Quentin Gliech
7d9d97a006
Implement the device access token request
2024-02-02 18:01:51 +01:00
Quentin Gliech
67ab42155c
Implement the device consent logic
2024-02-02 18:01:51 +01:00
Quentin Gliech
50654d2e40
Implement the device code authorisation request
2024-02-02 18:01:51 +01:00
Quentin Gliech
4301fd9378
Setup the device link form page
2024-02-02 18:01:51 +01:00
Quentin Gliech
83bf739538
Implement account management discovery as per MSC2965
2023-12-05 17:40:36 +01:00
Quentin Gliech
a0f5f3c642
Enable clippy lints on a workspace level
...
This enables a lot more lints than before in some crates, so this fixed a lot of warnings as well.
2023-12-05 17:20:42 +01:00
Quentin Gliech
df3ca5ae66
Upgrade clippy lints to 1.74.0 & fix warnings
2023-12-05 17:20:42 +01:00
Quentin Gliech
6f986e117a
Fix the login template in case no human_name was set on the provider
2023-11-21 16:09:38 +01:00
Quentin Gliech
5126d36b2e
Add upstream OAuth 2.0 providers name and branding
2023-11-20 17:23:02 +01:00
Quentin Gliech
7315dd9a7a
Allow endpoints and discovery mode override for upstream oauth2 providers
...
This time, at the configuration and database level
2023-11-17 16:18:39 +01:00
Quentin Gliech
364093f12f
Allow overriding usptream OAuth2 providers endpoints
...
Also have a way to disable OIDC discovery when all the endpoints are known.
2023-11-17 16:18:39 +01:00
Quentin Gliech
b2b88e11bf
Bump clippy checks to 1.73.0
2023-11-14 11:10:40 +01:00
Quentin Gliech
89420a2cfc
Refactor the upstream link provider template logic
...
Also adds tests for new account registration through an upstream oauth2
provider
2023-11-13 14:11:30 +01:00
Quentin Gliech
9c94e11e68
Check for existing users ahead of time on upstream OAuth2 registration
2023-11-13 14:11:30 +01:00
Quentin Gliech
6ded397977
Use minijinja templates to map OIDC claims to user attributes
2023-11-08 12:05:58 +01:00
Quentin Gliech
6d65bcae13
Make the upstream provider URL better display & fix test
2023-10-30 15:55:15 +01:00
Quentin Gliech
a404398c2c
Polish all forms and add nice page headings to most screens
2023-10-30 15:55:15 +01:00
Quentin Gliech
8984cc703b
Add instance privacy policy, TOS and imprint, and loads of design cleanups
2023-10-30 15:55:15 +01:00
Quentin Gliech
9b5c8fb44b
Allow running the authentication service on a different base path
2023-10-06 14:07:55 +02:00
Quentin Gliech
f2f51d45a4
handlers: fix test after a translation update
2023-10-05 19:29:23 +02:00
Quentin Gliech
b2cd8d83f7
templates: translate a lot more stuff
2023-10-05 19:29:23 +02:00
Quentin Gliech
1feafc1d13
handlers/templates: infer the language from the Accept-Language browser header
2023-10-05 19:29:23 +02:00
Quentin Gliech
15ad89aa82
templates: add translations function
2023-10-05 19:29:23 +02:00
Quentin Gliech
995bdfc13b
templates: replace tera with minijinja
2023-10-05 19:29:23 +02:00
Quentin Gliech
3303e74123
Add a way to discover the GraphQL endpoint in the .well-known/openid-configuration
...
This adds a `org.matrix.matrix-authentication-service.graphql_endpoint` key to it
2023-10-05 16:43:13 +02:00
Quentin Gliech
f20c8d8ef3
Infer client IP address from the peer address and the X-Forwarded-Proxy header
2023-09-20 20:24:30 +02:00
Quentin Gliech
894957934d
Test the activity tracker on the introspection endpoint
2023-09-19 21:57:54 +02:00
Quentin Gliech
b85655b944
Save the session activity in the database
2023-09-19 21:57:54 +02:00
Quentin Gliech
407c78a7be
Record the user session activity for most routes
2023-09-19 21:57:54 +02:00
Quentin Gliech
cf5510a1a2
Add an ActivityTracker which tracks session activity and regularly flush them to the database
2023-09-19 21:57:54 +02:00
Quentin Gliech
21406218aa
fixup! Deny URIs from client that are public suffixes
2023-09-18 11:57:50 +02:00
Quentin Gliech
7887387568
Deny URIs from client that are public suffixes
2023-09-18 11:57:50 +02:00
Quentin Gliech
54071c4969
Make the HTTP client factory reuse the underlying client
...
This avoids duplicating clients, and makes it so that they all share the same connection pool.
2023-09-14 16:52:01 +02:00
Quentin Gliech
9fcdad3142
Stop using deprecated chrono::DateTime::from_utc method
2023-09-13 18:28:41 +02:00
Quentin Gliech
9a77f67fbe
Make the error on introspection failure more explicit in the logs
2023-09-13 18:24:52 +02:00
Quentin Gliech
789040d22f
graphql: Fix the createOauth2Session mutation not persisting the changes to the database
2023-09-12 11:31:19 +02:00
Quentin Gliech
9c97a0c37a
storage: make the access token expiration optional
2023-09-11 12:03:42 +02:00
Quentin Gliech
e6b91c1ce4
data-model: make the access token expiration optional
2023-09-11 12:03:42 +02:00
Quentin Gliech
83ca90ee3d
Add a GraphQL mutation to create arbitrary OAuth2 sessions.
2023-09-11 12:03:42 +02:00
Quentin Gliech
20cb5dda8c
Have more granular errors on the refresh token grant
2023-09-08 15:19:43 +02:00
Quentin Gliech
0bb34ed3e0
Add the Sentry event ID in error response headers
2023-09-08 15:19:43 +02:00
Quentin Gliech
5a6e630c73
Test that a client_credentials token with the admin scope can add a user
2023-09-06 09:35:34 +02:00
Quentin Gliech
d16b880267
policy: only require redirect_uris for the authorization_code and implicit grants
2023-09-06 09:35:34 +02:00
Quentin Gliech
c85f5f2768
Only allow using the refresh token grant if it was asked during the client registration
2023-09-06 09:35:34 +02:00
Quentin Gliech
b9edbda5e1
Advertise the client_credentials grant in the discovery document
2023-09-06 09:35:34 +02:00
Quentin Gliech
542d0a6073
Implement the client credentials grant
2023-09-06 09:35:34 +02:00
Quentin Gliech
00fe5f902b
storage: add a method to create an OAuth 2.0 session for a client credentials grant
2023-09-06 09:35:34 +02:00
Quentin Gliech
7e247830c9
data-model: Make the user_id optional in the OAuth 2.0 sessions
2023-09-06 09:35:34 +02:00
Hugh Nimmo-Smith
bca3ab5eb6
Add CORS headers for /graphql
2023-09-01 17:30:33 +02:00
Kerry
17f8dc4e00
Implement MSC2965 action parameter ( #1673 )
...
* redirect session_end action to session detail
* fix react key warning in oauth session detail
* move Route type to /routing
* test getRouteActionRedirection
* comment
* frontend: Split the routing-related stuff in multiple files under routing/
* frontend: Cover all the redirections defined by MSC2965
* frontend: fix test
* Make the backend keep query parameters through login to the /account/ interface
* Fix frontend tests & clippy lints
---------
Co-authored-by: Quentin Gliech <quenting@element.io >
2023-09-01 09:42:50 +00:00
