10 Commits

Author SHA1 Message Date
yyefimov 1c8ee5cb88 fix(coderd): support string type for oidc response's expires_in json property (#20152)
Some versions of Azure AD return expires_in property as string. Use
json.Number to accept either integer or string and then convert to
int64.
Helpful links:

https://learn.microsoft.com/en-us/answers/questions/2337020/azure-ad-token-endpoint-returns-expires-in-as-stri

https://feedback.azure.com/d365community/idea/7772fd95-26e6-ec11-a81b-0022484ee92d
2025-10-15 17:37:37 +00:00
yyefimov 039fa89481 fix(coderd): correct the name of the unmarshall error variable (#20150)
Incorrect error variable is used during reporting of the issue during
unmarshall operations and this makes it hard to understand the
underlying reason for OIDC failure: use `unmarshalError` instead of
`err`.
2025-10-03 12:08:15 +10:00
Spike Curtis 1a41608035 fix: stop extending API key access if OIDC refresh is available (#17878)
fixes #17070

Cleans up our handling of APIKey expiration and OIDC to keep them separate concepts. For an OIDC-login APIKey, both the APIKey and OIDC link must be valid to login. If the OIDC link is expired and we have a refresh token, we will attempt to refresh.

OIDC refreshes do not have any effect on APIKey expiry.

https://github.com/coder/coder/issues/17070#issuecomment-2886183613 explains why this is the correct behavior.
2025-05-19 12:05:35 +04:00
Steven Masley d0a534e30d chore: prevent authentication of non-unique oidc subjects (#16498)
Any IdP returning an empty field here breaks the assumption of a
unique subject id. This is defined in the OIDC spec.
2025-02-10 09:31:08 -06:00
Steven Masley 50b78e3325 chore: instrument external oauth2 requests (#11519)
* chore: instrument external oauth2 requests

External requests made by oauth2 configs are now instrumented into prometheus metrics.
2024-01-10 09:13:30 -06:00
Cian Johnston 197cd935cf chore(Makefile): use linter version from dogfood Dockerfile (#11147)
* chore(Makefile): use golangci-lint version from dogfood Dockerfile

* chore(dogfood/Dockerfile): update golangci-lint to latest version

* chore(coderd): address linter complaints
2023-12-12 10:02:32 +00:00
Steven Masley d9d4d74f99 test: add full OIDC fake IDP (#9317)
* test: implement fake OIDC provider with full functionality
* Refactor existing tests
2023-08-25 14:34:07 -05:00
Kayla Washburn 697b0283c5 chore: fix low hanging lint issues (#9253) 2023-08-22 12:32:37 -06:00
Kyle Carberry 22e781eced chore: add /v2 to import module path (#9072)
* chore: add /v2 to import module path

go mod requires semantic versioning with versions greater than 1.x

This was a mechanical update by running:
```
go install github.com/marwan-at-work/mod/cmd/mod@latest
mod upgrade
```

Migrate generated files to import /v2

* Fix gen
2023-08-18 18:55:43 +00:00
Steven Masley 25ce30df36 feat: add azure oidc PKI auth instead of client secret (#9054)
* feat: add azure oidc PKI auth instead of client secret
* add client cert and key as deployment options
* Custom token refresher to handle pki auth
2023-08-14 17:33:13 -05:00