1
0
mirror of https://github.com/quay/quay.git synced 2026-01-29 08:42:15 +03:00
Commit Graph

37 Commits

Author SHA1 Message Date
Oleg Bulatov
e1a1feb293 feat(oidc): add OIDC_DISABLE_USER_ENDPOINT parameter (PROJQUAY-6908) (#2773) 2024-03-19 15:44:21 +01:00
Sunandadadi
298373a3db oidc: allows users to login via cli (PROJQUAY-6873) (#2748)
* oidc: allows users to login via cli (PROJQUAY-6873)

* fixing tests

* update reading username + adding tests
2024-03-18 14:06:16 -04:00
Sunandadadi
74fd23d7d3 backend: Syncing teams with OIDC group (PROJQUAY-6290) (#2693) 2024-02-27 16:53:51 -05:00
Sunandadadi
3e6384e642 sso: adding error log for export compliance (PROJQUAY-6486) (#2540)
* sso: adding error log for export compliance (PROJQUAY-6486)

* adding if condition for response
2023-12-08 11:38:21 -05:00
Kenny Lee Sin Cheong
72f7c64ed6 chore: update werkzeug and related package versions (PROJQUAY-5098) (#1982)
* chore: update werkzeug and related package versions (PROJQUAY-5098)

Path converter related change reference: https://github.com/pallets/werkzeug/issues/2506

* Update query count
2023-09-12 11:51:09 -04:00
Kenny Lee Sin Cheong
5f63b3a7bb chore: drop deprecated tables and remove unused code (PROJQUAY-522) (#2089)
* chore: drop deprecated tables and remove unused code

* isort imports

* migration: check for table existence before drop
2023-08-25 12:17:24 -04:00
Syed Ahmed
2db3b186f9 ui: add support for exposing quay UI as a dynamic plugin (PROJQUAY-3203) (#1799)
* ui: add support for exposing quay UI as a dynamic plugin (PROJQUAY-3203)

* Introduces a new SSO JWT based auth for client side Oauth
* Adds a new entrypoint component for the UI without topnav and sidenav for plugin
* Adds webpack config to build dynamic plugin
2023-04-20 19:05:07 -04:00
Syed Ahmed
f2b70c5031 login: Re-raise the export compliance exception on RHSSO (PROJQUAY-4844) (#1725)
Fixes an issue where the export compliance exception
gets caught as a generic OAUTH exception
2023-01-24 16:04:40 -05:00
Syed Ahmed
cb590f9a63 login: Add error message for exprot compliance hold (PROJQUAY-4844) (#1715)
Give users who are blocked more info on the next
steps to contact export compliance
2023-01-23 14:25:09 -05:00
Syed Ahmed
442bb1689d login: Use the correct username for export compliance (PROJQUAY-4844) (#1696)
SSO username can be different from quay username. Use the subject
returned from the token and parse the SSO username from the subject
2023-01-06 13:14:50 -05:00
Syed Ahmed
5bd2426400 login: Add subject in debug logs for export compliance (PROJQUAY-4844) (#1695)
This is to debug errors from export compliance in case of incorrect
matching for usernames
2023-01-05 17:34:56 -05:00
Dave O'Connor
e586d3e13d Fix nbf and oidc (#1477) 2022-08-10 10:55:36 -04:00
Dave O'Connor
db225c3293 Bump PyJWT (#1465) 2022-08-08 11:02:09 -04:00
Kenny Lee Sin Cheong
6ed0bcdedc auth: allow rs384 in jwt (PROJQUAY-4148) (#1449)
Allow the use of RS384 for jwt and oidc.
2022-07-18 14:03:27 -04:00
Oleg Bulatov
ed8f12ba34 Enable some flake8 checks in CI (#1389) 2022-06-16 18:22:16 +02:00
Syed Mushtaq Ahmed
922a82a3d9 oauth: Add the code param to the oauthrize.html template (PROJQUAY-3648) (#1362)
Fixes an issue where the code param is not passed to the app redirect
URI if the user has not authorized the app before
2022-06-07 13:35:28 -04:00
Jonathan King
0fdf96a2d1 rhsso: Add checks for e-mail blocked in export screen (PROJQUAY-2056) (#1333)
- Check for additional error messages returned from export screen
2022-05-19 10:59:32 -04:00
Brandon Caton
1d2e55b63d builders: Set imagePullPolicy to always (PROJQUAY-3507) (#1330)
Currently imagePullPolicy is set to IfNotPresent. This will ignore updates to the builder image.
2022-05-17 10:05:26 -04:00
Jonathan King
b21400b90d bump: Bump to redeploy Quay pods to reflect new endpoint (PROJQUAY-2056) (#1327)
- Bump vault version from 2 to 3
2022-05-13 17:58:40 -04:00
Jonathan King
ca70a501c6 sso: Handle edge case for stage sso only users (PROJQUAY-2056) (#1326)
- Handle 400 status code gracefully as users in stage sso may not necessarily exist in compliance backend
2022-05-12 16:40:00 -04:00
Jonathan King
42f09298c4 sso: Fix debug statement (PROJQUAY-2056) (#1325)
- Fix debug statement to print stringified json
2022-05-12 14:57:51 -04:00
Jonathan King
f6e754b561 sso: Use trusted cert from extra_ca_certs directory (PROJQUAY-2056) (#1324)
- Do not pass certificate in verify parameter, instead load automatically from extra_ca_certs dir
2022-05-12 14:31:27 -04:00
Jonathan King
0826ac0e4e sso: Use requests client in screening call (PROJQUAY-2056) (#1321)
- Use requests client instead of built in client to prevent cert conflicts
2022-05-12 10:28:27 -04:00
Jonathan King
4e739d30bf sso: Update mount path for export compliance certificate (PROJQUAY-2056) (#1320)
- Change mount path from  to /stack
2022-05-11 17:31:32 -04:00
Jonathan King
2c3e26a322 sso: Add test for RHSSO OAuth service (PROJQUAY-2056) (#1317)
- Add test for RHSSOOAuthService class
2022-05-11 16:33:01 -04:00
Jonathan King
ad4bb6f185 compliance: Move export screening to RHSSO class (PROJQUAY-2056) (#1302)
- Created a RHSSO class
- Put export compliance logic in class override
2022-05-04 16:30:44 -04:00
Kenny Lee Sin Cheong
712b8d7493 migration: configure logging in alembic's env.py (PROJQUAY-2412) (#875)
Reference: https://alembic.sqlalchemy.org/en/latest/api/config.html#configuration
2021-08-17 12:58:56 -04:00
Sunandadadi
5debec58f9 Quay.io: Catching requests from impersonated principals (#869)
Dennying requests when impersonated
2021-08-10 16:27:09 -05:00
Alec Merdler
7f23e584d1 oauth: add timeout to OAuth token exchange (PROJQUAY-1335) (#735)
Handles potential 'ECONNRESET' exception from using RH SSO
or any other SSO service.

Signed-off-by: Alec Merdler <alecmerdler@gmail.com>
2021-04-26 12:45:54 -07:00
Kenny Lee Sin Cheong
7d9a49da10 Replace jwkest with authlib (#685)
* Replace jwkest with authlib and PyCrypto with cryptography

Remove pycryptodome dependencies.
Remove post-fork random seed init - python-cryptography's pseudo RNG should be fork safe:
- https://cryptography.io/en/latest/security.html?highlight=fork
- https://cryptography.io/en/latest/hazmat/backends/openssl.html?highlight=fork#os-random-engine

* deps: Pin cryptography to 3.3.1

Latest available version available on RHEL.
As of 3.4, cryptography builds on rust, which is not readily available
on RHEL.
2021-03-15 15:25:23 -04:00
Lee Azzarello
0b2f1e9422 PROJQUAY-1380 OIDC external authentication to use PREFERRED_URL_SCHEME in config.yaml (#621)
Issue: https://issues.redhat.com/browse/PROJQUAY-1380

Changelog:

Added: OIDC login uses value of PREFERRED_URL_SCHEME when redirecting after successful authentication.

Testing:

Requires a custom external authentication OIDC provider to be configured and an installation to be behind a load balancer that is doing SSL termination.

Details:

Flask's url_for() function ignores the value of PREFERRED_URL_SCHEME which will break OAuth2 authentication because it requires redirecting to only HTTPS endpoints.
2021-01-08 12:38:20 -05:00
Kurtis Mullins
bd7252c536 [PROJQUAY-1021] task: Update "Black" to version 20.8b1 2020-11-30 18:48:19 -05:00
Kurtis Mullins
38be6d05d0 Python 3 (#153)
* Convert all Python2 to Python3 syntax.

* Removes oauth2lib dependency

* Replace mockredis with fakeredis

* byte/str conversions

* Removes nonexisting __nonzero__ in Python3

* Python3 Dockerfile and related

* [PROJQUAY-98] Replace resumablehashlib with rehash

* PROJQUAY-123 - replace gpgme with python3-gpg

* [PROJQUAY-135] Fix unhashable class error

* Update external dependencies for Python 3

- Move github.com/app-registry/appr to github.com/quay/appr
- github.com/coderanger/supervisor-stdout
- github.com/DevTable/container-cloud-config
- Update to latest mockldap with changes applied from coreos/mockldap
- Update dependencies in requirements.txt and requirements-dev.txt

* Default FLOAT_REPR function to str in json encoder and removes keyword assignment

True, False, and str were not keywords in Python2...

* [PROJQUAY-165] Replace package `bencode` with `bencode.py`

- Bencode is not compatible with Python 3.x and is no longer
  maintained. Bencode.py appears to be a drop-in replacement/fork
  that is compatible with Python 3.

* Make sure monkey.patch is called before anything else (

* Removes anunidecode dependency and replaces it with text_unidecode

* Base64 encode/decode pickle dumps/loads when storing value in DB

Base64 encodes/decodes the serialized values when storing them in the
DB. Also make sure to return a Python3 string instead of a Bytes when
coercing for db, otherwise, Postgres' TEXT field will convert it into
a hex representation when storing the value.

* Implement __hash__ on Digest class

In Python 3, if a class defines __eq__() but not __hash__(), its
instances will not be usable as items in hashable collections (e.g sets).

* Remove basestring check

* Fix expected message in credentials tests

* Fix usage of Cryptography.Fernet for Python3 (#219)

- Specifically, this addresses the issue where Byte<->String
  conversions weren't being applied correctly.

* Fix utils

- tar+stream layer format utils
- filelike util

* Fix storage tests

* Fix endpoint tests

* Fix workers tests

* Fix docker's empty layer bytes

* Fix registry tests

* Appr

* Enable CI for Python 3.6

* Skip buildman tests

Skip buildman tests while it's being rewritten to allow ci to pass.

* Install swig for CI

* Update expected exception type in redis validation test

* Fix gpg signing calls

Fix gpg calls for updated gpg wrapper, and add signing tests.

* Convert / to // for Python3 integer division

* WIP: Update buildman to use asyncio instead of trollius.

This dependency is considered deprecated/abandoned and was only
used as an implementation/backport of asyncio on Python 2.x
This is a work in progress, and is included in the PR just to get the
rest of the tests passing. The builder is actually being rewritten.

* Target Python 3.8

* Removes unused files

- Removes unused files that were added accidentally while rebasing
- Small fixes/cleanup
- TODO tasks comments

* Add TODO to verify rehash backward compat with resumablehashlib

* Revert "[PROJQUAY-135] Fix unhashable class error" and implements __hash__ instead.

This reverts commit 735e38e3c1d072bf50ea864bc7e119a55d3a8976.
Instead, defines __hash__ for encryped fields class, using the parent
field's implementation.

* Remove some unused files ad imports

Co-authored-by: Kenny Lee Sin Cheong <kenny.lee@redhat.com>
Co-authored-by: Tom McKay <thomasmckay@redhat.com>
2020-06-05 16:50:13 -04:00
Joseph Schorr
dce4d3ec1e Change GitHub Login to send the auth token via header (#329)
GitHub has deprecated support for passing the token via URL parameter
2020-04-09 11:30:41 -04:00
alecmerdler
3dd5f045ff fix all the docstrings 2020-02-05 19:55:07 -08:00
Tom McKay
e6ae94db8b 'make black' results 2019-12-02 12:23:08 -05:00
Jimmy Zelinskie
9c0dd3b722 initial import for Open Source 🎉 2019-11-12 11:09:47 -05:00