Commit Graph

267 Commits

Author SHA1 Message Date
Michael Klishin 0a5f103bc5
OAuth 2: integration suite cosmetics 2022-04-22 10:17:33 +04:00
Michael Klishin ebbba4c992
OAuth 2: extract complex claim integration tests in a separate group 2022-04-22 09:50:14 +04:00
Michael Klishin efe78133c9
OAuth 2: add an integration test for scope aliases 2022-04-22 01:31:22 +04:00
Michael Klishin 9d72a4a804
OAuth 2: more scope aliasing tests 2022-04-22 00:38:26 +04:00
Michael Klishin a242fb9f3d
OAuth 2: refactor unit_SUITE 2022-04-21 16:28:44 +04:00
Michael Klishin 0862199b9e
OAuth 2: initial scope aliasing test 2022-04-21 14:16:46 +04:00
Michael Klishin a2a54686e7
OAuth 2: initial work on scope aliases
Per discussion with @MarcialRosales, we try to fetch
aliases from two sources, based on feedback from two different
users who seemingly rely on the same family of identity
provider products:

 * Use the JWT scope field value first
 * Use extra_scopes_source app env setting second

Just like with the existing extra scopes/complex claim
support originally contributed for Keycloak/identityProvider,
we merge all these scopes obtained from "alternative sources"
with the value of the JWT scopes field. This implicitly
assumes that the result makes sense semantically and
there will not be conflicting scopes. That's on the user to
make sure of.

References #4588
2022-04-20 14:29:31 +04:00
Luke Bakken dba25f6462
Replace files with symlinks
This prevents duplicated and out-of-date instructions.
2022-04-15 06:04:29 -07:00
Michael Klishin c38a3d697d
Bump (c) year 2022-03-21 01:21:56 +04:00
Arnaud Cogoluègnes 4a2f61a49a
Fix usage of add_uaa_key command
Switch is --pem-file, not --pem_file.
2022-03-09 16:24:05 +01:00
Arnaud Cogoluègnes 8443305e49
Remove Travis CI badge in OAuth 2 plugin 2022-03-02 08:57:40 +01:00
Philip Kuryloski dabf053cf8 Additional dialyzer warning fixes
Currently loading of the rabbitmq_cli defined behaviors compiled with
Elixir does not work, so we ignore the callback definitions contained therein
2022-02-25 18:14:35 +01:00
Philip Kuryloski 226e00fcd2 Tighten up dialyzer usage
now that rules_erlang no longer cascades up dialyzer warnings from deps
2022-02-24 11:18:41 +01:00
Philip Kuryloski d8201726ae Ignore dialyzer warnings for most apps 2022-02-21 09:19:56 +01:00
Lajos Gerecs 608d11a3f8 convert additional_scopes_param to the correct equivalent 2022-02-03 18:13:08 +01:00
Philip Kuryloski efcd881658 Use rules_erlang v2
bazel-erlang has been renamed rules_erlang. v2 is a substantial
refactor that brings Windows support. While this alone isn't enough to
run all rabbitmq-server suites on windows, one can at least now start
the broker (bazel run broker) and run the tests that do not start a
background broker process
2022-01-18 13:43:46 +01:00
Anh Thi Lan Nguyen 575b6a1188 Increase token expiration time 2021-12-14 17:18:09 +07:00
Anh Thi Lan Nguyen 8aeca45a17 Start SSL app for testing server 2021-12-14 16:47:20 +07:00
Anh Thi Lan Nguyen 0bc7c98bda Standardise README.md 2021-12-14 12:22:55 +07:00
Anh Thi Lan Nguyen 868443deb0 Correct configuration example in README.md 2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen ea8ad0e3e3 Add timeout for httpc request 2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen 093a04323b Add configurable crl_check and fail_if_no_peer_cert
- Add configuration: crl_check, fail_if_no_peer_cert
- Correct configuration: hostname_verification
2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen 118e44c10e Add wildcard configuration
A "wildcard" configuration is added to enable key server verification with wildcard certificate
2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen a9bc1c0ce9 Update README.md
- Update new configuration document
- Add configurable "depth" for key server verification
2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen 8c541fb047 Set peer_verification default as verify_none 2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen 1615cbfb8b Update better configuration names
- "strict" changes to "https.peer_verification"
- "cacertfile" changes to "https.cacertfile"
2021-12-14 11:28:33 +07:00
Anh Thi Lan Nguyen dd685f1179 Oauth2 plugin improvements
- Validate JWKS server when getting keys
- Restrict usable algorithms
2021-12-14 11:28:33 +07:00
Michal Kuratczyk acf474e056 Fix cuttlefish config for oauth2
The structure of the signing_keys map should be `<<"id">> => {pem, <<"key">>}`.
Previously it was mapped directly as `<<"id">> => <<"key">>`.
2021-11-18 12:58:57 +01:00
Philip Kuryloski b8cabfe3dd bump test timeouts 2021-07-28 08:37:40 +02:00
Philip Kuryloski 2a6a9c786b Bazel test timeouts 2021-07-27 10:57:50 +02:00
Philip Kuryloski abc8703fd8 Bump test timeouts in bazel 2021-07-26 11:09:09 +02:00
Philip Kuryloski 8f9de08de7 Also assert no missing suites for all other deps 2021-07-12 18:05:55 +02:00
Philip Kuryloski 8c7e7e0656 Revert "Default all `rabbitmq_integration_suite` to flaky in bazel"
This reverts commit 70cb8147b2.
2021-06-23 20:53:14 +02:00
Philip Kuryloski 70cb8147b2 Default all `rabbitmq_integration_suite` to flaky in bazel
Most tests that can start rabbitmq nodes have some chance of
flaking. Rather than chase individual flakes for now, this commit
changes the default (though it can still be overriden, as is the case
for config_scheme_SUITE in many places, since I have yet to see that
particular suite flake).
2021-06-21 16:10:38 +02:00
Michael Klishin 604fbfac3a
Depend on erlang-jose ref with fix for potatosalad/erlang-jose#113 2021-06-10 15:49:39 +03:00
Michael Klishin ab795c1232
OAuth 2 system_SUITE: squash some erlc warnings 2021-06-10 15:48:33 +03:00
Philip Kuryloski 37f5744833 Add rabbitmq_auth_backend_oauth2 system_SUITE to bazel 2021-06-09 17:43:20 +02:00
Philip Kuryloski 30f9a95b9f Add dialyze for remaning tier-1 plugins 2021-06-01 10:19:10 +02:00
Philip Kuryloski 98e71c45d8 Perform xref checks on many tier-1 plugins 2021-05-21 12:03:22 +02:00
Philip Kuryloski c13c2af614 Bazel file refactoring 2021-05-11 12:03:27 +02:00
Philip Kuryloski ec5954fe9c Refactor rabbitmq_auth_backend_oauth2 bazel 2021-05-11 10:52:28 +02:00
SkapiN 05cb5f8fa6
Set correct field for extra scope and improve doc
- Replace  additional_rabbitmq_scopes in doc for the correct extra_scopes_source value
- Add samples
- More details for audiance checkup on token
2021-04-16 15:27:58 +02:00
Philip Kuryloski 072a1c0462 Refactor and dedupe .bazel file content 2021-04-16 10:22:44 +02:00
Philip Kuryloski 78bb20f0aa Adopt change of suite_name -> name in ct_suite from @bazel-erlang 2021-04-08 14:25:06 +02:00
Philip Kuryloski 2f17113154 Add deps/rabbitmq_auth_mechanism_ssl to bazel build 2021-04-06 14:30:14 +02:00
Philip Kuryloski 64f6c18cb8 Add the rabbitmq_auth_backend_oauth2 suite
requires recent @bazel-erlang updates
2021-03-31 19:11:32 +02:00
Philip Kuryloski a63f169fcb Remove duplicate rabbitmq-components.mk and erlang.mk files
Also adjust the references in rabbitmq-components.mk to account for
post monorepo locations
2021-03-22 15:40:19 +01:00
kjnilsson 52f745dcde Update rabbitmq-components.mk
use v1.x branch of ra
2021-03-18 15:14:40 +00:00
Loïc Hoguin d5e3bdd623
Add ADDITIONAL_PLUGINS variable
This allows including additional applications or third party
plugins when creating a release, running the broker locally,
or just building from the top-level Makefile.

To include Looking Glass in a release, for example:

$ make package-generic-unix ADDITIONAL_PLUGINS="looking_glass"

A Docker image can then be built using this release and will
contain Looking Glass:

$ make docker-image

Beware macOS users! Applications such as Looking Glass include
NIFs. NIFs must be compiled in the right environment. If you
are building a Docker image then make sure to build the NIF
on Linux! In the two steps above, this corresponds to Step 1.

To run the broker with Looking Glass available:

$ make run-broker ADDITIONAL_PLUGINS="looking_glass"

This commit also moves Looking Glass dependency information
into rabbitmq-components.mk so it is available at all times.
2021-03-12 12:29:28 +01:00
Michael Klishin 97ff62d3b2
Drop trailing newlines from logged messages where possible
Lager strips trailing newline characters but OTP logger with the default
formatter adds a newline at the end. To avoid unintentional multi-line log
messages we have to revisit most messages logged.

Some log entries are intentionally multiline, others
are printed to stdout directly: newlines are required there
for sensible formatting.
2021-03-11 15:17:37 +01:00