This commit adds the `--console` flag to the following commands:
* `step ssh certificate`
* `step ssh config`
* `step ssh hosts`
* `step ssh login`
* `step ssh proxycommand`
This PR upgrades go-pkcs12 and switches the default encoder to a modern
version PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC. It also adds
a legacy flag to use the previous version.
This PR also fixes some linter issues.
Fixes#1061
This commit sorts the flags in step certificate create command. It also
adds flags for the hidden insecure and subtle and replaces them in other
commands.
This commit fixes a reported problem of EOF errors on device
authentication flows. This fix prevents reusing the TCP connection
between request to the same host, that seems to resolve the issue.
The OAuth2.0 spec (https://www.rfc-editor.org/rfc/rfc6749#section-5.1)
dictates that there should/could be a `scope` parameter in responses
from calls to the `/token` endpoint. Including this in the cli output is
useful for debugging access tokens etc.
It adds the header "Accept: application/json" so OAuth services like
GitHub returns the data in the appropriate form instead of using
application/x-www-form-urlencoded. It also configures GitHub as a new
provider as it does not have a well-known url.
This header does not cause any issues on Google or Microsoft.
Fixes#740
- We'll fully remove the OOB flow once Google discontinues it
- In the mean time we've added the DEVICE env var to `step oauth` which
allows users to select the device authz grant flow even when using a
Google provider.
If a user runs:
step oauth --listen :1234 --listen-url http://localhost:1234/callback
The http handler should respond to /callback. Before this, the http
handler was only responding to /, and showing a 404 for /callback.
Fixes#562
In some environments like containers it might be difficult to
redirect to 127.0.0.1 and we might need to listen in 0.0.0.0, but
at the same time we cannot use http://0.0.0.0:10000 as the redirect_uri.
This parameters allows to override the redirect_uri in a loopback
authorization.
The name is set to --listen-url instead of --redirect-uri to avoid
confusion with --redirect-url. And generally --listen and --listen-url
will be used together.
