- the debug field bound the Code method left behind by the AppCode rename, rendering a function
value and failing to marshal under the JSON formatter; it now logs AppCode
- resolves zt-session tokens eagerly when the request context is created, so every request carrying one marks activity and gets session lifetime headers, regardless of endpoint
- marks last activity in SecurityCtx.resolveZtSession once the session is loaded
- adds SecurityTokenCtx.HasZtSessionHeader, a header-only check that does not parse bearer tokens
- emits only session lifetime headers from the API wrappers and drops the unused session-error header branch, so a stale token on an anonymous endpoint stays silent as it did on 1.6.x
- tests that requests to authenticated and anonymous endpoints with a zt-session mark activity, carry lifetime headers, and are reflected by current-api-session
* fixesopenziti/ziti#3356 adds www-authenticate headers
- www-authenticate headers are returned on 401s from API requests
- www-authenticate headers are returned during authentication to signal
addtional JWT bearer tokens needed (secondary ext jwt)
- adds support for additional headers on API errors
- adds SecurityTokenCtx for centralized security header processing
(legacy, jwt, etc.)
- adds SecurityCtx for centralized identity, auth policy, MFA handling
- refactors existing JWT authentication methods (oidc, legacy) to use
centralized processing where possible
- fixes 500 internal error on MFA enrllment in HA deployments
- fixes HA API Session Certs not working in HA
- adds spiffehlp module to common
- adds tests api session certs w/ spiffe id
- adds tests for SPIFFE IDs in API Session Certs
- adds tests for ext jwt + cert auth
- adds support for trust domain lookup on x509 chain
- adds support for non-ha trustDomain configuration
- adds default generated trust domain for non-ha controllers
- non-HA controllers will generate a trust domain from the root CA if
possible
- additionalTrustDomains has been added for transitioning between trust
domains
update changelog.md
- endpoint url/path -> name remains the same
- start timing on request context before we start processing
- log metrics in IsAllowed which is called by all endpoint after routing
- logging before routing to a handler would log all probe attacks
- add server headers during HTTP handler delegation rather than at HTTP
response time
- remove all old header setting locations
- remove unused status writer and other response code
- add manual set on authentication for session headers
- http requests should hard timeout w/ a reasonable response
- edge routers should close when an API session token is not provided or
does not match
- stream both types of sessions on edge router connect
- stream sessions for time out processing/deletion
- add id to session messages (edge control pb update, breaks backwards
compat)
- text producer is now pem producer only
- remove ability to render errors in pem producer
- update tests
- fix accept header processing for multiple accepts in one header
- remove old JSON schema, unsused code
- remove unused variables from base router functions
- rework all API entities
- rework all links
- fix lint issues
- adds error conversion logic
- update tests as needed
- fix up go test
- fix backwards compat w/ non json enroller
- allows fabric routers to be created in an unenrolled state
- allows fabric routers to be CRUD
- converts both edge and transit routers to use the same enrollment
facilities as identities (1st step to merge)
- migrations for enrollment changes
- adds ability to extend a base store
- add external cleanup logic to tx router to handle isbase=true
- use router handler for is connected status
* Add versioning and tagging
* Update for build info generation
* Return config ids as well as raw config
* Return [] not null for empty service configs list
* Try to fix body parse error issue
* Update fabric and foundation and sdk
Paul Lorenz