gsadmin/ziti
1
0
Fork 0
mirror of https://github.com/openziti/ziti.git synced 2026-10-12 15:28:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update deps and changelog

Browse Source
This commit is contained in:
Paul Lorenz
2021-01-27 18:26:45 -05:00
parent 54664b07d8
commit 463d01bddf
3 changed files with 59 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+51 -39
View File
@@ -6,20 +6,22 @@
* xgress_edge refactor, should fix 'failed to dipsatch to fabric' errors
* Update `ziti use` command to work with main branch
* MFA Support
* Fix deadlock on session close in router when connection is at capacity
* Fix issue where end of session didn't get sent in some scenarios
## MFA Support
Endpoint MFA is available that is based on RFC 4226 (HOTP: An HMAC-Based One-Time Password Algorithm)
and RFC 6238 (TOTP: Time-Based One-Time Password Algorithm). These standards are compatible with standard "Authenticator"
apps such as Google Authenticator and Authy. MFA is suggested to be used in situations where human
operators are involved and additional security is desired.
Endpoint MFA is available that is based on RFC 4226 (HOTP: An HMAC-Based One-Time Password
Algorithm) and RFC 6238 (TOTP: Time-Based One-Time Password Algorithm). These standards are
compatible with standard "Authenticator" apps such as Google Authenticator and Authy. MFA is
suggested to be used in situations where human operators are involved and additional security is
desired.
### Restricting Service Access
Services can now have a Posture Check of type MFA that can be created and associated with
a Service Policy. Service Policies that are associated with an MFA Posture Check will restrict
access to services if a client has not enrolled in MFA and passed an MFA check on each login.
Services can now have a Posture Check of type MFA that can be created and associated with a Service
Policy. Service Policies that are associated with an MFA Posture Check will restrict access to
services if a client has not enrolled in MFA and passed an MFA check on each login.
MFA Posture Checks support only the basic Posture Check fields:
@@ -29,6 +31,7 @@ MFA Posture Checks support only the basic Posture Check fields:
- roleAttributes - role attributes used to select this object from Service Policies
Example:
```
POST /posture-checks
{
@@ -40,15 +43,16 @@ POST /posture-checks
### Admin MFA Management
Admins of the Ziti Edge API can remove MFA from any user. However, they
cannot enroll on behalf of the client. The client will have to initiate
MFA enrollment via their client.
Admins of the Ziti Edge API can remove MFA from any user. However, they cannot enroll on behalf of
the client. The client will have to initiate MFA enrollment via their client.
Endpoints:
- `DELETE /identities/<id>/mfa` - remove MFA from an identity
- `GET /identities` - has a new field `isMfaEnabled` that is true/false based on the identity's MFA enrollment
- `GET /identities/<id>/posture-data` - now includes a `sessionPostureData` field which is a map of sessionId -> session posture data (including MFA status)
- `GET /identities` - has a new field `isMfaEnabled` that is true/false based on the identity's MFA
enrollment
- `GET /identities/<id>/posture-data` - now includes a `sessionPostureData` field which is a map of
sessionId -> session posture data (including MFA status)
Example Posture Data:
@@ -75,34 +79,40 @@ Example Posture Data:
### Client MFA Enrollment
Clients must individually enroll in MFA as the enrollment process includes
exchanging a symmetric key. During MFA enrollment the related MFA endpoints
will return different data and HTTP status codes based upon the state of MFA
enrollment (enrollment not started, enrollment started, enrolled).
Clients must individually enroll in MFA as the enrollment process includes exchanging a symmetric
key. During MFA enrollment the related MFA endpoints will return different data and HTTP status
codes based upon the state of MFA enrollment (enrollment not started, enrollment started, enrolled).
The general MFA enrollment flow is:
1. Authenticate as the identity via `POST /authenticate`
2. Start MFA enrollment via `POST /current-identity/mfa`
3. Retrieve the MFA provisioning URL or QR code
- `GET /current-identity/mfa`
- `GET /current-identity/mfa/qr-code`
4. Use the provisioning URL or QR code with an authentication app such as Google Authenticator, Authy, etc.
5. Use a current code from the authenticator to `POST /current-identity/mfa/verify` with the code in the `code` field `{"code": "someCode"}`
- `GET /current-identity/mfa`
- `GET /current-identity/mfa/qr-code`
4. Use the provisioning URL or QR code with an authentication app such as Google Authenticator,
Authy, etc.
5. Use a current code from the authenticator to `POST /current-identity/mfa/verify` with the code in
the `code` field `{"code": "someCode"}`
#### MFA Endpoints Overview:
This section is an overview for the endpoints. Each endpoint may return errors depending on
in input and MFA status.
This section is an overview for the endpoints. Each endpoint may return errors depending on in input
and MFA status.
- `GET /current-identity/mfa` - returns the current state of MFA enrollment or 404 Not Found
- `POST /current-identity/mfa` - initiates MFA enrollment or 409 Conflict
- `DELETE /current-identity/mfa` - remove MFA enrollment, requires a valid TOTP or recovery code
- `GET /current-identity/mfa/recovery-codes` - returns the current recovery codes, requires a valid TOTP Code
- `POST /current-identity/mfa/recovery-codes` - regenerates recovery codes, requires a valid TOTP code
- `POST /current-identity/mfa/verify` - allows MFA enrollment to be completed, requires a valid TOTP code
- `GET /current-identity/mfa/qr-code` - returns a QR code for use with QR code scanner, MFA enrollment must be started
- `POST /authenticate/mfa` - allows MFA authentication checks to be completed, requires a valid TOTP or recovery code
- `GET /current-identity/mfa/recovery-codes` - returns the current recovery codes, requires a valid
TOTP Code
- `POST /current-identity/mfa/recovery-codes` - regenerates recovery codes, requires a valid TOTP
code
- `POST /current-identity/mfa/verify` - allows MFA enrollment to be completed, requires a valid TOTP
code
- `GET /current-identity/mfa/qr-code` - returns a QR code for use with QR code scanner, MFA
enrollment must be started
- `POST /authenticate/mfa` - allows MFA authentication checks to be completed, requires a valid TOTP
or recovery code
MFA Enrollment Not Started:
@@ -115,6 +125,7 @@ MFA Enrollment Not Started:
- `GET /current-identity/mfa/qr-code` - returns 404 Not Found
MFA Enrollment Started:
- `GET /current-identity/mfa` - returns the current MFA enrollment and recovery codes
- `POST /current-identity/mfa` - returns 409 Conflict
- `DELETE /current-identity/mfa` - aborts the current enrollment, a blank `code` may be supplied
@@ -124,22 +135,24 @@ MFA Enrollment Started:
- `GET /current-identity/mfa/qr-code` - returns a QR code for use with QR code scanner in PNG format
MFA Completed:
- `GET /current-identity/mfa` - returns the current MFA enrollment, but not recovery codes
- `POST /current-identity/mfa` - returns 409 Conflict
- `DELETE /current-identity/mfa` - removes MFA, a valid TOTP or recovery code must be supplied
- `GET /current-identity/mfa/recovery-codes` - shows the current recovery codes, a valid TOTP code must be supplied
- `GET /current-identity/mfa/recovery-codes` - shows the current recovery codes, a valid TOTP code
must be supplied
- `POST /current-identity/mfa` - returns HTTP status 409 Conflict
- `POST /current-identity/mfa/verify` - returns HTTP status 409 Conflict
- `GET /current-identity/mfa/qr-code` - returns 404 Not Found
### Client MFA Recovery Codes
Client MFA recovery codes are generated during enrollment and can be regenerated at any
time with a valid TOTP code. Twenty codes are generated and are one time use only.
Generating new codes replaces all existing recovery codes.
Client MFA recovery codes are generated during enrollment and can be regenerated at any time with a
valid TOTP code. Twenty codes are generated and are one time use only. Generating new codes replaces
all existing recovery codes.
To view:
```
GET /current-identity/mfa/recovery-codes
{
@@ -148,6 +161,7 @@ GET /current-identity/mfa/recovery-codes
```
To Generate new codes:
```
POST /current-identity/mfa/recovery-codes
{
@@ -157,10 +171,9 @@ POST /current-identity/mfa/recovery-codes
### Authentication
During API Session authentication a new `authQuery` field is returned.
This field will indicate if there are any outstanding authentication
Posture Queries that need to be fulfilled before authentication is
considered complete.
During API Session authentication a new `authQuery` field is returned. This field will indicate if
there are any outstanding authentication Posture Queries that need to be fulfilled before
authentication is considered complete.
When MFA authentication is required a field will now appear as an
`authQuery` with the following format:
@@ -185,7 +198,6 @@ When MFA authentication is required a field will now appear as an
}
```
# Release 0.18.4
## What's New
go.mod
+3 -3
View File
@@ -24,10 +24,10 @@ require (
github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d
github.com/keybase/go-ps v0.0.0-20190827175125-91aafc93ba19
github.com/michaelquigley/pfxlog v0.3.6
github.com/openziti/edge v0.17.52
github.com/openziti/fabric v0.15.13
github.com/openziti/edge v0.17.53
github.com/openziti/fabric v0.15.15
github.com/openziti/foundation v0.15.9
github.com/openziti/sdk-golang v0.15.10
github.com/openziti/sdk-golang v0.15.12
github.com/pborman/uuid v1.2.0
github.com/pkg/errors v0.9.1
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0
go.sum
+5 -8
View File
@@ -520,16 +520,13 @@ github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
github.com/openziti/edge v0.17.52 h1:Qd6hgnp0NDyX0b0p1vSvfjZmEgRR2wL2tHg/5giSLRg=
github.com/openziti/edge v0.17.52/go.mod h1:rqHyScpW5UQZRRVEKKVGWgXCfdoLndtPhcsc4cYJrmA=
github.com/openziti/fabric v0.15.13 h1:GgS4Sbce6ubkDUtO2oPQFEzh5S9EiAjtMs50NJbuAvo=
github.com/openziti/fabric v0.15.13/go.mod h1:B8NeRzN+eIdo2Q4JUCbP0covC5SYqerrxwJsBgCU+A8=
github.com/openziti/foundation v0.15.8 h1:BFKDBkgsuXWgCtU7TS3eBPz2gceA057gK6W6IiyUQfM=
github.com/openziti/foundation v0.15.8/go.mod h1:34ifQ24R2EUNjakzZBKY1M4EvnOWeIYJOrJxRGdRNh4=
github.com/openziti/edge v0.17.53 h1:LJ2G6x/M+ZG+89yBHLdnKumXmkMIwnl+4LX53Bteb6g=
github.com/openziti/edge v0.17.53/go.mod h1:irZJtq0WjOr/kNm35SZQopCxN7EenQsHctFXLxSAZ/U=
github.com/openziti/foundation v0.15.9 h1:Do/wohULRt+3H6mlB8SZmIUl/mbxUuN7/Lf7nbz6ZRo=
github.com/openziti/foundation v0.15.9/go.mod h1:34ifQ24R2EUNjakzZBKY1M4EvnOWeIYJOrJxRGdRNh4=
github.com/openziti/sdk-golang v0.15.10 h1:iwYTmBsEOBxcQlXuwSSBQLipUyT4QuRDFYXkf6zjyYs=
github.com/openziti/sdk-golang v0.15.10/go.mod h1:ZC5Tke4NFsRH3qcZnc9X51hGjpXlq0aOCcadgxnICYI=
github.com/openziti/sdk-golang v0.15.11/go.mod h1:L1UbvXUV7DV6a3pd50CAJqtt9z6nN53p2cKNJlHZXR8=
github.com/openziti/sdk-golang v0.15.12 h1:RDkqznApxSzbftAHsf99fHwSBdSAEKV21TgemjqYKA0=
github.com/openziti/sdk-golang v0.15.12/go.mod h1:L1UbvXUV7DV6a3pd50CAJqtt9z6nN53p2cKNJlHZXR8=
github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6 h1:lNCW6THrCKBiJBpz8kbVGjC7MgdCGKwuvBgc7LoD6sw=
github.com/orcaman/concurrent-map v0.0.0-20190826125027-8c72a8bb44f6/go.mod h1:Lu3tH6HLW3feq74c2GC+jIMS/K2CFcDWnWD9XkenwhI=
github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=