Evan Cordell
9df650688b
Install jwtproxy in /usr/local/bin
2016-04-29 14:10:33 -04:00
Evan Cordell
97ad9684d7
Use jwtproxy binary from github
2016-04-29 14:10:33 -04:00
Evan Cordell
d2aa4be29e
Explicitly set jwtproxy audience
2016-04-29 14:10:33 -04:00
Evan Cordell
0c2ecec9a9
Don't check for client certs when talking to clair
2016-04-29 14:10:33 -04:00
Evan Cordell
4d0627f83d
Turn down logging on jwtproxy
2016-04-29 14:10:33 -04:00
Evan Cordell
47a52a47eb
Remove unneeded service key expiration
2016-04-29 14:10:33 -04:00
Evan Cordell
9ffc32f680
Generate preshared key on boot
2016-04-29 14:10:33 -04:00
Evan Cordell
f30a9e56f3
Be really sure about proxy protocol
2016-04-29 14:10:33 -04:00
Evan Cordell
cf5f7aa476
Create JWK formatted key on startup
2016-04-29 14:10:33 -04:00
Evan Cordell
8595140f38
Use signer proxy for all http(s) requests
2016-04-29 14:10:33 -04:00
Evan Cordell
f4d2fae5d8
Separate jwtproxy signer config from secscan config
2016-04-29 14:10:33 -04:00
Evan Cordell
474884acd7
Don't require certs for clair anymore
2016-04-29 14:10:33 -04:00
Evan Cordell
822b253b85
Add message when no approval user exists
2016-04-29 14:10:33 -04:00
Evan Cordell
e499c4a8ef
Actually go through signer proxy
2016-04-29 14:10:33 -04:00
Evan Cordell
52590687ae
Dockerfile fixes
2016-04-29 14:10:33 -04:00
Evan Cordell
668ce2c7cd
Generate private key on startup
2016-04-29 14:10:33 -04:00
Evan Cordell
85667a9cf6
Creat mitm certs on boot
2016-04-29 14:10:33 -04:00
Evan Cordell
6754131350
Optional tests (on by default) and better load order to reduce build time
2016-04-29 14:10:33 -04:00
Evan Cordell
492dcf4781
Verify that jwt was issued by clair
2016-04-29 14:10:33 -04:00
Evan Cordell
118f2d0ce5
Add mitm certs to jwtproxy
2016-04-29 14:10:33 -04:00
Evan Cordell
9e7a501dae
Authenticate in the other direction with jwtproxy
2016-04-29 14:10:33 -04:00
Evan Cordell
da0a988650
Configure jwtproxy from stack/conf yaml
2016-04-29 14:10:33 -04:00
Evan Cordell
adc86456b5
Secure the correct endpoint
2016-04-29 14:10:33 -04:00
Evan Cordell
8c8ee9c2be
Add jwtproxy and configure verifier for /secscan/notify
2016-04-29 14:10:33 -04:00
Joseph Schorr
6091db983b
Hide expired keys outside of their staleness window
2016-04-29 14:10:33 -04:00
Joseph Schorr
a55e92bc95
Add UI support for multiple operations on keys
2016-04-29 14:09:37 -04:00
Jimmy Zelinskie
726cb5fe6a
key server: 403 on expired approved keys ( #1410 )
2016-04-29 14:09:37 -04:00
Joseph Schorr
4f63a50a17
Change account-less logs to use a user and not null
...
This allows us to skip the migration
2016-04-29 14:09:37 -04:00
Jimmy Zelinskie
5cb6ba4d12
keyserver migration: fix constraint name
2016-04-29 14:09:37 -04:00
Joseph Schorr
28a80ef6a9
Make sure to verify service names on key creation
2016-04-29 14:09:37 -04:00
Joseph Schorr
dc9bcec9ce
Add pre shared generation tool
2016-04-29 14:09:37 -04:00
Jimmy Zelinskie
ca5794ba18
key server: use total_seconds() for cache headers
2016-04-29 14:09:37 -04:00
Joseph Schorr
5d6e5a42e8
Add delete logging and tests for logging
2016-04-29 14:09:09 -04:00
Jimmy Zelinskie
6aa7040f39
keyserver: add cache-control headers
2016-04-29 14:05:16 -04:00
Joseph Schorr
bc08ac2749
Fix timeouts in the JWT endpoint tests
2016-04-29 14:05:16 -04:00
Joseph Schorr
522cf68c5d
Lots of smaller fixes:
...
- Add the rotation_duration to the keys API
- Have the key service UI use the new rotation_duration field
- Fix notification deletion lookup path
- Add proper support for the new notification in the UI
- Only delete expired keys after 7 days (configurable)
- Fix angular digest loop
- Fix unit tests
- Regenerate initdb
2016-04-29 14:05:16 -04:00
Jimmy Zelinskie
2805dad64f
test_endpoints: update to use JWT headers
2016-04-29 14:05:16 -04:00
Jimmy Zelinskie
d0bd70fb36
endpoints.web: add missing import
2016-04-29 14:05:16 -04:00
Jimmy Zelinskie
370ac3ecd0
service keys: add rotation_duration field
2016-04-29 14:05:16 -04:00
Jimmy Zelinskie
6577ac3e62
mv JWK-canonicalization util.security.fingerprint
2016-04-29 14:05:16 -04:00
Jimmy Zelinskie
4020ab9f55
service keys: delete notifications by prefix
2016-04-29 14:05:16 -04:00
Jimmy Zelinskie
fca258d8bf
endpoints: remove /keys
...
BitTorrent support should now be able to use the keyserver
infrastructure instead.
2016-04-29 14:05:16 -04:00
Joseph Schorr
6a00025545
Add a maximum width on the friendly name and service name columns
2016-04-29 14:05:16 -04:00
Jimmy Zelinskie
9f4a4092da
keyserver: get signer kid from unverified headers
2016-04-29 14:05:16 -04:00
Joseph Schorr
08017c5111
Further UI updates
2016-04-29 14:05:16 -04:00
Joseph Schorr
a4a01e76c0
Fix up the migration to include the additional changes needed
2016-04-29 14:05:16 -04:00
Jimmy Zelinskie
dfe9a8e4e1
keyserver: tests!
2016-04-29 14:05:16 -04:00
Jimmy Zelinskie
cfc15746a6
keyserver: tests!
2016-04-29 14:05:16 -04:00
Jimmy Zelinskie
d19eb16b45
keyserver: add generate key function
...
The superuser API, initdb, and tests will all need this functionality.
2016-04-29 14:05:16 -04:00
Joseph Schorr
23a8a29654
More tests
2016-04-29 14:05:16 -04:00
