Commit Graph

18 Commits

Author SHA1 Message Date
Junhyun Shim 1afd63d7e3 Minimize the risk of TracedTooManyLines in simulation
- Disable audit logging for simulation
- Relax the max_trace_lines knob limit to reduce false positives
2023-02-06 21:50:39 +01:00
Junhyun Shim ce652fa284 Replace AuthZ's use of tenant names in token with tenant ID
Also, to minimize audit log loss, handle token usage audit logging at each usage.
This has a side-effect of making the token use log less bursty.
This also subtly changes the dedup cache policy.
Dedup time window used to be 5 seconds (default) since the start of batch-logging.
Now it's 5 seconds from the first usage since the closing of the previous dedup window
2023-02-03 21:46:31 +01:00
sfc-gh-tclinkenbeard b2222a5249 Remove rare annotations from Token code 2023-01-18 11:39:02 -08:00
Junhyun Shim 36b4569a08 Merge remote-tracking branch 'origin/main' into mako-authz-token-generation 2022-12-07 08:49:20 +01:00
sfc-gh-tclinkenbeard 994fd4aa41 Remove rare annotation from some code probes 2022-12-01 09:59:08 -08:00
Junhyun Shim a4157e0c51 Expose TokenSign as a public library to be used by Mako 2022-11-21 14:33:45 +01:00
Junhyun Shim 41ea1678d0 Merge remote-tracking branch 'origin/main' into authz-accept-base64-for-jwt-tenant-name 2022-11-15 22:57:49 +01:00
sfc-gh-tclinkenbeard c03f60c618 Update rare code probe annotations 2022-11-15 13:21:25 -08:00
Junhyun Shim 50f4021cf7 Make token's 'tenants' field base64-encoded (cf. base64url)
- Remove redundant operation from TokenSign
- Let the sign/verify API directly report errors
  instead of tracing at failing subroutine, which lacks context
2022-11-04 20:17:08 +01:00
Markus Pilman 0eeecdcc79
Apply suggestions from code review
Co-authored-by: Junhyun Shim <junhyun.shim@snowflake.com>
2022-10-12 08:34:18 -06:00
Markus Pilman 5239c491c4 Audit all AuthZ token usages 2022-10-11 14:34:10 -06:00
Junhyun Shim 727e000b2a Apply clang format 2022-09-09 15:31:29 +02:00
Junhyun Shim 89800dbb03 Cover TokenCache code probes unhit by unit test
* Token with invalid signature
* Valid token doesn't reference tenant
2022-09-09 15:30:07 +02:00
Junhyun Shim b4e428fa33 Address review comments
- Revert JWT timestamp from double back to uint64_t
- Describe in comment the need for wait loop at the beginning of watchPublicKeyJwksFile()
- Revert CLI args definition in fdbserver.actor.cpp that was
  incorrectly tabbed with a bad clang-format run
2022-08-29 12:49:03 +02:00
Junhyun Shim 62f8f01ed8 Fix token parser only allowing uint64 2022-08-17 20:23:51 +02:00
Junhyun Shim d3befe62d8 Make issued-at field mandatory at token verification 2022-08-17 17:33:50 +02:00
A.J. Beamon 5a071e1b19 Fix bug in token cache unit test where the expiration time was underflowing. 2022-07-30 14:22:24 -07:00
Markus Pilman b600966cf9 fix token cache unit test 2022-07-29 12:47:55 -06:00