fb2034245d
fixes openziti/ziti#3356 adds www-authenticate headers ( #3561 )
...
* fixes openziti/ziti#3356 adds www-authenticate headers
- www-authenticate headers are returned on 401s from API requests
- www-authenticate headers are returned during authentication to signal
addtional JWT bearer tokens needed (secondary ext jwt)
- adds support for additional headers on API errors
- adds SecurityTokenCtx for centralized security header processing
(legacy, jwt, etc.)
- adds SecurityCtx for centralized identity, auth policy, MFA handling
- refactors existing JWT authentication methods (oidc, legacy) to use
centralized processing where possible
2026-02-24 10:01:36 -05:00
90112219a3
Support multi-underlay control channels. Fixes #3550
2026-02-11 14:20:29 -05:00
45bf527441
Provide more error context to SDKs for terminator errors. Fixes #3524
2026-02-04 14:36:21 -05:00
da9ef76d19
Optimize imports
2026-01-28 15:01:35 -05:00
2ffc6e1151
Update ziti version to 2.0
2026-01-28 12:34:10 -05:00
284a08b1af
Remove support for create terminator v1. Fixes #3516
2026-01-26 10:25:39 -05:00
25dda7f994
adds error response for token update if API Session IDs do not match ( #3440 )
...
fixes #3437 adds error response for token update if API Session IDs do not match
- updates all token updates to add structured errors
- added an upfront API Session ID check on token updates in order to
provide an error
adds fix for #3444 ensure api session types are checked to avoid nil ref
Identities may have mixed authentication modes if the credentials are
being shared. While not recommended, it is possible. This can cause
situations where API Session are not of a uniform type. During token
updates for OIDC, legacy API Sessions must be ignored.
- ignores legacy API Sessions during token update for a specific
identity
- adds error messages for unlikely scenarios that indicate systemic
failures
2025-12-16 09:26:46 -05:00
ffe6e16b76
Separate raft command submission limiting from in-flight limiting. Fix some create terminator error handling. Fixes #3318
2025-12-03 17:01:28 -05:00
d02d25c031
fix openziti/ziti#3354 sdk/env details not distributed ( #3394 )
...
* fix openziti/ziti#3354 sdk/env details not distributed
2025-11-26 10:54:10 -05:00
8bedd3af1d
Clean up connect events tests and remove global XG registry. Fixes #3345
2025-10-29 14:46:52 -04:00
bb5cc51a97
adds posture cache, instance, instance data, and event hooks ( #3267 )
...
* adds posture cache, instance, instance data, and event hooks
- reworks router security
- abstracts api session and service sessions
- use connection tracker instead of various maps
- doc
- adds service sessions as always JWTs
- addes token logging fields
- removes multiple connection tracking fields
- adds support for router specific posture data/respones
- adds support for router posture check evaluation
- defer dial/bind posture checking for legacy to controller
- fix double session event emitting
- fix session event missing id
2025-10-15 14:01:56 -04:00
423dff3d92
fix #3236 SDK/ENV info is not saved on OIDC auth ( #3137 )
2025-08-05 09:51:00 -04:00
10f4ad046d
Fix race condition on terminator create
2025-07-23 15:00:25 -04:00
5902631861
ids used by circuits and ingress/egress can conflict in an HA setup. Fixes #3124
2025-06-18 11:24:16 -04:00
981df8269d
Support xgress flow control from the SDK. Fixes #2986
2025-04-30 10:27:43 -04:00
0e61edb2f9
fix #2984 identity/router enrollment do not return full chains ( #2990 )
...
* fix #2984 identity/router enrollment do not return full chains
- router extend via REST/ctrl now return full chains
- identity extend via REST now return full chains
- updates tests to allow for chain lengths
- modifies verification to look at the first cert in the chain (leaf)
- modifies edge routers to not start extension if new certs can't be
saved
- adds network-jwt tests
2025-04-11 11:27:57 -04:00
e647d67325
Update to channel/v4
2025-04-02 15:28:59 -04:00
78605a0955
fix #2865 remove fingerprint checks from controller ( #2866 )
...
* fix #2865 remove fingerprint checks from controller
- on their own fingerpint checking does not provide any additional
security as the underlying certificate is not verified
- fingerprint based checking will not work with spiffeid generated
certificates or x509 claims
- routers still support sending fingerprints for old controller support
2025-03-04 10:21:38 -05:00
ec57c80ff7
ER/T Hosting HA chaos test and fixes ( #2806 )
...
* Add ERT hosting chaos test. Also add ert terminator validation utility. Fixes #2288
* Rework ER/T terminator management based on SDK terminator management code
* Update deps
* Make sdk/ert-terminators into a constant
2025-02-25 17:02:21 -05:00
3c9861ca3b
Update deps and changelog. Update for SDK changes
2025-02-10 15:35:17 -05:00
d84292cfd9
Fix tests
2025-01-07 19:22:47 -05:00
6517a7c22f
Move routers to a subscription model where they subcribe to model data from one controller for a limited time. Fixes #2599
2025-01-07 19:21:53 -05:00
32eddd61ca
HA SDK terminators test. Fixes #2217 . Fixes #2533
2024-11-12 18:45:08 -05:00
16f0a858e6
Add controller connect events. Fixes #1835 . Fixes #2234
2024-11-01 15:21:01 -04:00
cccf0c06af
Update to channel/v3. Fixes #2390
2024-09-09 12:23:25 -04:00
0945427320
Migrated edge router tunneler code to use the router data model. Fixes #2121
2024-07-26 17:06:01 -04:00
c3b43133d1
Merge fabric and controller model code. Fixes #2205
2024-07-09 16:11:01 -04:00
a0245e5cd3
Allow ER/T to intercept services w/out sessions when in HA mode. Fixes #1942
2024-04-16 15:11:00 -04:00
36ced919ae
Merge branch 'main' into ha-staging
2024-03-14 08:38:57 -04:00
fab81e4cd4
Add terminator chaos testing and fix issues found. Fixes #1794 Fixes #1369
2024-03-12 10:31:36 -04:00
09542c7728
consolidated ha changes
2024-02-29 09:27:56 -05:00
935c89bb7d
fixes 1354 adds hostname/domain to env info
2024-02-22 14:32:00 -05:00
744ae68bbd
Fix controller crash. Fixes #1736
2024-02-08 21:55:48 -05:00
3aace85a97
Refactor terminator state machine to be more like links state machine. Fixes #1733 Fixes #1734
2024-02-08 21:55:48 -05:00
26c6263fa3
Fix terminator id race condition. Fixes #1685
2024-01-19 11:31:32 -05:00
a84369a6e9
Consolidate fabric and edge persistence code. Fixes #1555
2023-12-06 17:36:37 -05:00
db6554ee06
Implement idempotency for sdk terminators. Fixes #1446
2023-12-01 15:44:05 -05:00
b270d18faf
Add additional logging. Remove unnecessary router lookups. May address #1460
2023-10-31 14:57:06 -04:00
3523b34b2c
Fix panic when router version info isn't set by ensuring it is set and making sure we get the right version. Fixes #1423
2023-10-11 13:55:50 -04:00
096f53d090
Merge remote-tracking branch 'origin/release-next' into merge-fabric
2023-09-30 12:26:10 -04:00
064ae0df52
Second pass at edge terminator fixes
2023-09-29 10:57:43 -04:00
f3d67b7f49
Update fabric imports
2023-09-28 23:34:28 -04:00
b12f1d33f5
Add CreateTerminatorV2 flow for edge terminators. Fixes #1619
2023-09-27 17:32:44 -04:00
07da3cd513
Merge remote-tracking branch 'edge/main' into merge-edge
...
Updated package names
Merged golangci-lint configurations
2023-09-27 16:54:53 -04:00
74006eeb9d
Don't update identity if it hasn't changed. Fix change attribution for edge client updates. Fixes #1610 . Fixes #1611
2023-09-13 11:42:35 -04:00
8a4ff813b1
Put api session into tunnel state after looking up from cache. Fixes #1597
2023-08-30 17:14:29 -04:00
5b59ae13ee
Update for moved packages in fabric
2023-08-23 09:40:05 -04:00
0c84601cd0
Update for link management changes
2023-08-09 10:20:58 -04:00
b061fe9a39
Move internal/certs to common. Remove some incidental files that weren't used.
2023-08-07 10:20:06 -04:00
dba0fb6f7c
Move protobufs to common
2023-08-04 17:01:15 -04:00
Andrew Martinez