This commit adds an option to disable access log for health endpoints.
This is especially helpful in environments like Kubernetes, where
special preprocessing filters would be required otherwise.
Closes#1278
Previously, user and client were sent as path parameters on consent and
login lifecycle endpoints. This patch uses query parameters instead.
This allows developers to use users with slashes and dots without
causing issues with the URI path.
Signed-off-by: aeneasr <aeneas@ory.sh>
This patch enables developers to whitelist insecure redirect URLs while using flag `--dangerous-force-http`.
Closes#1021
Signed-off-by: aeneasr <aeneas@ory.sh>
This patch significantly refactors internal configuration and service management with the goal of making configuration changes possible without service restarts. This patch prepares the possibility to configure ORY Hydra from a remote source (etcd, consul) and watch for changes. This patch also introduces the possibility to configure ORY Hydra from a configuration file on top of environment variables.
The following issues have been fixed as well:
- Key rotation of the system secret is now much simpler (closes#1316)
- Database connectivity parameters such as max_conns no longer cause issues with older postgres versions (closes#1327)
- Non-existing routes now return a JSON error instead of `text/plain` when `application/json` was requested (clsoes #1244)
- We now push tags latest, X, X.Y, X.Y.Z to docker hub (closes#1289)
- The quickstart guide no longer builds the source code but instead pulls latest tag (closes#1309)
- We moved to goreleaser and godownloader for release management (closes#1107)
- The quickstart Docker Compose files are now reusable (closes#1196)
The following issues are also resolved:
- Closes#1121
Signed-off-by: aeneasr <aeneas@ory.sh>
We should not reject insecure requests coming in via unix socket as
there is no TLS support anyways.
Signed-off-by: Janis Meybohm <meybohm@traum-ferienwohnungen.de>
This allows the use of strings like "unix:/path/to/socket" as PUBLIC_HOST and/or PRIVATE_HOST.
Signed-off-by: Janis Meybohm <meybohm@traum-ferienwohnungen.de>
This is needed for external health checks (from loadbalancing
infrastructure for example) and black box monitoring.
Signed-off-by: Janis Meybohm <meybohm@traum-ferienwohnungen.de>
Field `allowed_cors_origins` was added to OAuth 2.0 Clients. It enables
CORS for the whitelisted URLS for paths which clients interact with,
such as /oauth2/token.
Closes#975
Signed-off-by: arekkas <aeneas@ory.am>
This patch introduces two ports, public and administrative. The public
port is responsible for handling API requests to public endpoints such
as /oauth2/auth, while the administrative port handles requests to
JWK, OAuth 2.0 Client, and Login & Consent endpoints.
Closes#904
Signed-off-by: arekkas <aeneas@ory.am>
This patch deprecates the `hydra connect` command as internal
access control has been removed from ORY Hydra and this command
no longer serves any purpose.
Instead, all commands are supplied with environment variables `HYDRA_URL`,
`OAUTH2_CLIENT_ID`, `OAUTH2_CLIENT_SECRET`, `OAUTH2_ACCESS_TOKEN`.
Please check out `hydra help <command>` for usage instructions. You
should also check out the upgrade guide for more detailed upgrade instructions.
This patch also renames some flags and command names which have been
documented in the upgrade guide.
Closes#841Closes#840
This patch makes significant changes to the consent flow. First,
the consent flow is being renamed to "User Login and Consent Flow"
and is split into two redirection flows, the "User Login Redirection Flow"
and the "User Consent Flow".
Conceptually, not a lot has changed but the APIs have been cleaned up
and the new flow is a huge step towards OpenID Connect Certification.
Besides easier implementation on the (previously known as) consent app,
this patch introduces a new set of features which lets ORY Hydra
detect previous logins and previously accepted consent requests. In turn,
the user does not need to login or consent on every OAuth2 Authorize Code
Flow.
This patch additionally lays the foundation for revoking tokens per
user or per user and client.
Awesome.
Closes#771Closes#772
We have learned a lot over the last year in terms of how ORY Hydra is being used. Initially, we wanted to avoid the problems facing popular databases like MongoDB or others, which did not include authentication for their management APIs.
For this reason, the Warden API was born and primarily used internally and exposed via HTTP. We learned that access control policies are well received, but also add additional complexity to understanding the software. While we firmly believe that these policies implement best practices for access control in complex systems, we do understand that they add a barrier to getting started with ORY Hydra.
For this reason we are planning on moving the Warden API from this project to ORY Oathkeeper or potentially it's own server. We would add a migration path for existing policy definitions to the new service. The default docker image would combine the services in such a way, that ORY Hydra is protected. We would additionally have an (insecure) docker image without authentication which can be used for testing.
This also opens up the possibility of having more access control mechanisms than access control policies. For example, we can add ACL and RBAC and other mechanisms too.
First I think it makes good sense to move this functionality into a separate service and remove the warden calls internally completely. The reason being that not everyone wants to rely on Hydra's access control. Sometimes it's enough to use a gateway in front and require e.g. an API key for management or whatever. New adopters are always baffled by complexity involved with policies and scopes. Removing that from the core could really help. The user survey has also shown that this stuff is quite complex to grasp.
The idea is to have a separate service which is basically ladon as a HTTP API. I think it makes sense to add some functionality to resolve access tokens so it would basically be very similar to the current warden API - probably even equal. There would definitely be some backup mode where hydra's database tables and migrations are used as to make migration as easy as possible.
Then, we would ship docker images and example set ups where different configurations are shown. One of the configurations would be the current one, so basically what we have now in hydra but with the three services combined in one image.
Closes#807
Tests would fail because the config file is polled in order to check
if the server is already started or not. Moving the persist command
right before starting the server resolves issues with racy tests.
Previously, JSON Web Keys did not have to specify a unique id. JWKs
generated by ORY Hydra typically only used `public` or `private`
as KeyID. This patch changes that and appends a unique id if no
KeyID was given. To be able to separate between public and private key
pairs in resource name, the public/private convention was kept.
This change targets specifically the OpenID Connect ID Token and HTTP
TLS keys. The ID Token key was previously "hydra.openid.id-token:public"
and "hydra.openid.id-token:private" which now changed to something like
"hydra.openid.id-token:public:9a458aa3-65a0-4982-835f-343eec45183c" and
"hydra.openid.id-token:private:fa353995-d77d-420a-b967-63bf0721271b"
with the UUID part being random for every installation.
This change will help greatly with key rotation in the future.
Closes#589
In order to support running Hydra with a different path prefix behind
a proxy, issue a challenge token with an issuer-prefixed auth redirect
URL instead of the URL received with the auth request.
Signed-off-by: Wyatt Anderson <wanderson@gmail.com>
* oauth2: scopes should be separated by %20 and not +, to ensure javascript compatibility - closes#277
* oauth2/introspect: make endpoint rfc7662 compatible - closes#289
* warden: make it clear that ladon.Request.Subject is not required or break bc and remove it - closes#270
* travis: execute gox build only when new commit is a new tag - closes#285
* docs: improve introduction (#267)
* core: (health) monitoring endpoint - closes#216
* oauth2/introspect: make endpoint rfc7662 compatible - closes#289
* connections: remove connections API - closes#265
* oauth2: token revocation endpoint - closes#233
* vendor: update to fosite 0.5.0
* core: add sql support #292
* connections: remove connections API - closes#265
* all: coverage report is missing covered lines of nested packages - closes#296
* cmd: prettify the `hydra token user` output - closes#281
* travis: make it possible for travis-ci to build forked repos - closes#295
sawadashota
Igor Zibarev
aeneasr
hackerman
Sawada Shota
jayme-github
Julian Tescher
JiaLiPassion
Amir Aslaminejad
Amir Aslaminejad
Prateek Malhotra
hackerman
arekkas
Dmitry Dolbik
aeneasr
Wyatt Anderson
fazal