Skip to content

Commit 17301f6

Browse files
authored
Merge pull request #18 from Keyfactor/release-v1.1
Merge v1.1.2 to main
2 parents b0530af + e40a700 commit 17301f6

File tree

9 files changed

+139
-29
lines changed

9 files changed

+139
-29
lines changed

.github/config/variables.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,13 @@ variable "keyfactor_client_secret_12_3_0" {
2727
variable "keyfactor_hostname_12_3_0_KC" {
2828
description = "The hostname of the Keyfactor instance"
2929
type = string
30-
default = "int-oidc-lab.eastus2.cloudapp.azure.com"
30+
default = "int1230-oauth.eastus2.cloudapp.azure.com"
31+
3132
}
3233

3334
variable "keyfactor_auth_token_url_12_3_0_KC" {
3435
description = "The hostname of the KeyCloak instance to authenticate to for a Keyfactor Command access token"
3536
type = string
36-
default = "https://int-oidc-lab.eastus2.cloudapp.azure.com:8444/realms/Keyfactor/protocol/openid-connect/token"
37+
default = "https://int1230-oauth.eastus2.cloudapp.azure.com:8444/realms/Keyfactor/protocol/openid-connect/token"
3738
}
3839

CHANGELOG.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
# v1.1.1
2+
3+
## Bug fixes
4+
- `oauth2` client now correctly sets the `scopes` and `audience` fields when invoked with explicit values.
5+
- `core` when passing a string for CA certificate check if `.TLSClientConfig.RootCAs` is nil and create a new `CertPool` if it is.
6+
7+
## Chores
8+
- Update `stretchr/testify` to `v1.10.0`
9+
- Update `AzureAD/microsoft-authentication-library-for-go` to `v1.3.2`
10+
- Update `x/crypto` to `v0.30.0`
11+
- Update `x/net` to `v0.32.0`
12+
- Update `x/sys` to `v0.28.0`
13+
- Update `x/text` to `v0.21.0`
14+
115
# v1.1.0
216

317
## Features

auth_providers/auth_core.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,9 @@ func (c *CommandAuthConfig) BuildTransport() (*http.Transport, error) {
322322
return &output, fmt.Errorf("failed to append custom CA cert to pool")
323323
}
324324
} else {
325+
if output.TLSClientConfig.RootCAs == nil {
326+
output.TLSClientConfig.RootCAs = x509.NewCertPool()
327+
}
325328
// Append your custom cert to the pool
326329
if ok := output.TLSClientConfig.RootCAs.AppendCertsFromPEM([]byte(c.CommandCACert)); !ok {
327330
return &output, fmt.Errorf("failed to append custom CA cert to pool")

auth_providers/auth_oauth.go

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -220,12 +220,6 @@ func (b *CommandConfigOauth) GetHttpClient() (*http.Client, error) {
220220
b.Scopes = DefaultScopes
221221
}
222222

223-
if b.Audience != "" {
224-
config.EndpointParams = map[string][]string{
225-
"Audience": {b.Audience},
226-
}
227-
}
228-
229223
ctx := context.WithValue(context.Background(), oauth2.HTTPClient, &http.Client{Transport: baseTransport})
230224
tokenSource := config.TokenSource(ctx)
231225

auth_providers/auth_oauth_test.go

Lines changed: 97 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,13 @@
1515
package auth_providers_test
1616

1717
import (
18+
"crypto/tls"
19+
"encoding/pem"
1820
"fmt"
1921
"net/http"
22+
"net/url"
2023
"os"
24+
"path/filepath"
2125
"strings"
2226
"testing"
2327

@@ -107,7 +111,19 @@ func TestCommandConfigOauth_Authenticate(t *testing.T) {
107111
t.FailNow()
108112
}
109113

110-
caCertPath := "../lib/certs/int-oidc-lab.eastus2.cloudapp.azure.com.crt"
114+
hostName := os.Getenv(auth_providers.EnvKeyfactorHostName)
115+
caCertPath := fmt.Sprintf("../lib/certs/%s.crt", hostName)
116+
// check if the caCertPath exists and if not then reach out to host to get the cert and save it to the path
117+
if _, err := os.Stat(caCertPath); os.IsNotExist(err) {
118+
// get the cert from the host
119+
dErr := DownloadCertificate(hostName, caCertPath)
120+
if dErr != nil {
121+
t.Errorf("unable to download certificate from %s: %v", hostName, dErr)
122+
t.FailNow()
123+
}
124+
125+
// save the cert to the
126+
}
111127

112128
//Delete the config file
113129
t.Logf("Deleting config file: %s", configFilePath)
@@ -434,3 +450,83 @@ func unsetOAuthEnvVariables() {
434450
//os.Unsetenv(auth_providers.EnvKeyfactorDomain)
435451

436452
}
453+
454+
// DownloadCertificate fetches the SSL certificate chain from the given URL or hostname
455+
// while ignoring SSL verification and saves it to a file named "<hostname>.crt".
456+
func DownloadCertificate(input string, outputPath string) error {
457+
// Ensure the input has a scheme; default to "https://"
458+
if !strings.HasPrefix(input, "http://") && !strings.HasPrefix(input, "https://") {
459+
input = "https://" + input
460+
}
461+
462+
// Parse the URL
463+
parsedURL, err := url.Parse(input)
464+
if err != nil {
465+
return fmt.Errorf("invalid URL: %v", err)
466+
}
467+
468+
hostname := parsedURL.Hostname()
469+
if hostname == "" {
470+
return fmt.Errorf("could not determine hostname from URL: %s", input)
471+
}
472+
473+
// Set default output path to current working directory if none is provided
474+
if outputPath == "" {
475+
cwd, err := os.Getwd()
476+
if err != nil {
477+
return fmt.Errorf("failed to get current working directory: %v", err)
478+
}
479+
outputPath = cwd
480+
}
481+
482+
// Ensure the output directory exists
483+
if err := os.MkdirAll(outputPath, os.ModePerm); err != nil {
484+
return fmt.Errorf("failed to create output directory: %v", err)
485+
}
486+
487+
// Create the output file
488+
outputFile := filepath.Join(outputPath, fmt.Sprintf("%s.crt", hostname))
489+
file, err := os.Create(outputFile)
490+
if err != nil {
491+
return fmt.Errorf("failed to create file %s: %v", outputFile, err)
492+
}
493+
defer file.Close()
494+
495+
// Create an HTTP client that ignores SSL verification
496+
httpClient := &http.Client{
497+
Transport: &http.Transport{
498+
TLSClientConfig: &tls.Config{
499+
InsecureSkipVerify: true, // Ignore SSL certificate verification
500+
},
501+
},
502+
}
503+
504+
// Send an HTTP GET request to the server
505+
resp, err := httpClient.Get(input)
506+
if err != nil {
507+
return fmt.Errorf("failed to connect to %s: %v", input, err)
508+
}
509+
defer resp.Body.Close()
510+
511+
// Get the TLS connection state from the response
512+
tlsConnState := resp.TLS
513+
if tlsConnState == nil {
514+
return fmt.Errorf("no TLS connection state found")
515+
}
516+
517+
// Write the entire certificate chain to the output file in PEM format
518+
for _, cert := range tlsConnState.PeerCertificates {
519+
err = pem.Encode(
520+
file, &pem.Block{
521+
Type: "CERTIFICATE",
522+
Bytes: cert.Raw,
523+
},
524+
)
525+
if err != nil {
526+
return fmt.Errorf("failed to write certificate to file: %v", err)
527+
}
528+
}
529+
530+
fmt.Printf("Certificate chain saved to: %s\n", outputFile)
531+
return nil
532+
}

auth_providers/command_config.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -314,6 +314,8 @@ func (s *Server) GetOAuthClientConfig() (*CommandConfigOauth, error) {
314314
WithClientSecret(s.ClientSecret).
315315
WithAccessToken(s.AccessToken).
316316
WithTokenUrl(s.OAuthTokenUrl).
317+
WithScopes(s.Scopes).
318+
WithAudience(s.Audience).
317319
Build()
318320

319321
vErr := oauthConfig.ValidateAuthConfig()

go.mod

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ go 1.22
1919
require (
2020
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.0
2121
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.3.0
22-
github.com/stretchr/testify v1.9.0
22+
github.com/stretchr/testify v1.10.0
2323
golang.org/x/oauth2 v0.24.0
2424
gopkg.in/yaml.v2 v2.4.0
2525
)
@@ -28,16 +28,16 @@ require (
2828
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0 // indirect
2929
github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
3030
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 // indirect
31-
github.com/AzureAD/microsoft-authentication-library-for-go v1.3.1 // indirect
31+
github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 // indirect
3232
github.com/davecgh/go-spew v1.1.1 // indirect
3333
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
3434
github.com/google/uuid v1.6.0 // indirect
3535
github.com/kylelemons/godebug v1.1.0 // indirect
3636
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
3737
github.com/pmezard/go-difflib v1.0.0 // indirect
38-
golang.org/x/crypto v0.28.0 // indirect
39-
golang.org/x/net v0.30.0 // indirect
40-
golang.org/x/sys v0.26.0 // indirect
41-
golang.org/x/text v0.19.0 // indirect
38+
golang.org/x/crypto v0.30.0 // indirect
39+
golang.org/x/net v0.32.0 // indirect
40+
golang.org/x/sys v0.28.0 // indirect
41+
golang.org/x/text v0.21.0 // indirect
4242
gopkg.in/yaml.v3 v3.0.1 // indirect
4343
)

go.sum

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0 h1:eXnN9
1212
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.0/go.mod h1:XIpam8wumeZ5rVMuhdDQLMfIPDf1WO3IzrCRO3e3e3o=
1313
github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
1414
github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
15-
github.com/AzureAD/microsoft-authentication-library-for-go v1.3.1 h1:gUDtaZk8heteyfdmv+pcfHvhR9llnh7c7GMwZ8RVG04=
16-
github.com/AzureAD/microsoft-authentication-library-for-go v1.3.1/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
15+
github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2 h1:kYRSnvJju5gYVyhkij+RTJ/VR6QIUaCfWeaFm2ycsjQ=
16+
github.com/AzureAD/microsoft-authentication-library-for-go v1.3.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
1717
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
1818
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
1919
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -42,19 +42,19 @@ github.com/redis/go-redis/v9 v9.6.1 h1:HHDteefn6ZkTtY5fGUE8tj8uy85AHk6zP7CpzIAM0
4242
github.com/redis/go-redis/v9 v9.6.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA=
4343
github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
4444
github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
45-
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
46-
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
47-
golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
48-
golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
49-
golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
50-
golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
45+
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
46+
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
47+
golang.org/x/crypto v0.30.0 h1:RwoQn3GkWiMkzlX562cLB7OxWvjH1L8xutO2WoJcRoY=
48+
golang.org/x/crypto v0.30.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
49+
golang.org/x/net v0.32.0 h1:ZqPmj8Kzc+Y6e0+skZsuACbx+wzMgo5MQsJh9Qd6aYI=
50+
golang.org/x/net v0.32.0/go.mod h1:CwU0IoeOlnQQWJ6ioyFrfRuomB8GKF6KbYXZVyeXNfs=
5151
golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
5252
golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
5353
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
54-
golang.org/x/sys v0.26.0 h1:KHjCJyddX0LoSTb3J+vWpupP9p0oznkqVk/IfjymZbo=
55-
golang.org/x/sys v0.26.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
56-
golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
57-
golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
54+
golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
55+
golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
56+
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
57+
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
5858
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5959
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
6060
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

tag.sh

100644100755
Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
RC_VERSION=rc.2
2-
TAG_VERSION_1=v1.0.0-$RC_VERSION
1+
RC_VERSION=rc.0
2+
TAG_VERSION_1=v1.1.2-$RC_VERSION
33
git tag -d $TAG_VERSION_1 || true
44
git tag $TAG_VERSION_1
55
git push origin $TAG_VERSION_1

0 commit comments

Comments
 (0)