* fixesopenziti/ziti#4094 accept first-party certs issued by a separate edge signing CA
- adds FirstPartyX509CertValidation and ThirdPartyX509CertValidation usages and an
intermediates field to the router data model public keys, deprecating
ClientX509CertValidation
- publishes config CA bundle roots as first-party anchors with their intermediates and
Ca store entries as third-party anchors; controller certs carry JWT validation only,
since a controller identity is never a CA and anchors no client cert chains
- builds router first-party and client cert trust pools from the published usages,
falling back to the deprecated usage against older controllers
- propagates the full signing cert chain between controllers via a new mesh
SigningCertChainHeader and persists whole chains in controller records
- removes the orphaned InstantStrategy.AddPublicKey, dead since public key sync moved
to controller list data
- gives each command dispatcher its own decoder registry so multiple in-process
controllers no longer decode into the last-started controller's managers
- adds a three-controller in-process HA test harness with a split signing PKI,
cluster formation and first-party cert integration tests
- trusts the edge signing CA when verifying router control channel certs
- adds a variadic additionalRoots parameter to VerifyLeafCertChain, applied to a
clone of the caller's pool so an identity's live tls.Configs are unaffected
- passes the edge enrollment signing CA bundle as additional roots when admitting
a router control channel connection, so a deployment whose signing CA sits
outside the controller's own trust bundle no longer has every router refused
- leaves the fingerprint check bound to the verified leaf, so the wider anchor set
changes which chains verify, not which routers are admitted
- covers the split-root case and the caller-pool guarantee in common/cert tests
- repoints the controller identity and enrollment signingCert to the ziti
pki generated testdata/pki tree, replacing the removed
testdata/ca/intermediate key/cert paths
- sets trustDomain to ziti.test to match the regenerated PKI
* fix#3933 add controller to enrollment response
- adds the cluster's controllers to ott, ottca, updb, and token enrollment
responses with client and OIDC API addresses only
- synthesizes the running controller with its API addresses in non-HA mode
so the list is never empty
- adds --not-before to ziti pki create for backdated test CAs
- replaces the test PKI with a SPIFFE-capable, ziti pki generated and managed
one and rewires the config sets
- tests the controller list across ott/ottca/updb/token, non-HA, and raft
* fix missing wildcard cert from new PKI
* go mod tidy
- updates openziti/xweb/v3 for actual fix
- adds Test_OidcListener_BindFailure_DoesNotPanic and the
oidc-listener-bind-failure config set, asserting the controller keeps
the other web servers running when an edge-oidc listener cannot bind
* fixes#3806 expose OpenZiti endpoints in OIDC discovery document
- adds vendor-specific "openziti_endpoints" field to the
/.well-known/openid-configuration response
- overrides Discovery() on the OIDC server to wrap the standard config
with OpenZiti login and MFA endpoint URLs
- advertises password, cert, ext-jwt, totp, totp enrollment, and
auth query endpoints as absolute URLs derived from the issuer
- adds integration test verifying all openziti_endpoints fields
- adds dual-server integration test confirming endpoint URLs reflect
the correct issuer when edge-oidc is hosted on multiple bind points
* changelog
* fixes#3597, enable OIDC by default
- adds ability to have different sets of environment configs for tests
- adds ConfigSet struct as a configuration device for integration tests
- allows entire environments to be defined as needed
- original ats config set at "default-ats"
- tests that do not specify a config set, use "default-ats" as before
- standardizes configuration location, naming, etc.
- adds README.md for the above
- updates testContext to now be config set aware
- add config value to disable, update tests, changelog
- add defense against cached version data for tests
- adds support for trust domain lookup on x509 chain
- adds support for non-ha trustDomain configuration
- adds default generated trust domain for non-ha controllers
- non-HA controllers will generate a trust domain from the root CA if
possible
- additionalTrustDomains has been added for transitioning between trust
domains
update changelog.md
* progress on controller communication
* added yaml encoding/decoding
* move dispatch callbacks to be more consistent
* update unit tests
* small cleaups
* Add new datadir to unit tests
* fix linter
* Was able to use FSM hooks to get configuration updates to show raft state
* Send index to prevent older versions from being applied and added leader override
* pr comments and added/removed ctrl connections
* added error logging
* pr comments
* spelling and bad log newlines
* added delete from the toconnect map and added end case to the background connect
* reordered removal from map
* added mtx around access. Forgot that was changed to be unsopported.
- allows fabric routers to be created in an unenrolled state
- allows fabric routers to be CRUD
- converts both edge and transit routers to use the same enrollment
facilities as identities (1st step to merge)
- migrations for enrollment changes
- adds ability to extend a base store
- add external cleanup logic to tx router to handle isbase=true
- use router handler for is connected status
Andrew Martinez