
+	bin/golangci-lint run --fix

 .PHONY: docker-image
 docker-image:
@@ -73,14 +80,11 @@ bin/protoc: scripts/get-protoc
 bin/protoc-gen-go:
 	@go install -v $(REPO_PATH)/vendor/github.com/golang/protobuf/protoc-gen-go

-bin/golint:
-	@go install -v $(THIS_DIRECTORY)/vendor/golang.org/x/lint/golint
-
 clean:
 	@rm -rf bin/

-testall: testrace vet fmt lint
+testall: testrace

 FORCE:

-.PHONY: test testrace vet fmt lint testall
+.PHONY: test testrace testall
@@ -63,17 +63,17 @@ Depending on the connectors limitations in protocols can prevent dex from issuin

 Dex implements the following connectors:

-| Name | supports refresh tokens | supports groups claim | status | notes |
-| ---- | ----------------------- | --------------------- | ------ | ----- |
-| [LDAP](Documentation/connectors/ldap.md) | yes | yes | stable | |
-| [GitHub](Documentation/connectors/github.md) | yes | yes | stable | |
-| [SAML 2.0](Documentation/connectors/saml.md) | no | yes | stable |
-| [GitLab](Documentation/connectors/gitlab.md) | yes | yes | beta | |
-| [OpenID Connect](Documentation/connectors/oidc.md) | yes | no ([#1065][issue-1065]) | beta | Includes Google, Salesforce, Azure, etc. |
-| [LinkedIn](Documentation/connectors/linkedin.md) | yes | no | beta | |
-| [Microsoft](Documentation/connectors/microsoft.md) | yes | yes | beta | |
-| [AuthProxy](Documentation/connectors/authproxy.md) | no | no | alpha | Authentication proxies such as Apache2 mod_auth, etc. |
-| [Bitbucket Cloud](Documentation/connectors/bitbucketcloud.md) | yes | yes | alpha | |
+| Name | supports refresh tokens | supports groups claim | supports preferred_username claim | status | notes |
+| ---- | ----------------------- | --------------------- | --------------------------------- | ------ | ----- |
+| [LDAP](Documentation/connectors/ldap.md) | yes | yes | yes | stable | |
+| [GitHub](Documentation/connectors/github.md) | yes | yes | yes | stable | |
+| [SAML 2.0](Documentation/connectors/saml.md) | no | yes | no | stable |
+| [GitLab](Documentation/connectors/gitlab.md) | yes | yes | yes | beta | |
+| [OpenID Connect](Documentation/connectors/oidc.md) | yes | no ([#1065][issue-1065]) | no | beta | Includes Google, Salesforce, Azure, etc. |
+| [LinkedIn](Documentation/connectors/linkedin.md) | yes | no | no | beta | |
+| [Microsoft](Documentation/connectors/microsoft.md) | yes | yes | no | beta | |
+| [AuthProxy](Documentation/connectors/authproxy.md) | no | no | no | alpha | Authentication proxies such as Apache2 mod_auth, etc. |
+| [Bitbucket Cloud](Documentation/connectors/bitbucketcloud.md) | yes | yes | no | alpha | |

 Stable, beta, and alpha are defined as:

@@ -1,7 +1,6 @@
 package main

 import (
-	"github.com/dexidp/dex/server"
 	"testing"

 	"github.com/ghodss/yaml"
@@ -9,6 +8,7 @@ import (

 	"github.com/dexidp/dex/connector/mock"
 	"github.com/dexidp/dex/connector/oidc"
+	"github.com/dexidp/dex/server"
 	"github.com/dexidp/dex/storage"
 	"github.com/dexidp/dex/storage/sql"
 )
@@ -211,5 +211,4 @@ logger:
 	if diff := pretty.Compare(c, want); diff != "" {
 		t.Errorf("got!=want: %s", diff)
 	}
-
 }
@@ -182,7 +182,6 @@ func serve(cmd *cobra.Command, args []string) error {
 			return fmt.Errorf("failed to initialize storage connectors: %v", err)
 		}
 		storageConnectors[i] = conn
-
 	}

 	if c.EnablePasswordDB {
@@ -143,7 +143,7 @@ func cmd() *cobra.Command {
 			ctx := oidc.ClientContext(context.Background(), a.client)
 			provider, err := oidc.NewProvider(ctx, issuerURL)
 			if err != nil {
-				return fmt.Errorf("Failed to query provider %q: %v", issuerURL, err)
+				return fmt.Errorf("failed to query provider %q: %v", issuerURL, err)
 			}

 			var s struct {
@@ -153,7 +153,7 @@ func cmd() *cobra.Command {
 				ScopesSupported []string `json:"scopes_supported"`
 			}
 			if err := provider.Claims(&s); err != nil {
-				return fmt.Errorf("Failed to parse provider scopes_supported: %v", err)
+				return fmt.Errorf("failed to parse provider scopes_supported: %v", err)
 			}

 			if len(s.ScopesSupported) == 0 {
--- a/Show More
+++ b/Show More