Endpoints such as /current-identity/edge-routers would internally use a
ListAssociations(...) that would not respect the original query
parameters of limit/offset. Instead they would only respect the filter
parameter.
Per internal conversations, we agreed to maintain both paths.
- allow timeouts for MFA posture checks
- allow wake/unlocked MFA options
- allow legacy toggle for SDKs that don't supply endpoint state
- supply timeouts on posture checks
- posture data now caches session state
- NULL output for empty arrays will now be empty array "[]"
- patching no longer clears osType
- patching with the same path between two different OS types no longer
collides resulting in 1 process being saved
- now reports all versions, api bindings, and api bind points from xweb
- now reports api base urls (http://<bindpoint>/<api path>
- now points 'edge' to 'edge-client' api binding
- splits Open API 2.0 (swagger) into client/management APIs
- uses go-swaggers flatten capabilities
- uses newer version of go-swagger (v0.27.0)
- introduces /edge/client/v1, /edge/management/v1
- non-prefixed URLs default to /edge/client/v1
- splits some shared management/client API handlers
- renames some REST models to "client" instead of "limited"
- passes all apitests, fails dataflow upd test (main fails this as well)
- updates generate rest script for powershell
- todo: test generate rest script for bash
- todo: use xweb (different branch)
- adds a new posture check for dealing with multiple processes
- supports anyOf and allOf semantics
- does not require new posture responses, current process responses
suffice
- tests
- routers can now opt to extend their enrollment at any time with a
previous or new key
- adds tests for router enrollment
- adds tests for router enrollment extension
- update api session session state on mfa enroll
- update posture data state on mfa enroll
- centralize setting mfa posture data
- pass isMfaRequired and isMfaComplete in apiSession/currentApiSession
- GET /identity/{id}/posture-data is now formalized in the swagger.yml
- posture data output now includes the last 100 failed service requests
with temporal posture data state
- added ziti controller instance id header to detect restarts
- add GET /identity/{id}/failed-service-requests
- as updates to API Sessions can now happen later than the last time
they were active, updatedAt is no longer the correct representation of
the last activity an API Session had
- move all logic that used updatedAt to lastActivityAt
- add migration to set lastActivityAt
Router state used to be stored and accessed in a thread unsafe way.
State is now locks on a mutex for setting values and values are copied
out for referencing.
- swagger copy pasta was using the same parameter name for everything,
"body", which made error messages read "error in body for body"
- parameter rename ripples into parameter property definitions
- allow mfa codes in GET and DELETe as libuv doesn't allow them to have
bodies (-.-)
hostnames may be a nil pointer at times now due to the fact that edge
routers may be waiting to sync and may be "online" but edge hellos
have not been exchanged.
- edge router sync is now modular and can have different strategies
- plans to make this configurabe in the future with multiple strat
- legacy strategy is called "instant" and is the only option
- instant strat now supports control signaling and resync requests
- edge routers now do not remove connections till after a full sync
- added the ability for the controller to report the er sync status
- added er syn status to GET /edge-routers list and detail
- improved log output in sync logic
Paul Lorenz