diff --git a/CHANGELOG.md b/CHANGELOG.md index 3ea19cda..52e207f4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,55 @@ # Changelog +## v0.27.2 + +### Changes + +Even though not recommended at all, it is now possible to opt-out of the `refresh_token` nbf claim, and disable it. + +By default, A `refresh_token` will not be valid before `access_token_lifetime - 60 seconds`, but some (bad) client +implementations try to refresh `access_tokens` while they are still valid for a long time. To opt-out, you get a new +config variable: + +``` +# By default, `refresh_token`s will have an `nbf` claim, making them valid +# at `access_token_lifetime - 60 seconds`. Any usage before this time will +# result in invalidation of not only the token itself, but also all other +# linked sessions and tokens for this user to prevent damage in case a client +# leaked the token by accident. +# However, there are bad / lazy client implementations that do not respect +# either `nbf` in the `refresh_token`, or the `exp` claim in `access_token` +# and will refresh early while the current access_token is still valid. +# This does not only waste resources and time, but also makes it possible +# to have multiple valid `access_token`s at the same time for the same +# session. You should only disable the `nbf` claim if you have a good +# reasons to do so. +# If disabled, the `nbf` claim will still exist, but always set to *now*. +# default: false +DISABLE_REFRESH_TOKEN_NBF=false +``` + +[#651](https://github.com/sebadob/rauthy/pull/653) + +### Bugfix + +The Rauthy deployment could get stuck in Kubernetes when you were running a HA-Cluster with Postgres as your database +of choice. The cache raft re-join had an issue sometimes because of a race condition, which needed a full restart of the +cluster. This has been fixed in [hiqlite-0.3.2](https://github.com/sebadob/hiqlite/releases/tag/v0.3.2) and the +dependency has been bumped. + +## v0.27.1 + +### Bugfix + +With the big migration to [Hiqlite](https://github.com/sebadob/hiqlite) under the hood, a bug has been introduced with +`v0.27.0` that made it possible to end up with a `NULL` value for the password policy after an update. Which would +result in errors further down the road after a restart, because the policy could not be read again. + +This version fixes the issue itself and checks at startup if the database needs a fix for this issue because of an +already existing `NULL` value. In this case, the default password policy will be inserted correctly at startup. + +[#646](https://github.com/sebadob/rauthy/pull/646) + ## v0.27.0 ### Breaking diff --git a/Cargo.lock b/Cargo.lock index dd5bc973..d8b5ebe9 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -205,7 +205,7 @@ dependencies = [ "pin-project-lite", "rustls-pki-types", "tokio", - "tokio-rustls 0.26.0", + "tokio-rustls 0.26.1", "tokio-util", "tracing", ] @@ -550,9 +550,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.93" +version = "1.0.94" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4c95c10ba0b00a02636238b814946408b1322d5ac4760326e6fb8ec956d85775" +checksum = "c1fd03a028ef38ba2276dce7e33fcd6369c158a1bca17946c4b1b701891c1ff7" [[package]] name = "arbitrary" @@ -836,7 +836,7 @@ dependencies = [ "axum-core", "bytes", "futures-util", - "http 1.1.0", + "http 1.2.0", "http-body 1.0.1", "http-body-util", "hyper 1.5.1", @@ -852,9 +852,9 @@ dependencies = [ "serde_json", "serde_path_to_error", "serde_urlencoded", - "sync_wrapper 1.0.2", + "sync_wrapper", "tokio", - "tower 0.5.1", + "tower 0.5.2", "tower-layer", "tower-service", "tracing", @@ -869,13 +869,13 @@ dependencies = [ "async-trait", "bytes", "futures-util", - "http 1.1.0", + "http 1.2.0", "http-body 1.0.1", "http-body-util", "mime", "pin-project-lite", "rustversion", - "sync_wrapper 1.0.2", + "sync_wrapper", "tower-layer", "tower-service", "tracing", @@ -893,14 +893,14 @@ dependencies = [ "cookie 0.18.1", "fastrand", "futures-util", - "http 1.1.0", + "http 1.2.0", "http-body 1.0.1", "http-body-util", "mime", "multer", "pin-project-lite", "serde", - "tower 0.5.1", + "tower 0.5.2", "tower-layer", "tower-service", ] @@ -914,17 +914,17 @@ dependencies = [ "arc-swap", "bytes", "futures-util", - "http 1.1.0", + "http 1.2.0", "http-body 1.0.1", "http-body-util", "hyper 1.5.1", "hyper-util", "pin-project-lite", - "rustls 0.23.19", + "rustls 0.23.20", "rustls-pemfile 2.2.0", "rustls-pki-types", "tokio", - "tokio-rustls 0.26.0", + "tokio-rustls 0.26.1", "tower 0.4.13", "tower-service", ] @@ -1039,9 +1039,9 @@ dependencies = [ [[package]] name = "binstring" -version = "0.1.1" +version = "0.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7e0d60973d9320722cb1206f412740e162a33b8547ea8d6be75d7cff237c7a85" +checksum = "ed79c2a8151273c70956b5e3cdfdc1ff6c1a8b9779ba59c6807d281b32ee2f86" [[package]] name = "bitflags" @@ -1284,9 +1284,9 @@ checksum = "ade8366b8bd5ba243f0a58f036cc0ca8a2f069cff1a2351ef1cac6b083e16fc0" [[package]] name = "cc" -version = "1.2.2" +version = "1.2.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f34d93e62b03caf570cccc334cbc6c2fceca82f39211051345108adcba3eebdc" +checksum = "9157bbaa6b165880c27a4293a474c91cdcf265cc68cc829bf10be0964a391caf" dependencies = [ "jobserver", "libc", @@ -1350,9 +1350,9 @@ dependencies = [ [[package]] name = "chrono" -version = "0.4.38" +version = "0.4.39" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401" +checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825" dependencies = [ "android-tzdata", "iana-time-zone", @@ -1403,9 +1403,9 @@ dependencies = [ [[package]] name = "clap" -version = "4.5.21" +version = "4.5.23" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fb3b4b9e5a7c7514dfa52869339ee98b3156b0bfb4e8a77c4ff4babb64b1604f" +checksum = "3135e7ec2ef7b10c6ed8950f0f792ed96ee093fa088608f1c76e569722700c84" dependencies = [ "clap_builder", "clap_derive", @@ -1413,9 +1413,9 @@ dependencies = [ [[package]] name = "clap_builder" -version = "4.5.21" +version = "4.5.23" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b17a95aa67cc7b5ebd32aa5370189aa0d79069ef1c64ce893bd30fb24bff20ec" +checksum = "30582fc632330df2bd26877bde0c1f4470d57c582bbc070376afcd04d8cb4838" dependencies = [ "anstream", "anstyle", @@ -1437,9 +1437,9 @@ dependencies = [ [[package]] name = "clap_lex" -version = "0.7.3" +version = "0.7.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "afb84c814227b90d6895e01398aee0d8033c00e7466aca416fb6a8e0eb19d8a7" +checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6" [[package]] name = "cmake" @@ -1452,9 +1452,9 @@ dependencies = [ [[package]] name = "coarsetime" -version = "0.1.34" +version = "0.1.35" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "13b3839cf01bb7960114be3ccf2340f541b6d0c81f8690b007b2b39f750f7e5d" +checksum = "4252bf230cb600c19826a575b31c8c9c84c6f11acfab6dfcad2e941b10b6f8e2" dependencies = [ "libc", "wasix", @@ -1601,18 +1601,18 @@ dependencies = [ [[package]] name = "crossbeam-channel" -version = "0.5.13" +version = "0.5.14" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "33480d6946193aa8033910124896ca395333cae7e2d1113d1fef6c3272217df2" +checksum = "06ba6d68e24814cb8de6bb986db8222d3a027d15872cabc0d18817bc3c0e4471" dependencies = [ "crossbeam-utils", ] [[package]] name = "crossbeam-deque" -version = "0.8.5" +version = "0.8.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "613f8cc01fe9cf1a3eb3d7f488fd2fa8388403e97039e2f73692932e291a770d" +checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51" dependencies = [ "crossbeam-epoch", "crossbeam-utils", @@ -1629,18 +1629,18 @@ dependencies = [ [[package]] name = "crossbeam-queue" -version = "0.3.11" +version = "0.3.12" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df0346b5d5e76ac2fe4e327c5fd1118d6be7c51dfb18f9b7922923f287471e35" +checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115" dependencies = [ "crossbeam-utils", ] [[package]] name = "crossbeam-utils" -version = "0.8.20" +version = "0.8.21" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80" +checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28" [[package]] name = "crypto-bigint" @@ -1724,9 +1724,9 @@ dependencies = [ [[package]] name = "ct-codecs" -version = "1.1.2" +version = "1.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "026ac6ceace6298d2c557ef5ed798894962296469ec7842288ea64674201a2d1" +checksum = "b916ba8ce9e4182696896f015e8a5ae6081b305f74690baa8465e35f5a142ea4" [[package]] name = "ctrlc" @@ -2090,9 +2090,9 @@ checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a" [[package]] name = "fastrand" -version = "2.2.0" +version = "2.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "486f806e73c5707928240ddc295403b1b93c96a02038563881c4a2fd84b81ac4" +checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be" [[package]] name = "fastwebsockets" @@ -2104,7 +2104,7 @@ dependencies = [ "axum-core", "base64 0.21.7", "bytes", - "http 1.1.0", + "http 1.2.0", "http-body-util", "hyper 1.5.1", "hyper-util", @@ -2119,9 +2119,9 @@ dependencies = [ [[package]] name = "fdeflate" -version = "0.3.6" +version = "0.3.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "07c6f4c64c1d33a3111c4466f7365ebdcc37c5bd1ea0d62aae2e3d722aacbedb" +checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c" dependencies = [ "simd-adler32", ] @@ -2393,7 +2393,7 @@ dependencies = [ "fnv", "futures-core", "futures-sink", - "http 1.1.0", + "http 1.2.0", "indexmap 2.7.0", "slab", "tokio", @@ -2464,9 +2464,9 @@ dependencies = [ [[package]] name = "hiqlite" -version = "0.3.1" +version = "0.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f19fc568aa390a14921be3b9c208000b91b47777f078035d1a52dcc7a8ec0035" +checksum = "4278d3e5e0093f7da889443336a82aef39d57d286ac6a0d6933ec45d1bd4dd3b" dependencies = [ "argon2", "axum", @@ -2492,7 +2492,6 @@ dependencies = [ "hyper 1.5.1", "hyper-util", "lazy_static", - "log", "lz4-sys", "mime_guess", "num-derive", @@ -2503,17 +2502,17 @@ dependencies = [ "rusqlite", "rust-embed", "rust_decimal", - "rustls 0.23.19", + "rustls 0.23.20", "serde", "serde_json", "serde_rusqlite", "sha2", "spow", "strum", - "thiserror 2.0.3", + "thiserror 2.0.7", "tokio", - "tokio-rustls 0.26.0", - "tower 0.5.1", + "tokio-rustls 0.26.1", + "tower 0.5.2", "tower-http", "tower-layer", "tower-service", @@ -2542,24 +2541,24 @@ dependencies = [ [[package]] name = "hmac-sha1-compact" -version = "1.1.4" +version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dff9d405ec732fa3fcde87264e54a32a84956a377b3e3107de96e59b798c84a7" +checksum = "18492c9f6f9a560e0d346369b665ad2bdbc89fa9bceca75796584e79042694c3" [[package]] name = "hmac-sha256" -version = "1.1.7" +version = "1.1.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3688e69b38018fec1557254f64c8dc2cc8ec502890182f395dbb0aa997aa5735" +checksum = "4a8575493d277c9092b988c780c94737fb9fd8651a1001e16bee3eccfc1baedb" dependencies = [ "digest", ] [[package]] name = "hmac-sha512" -version = "1.1.5" +version = "1.1.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e4ce1f4656bae589a3fab938f9f09bf58645b7ed01a2c5f8a3c238e01a4ef78a" +checksum = "b0b3a0f572aa8389d325f5852b9e0a333a15b0f86ecccbb3fdb6e97cd86dc67c" dependencies = [ "digest", ] @@ -2597,9 +2596,9 @@ dependencies = [ [[package]] name = "http" -version = "1.1.0" +version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "21b9ddb458710bc376481b842f5da65cdf31522de232c1ca8146abce2a358258" +checksum = "f16ca2af56261c99fba8bac40a10251ce8188205a4c448fbb745a2e4daa76fea" dependencies = [ "bytes", "fnv", @@ -2624,7 +2623,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184" dependencies = [ "bytes", - "http 1.1.0", + "http 1.2.0", ] [[package]] @@ -2635,7 +2634,7 @@ checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f" dependencies = [ "bytes", "futures-util", - "http 1.1.0", + "http 1.2.0", "http-body 1.0.1", "pin-project-lite", ] @@ -2695,7 +2694,7 @@ dependencies = [ "futures-channel", "futures-util", "h2 0.4.7", - "http 1.1.0", + "http 1.2.0", "http-body 1.0.1", "httparse", "httpdate", @@ -2729,13 +2728,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "08afdbb5c31130e3034af566421053ab03787c640246a446327f550d11bcb333" dependencies = [ "futures-util", - "http 1.1.0", + "http 1.2.0", "hyper 1.5.1", "hyper-util", - "rustls 0.23.19", + "rustls 0.23.20", "rustls-pki-types", "tokio", - "tokio-rustls 0.26.0", + "tokio-rustls 0.26.1", "tower-service", "webpki-roots", ] @@ -2761,7 +2760,7 @@ dependencies = [ "bytes", "futures-channel", "futures-util", - "http 1.1.0", + "http 1.2.0", "http-body 1.0.1", "hyper 1.5.1", "pin-project-lite", @@ -3108,9 +3107,9 @@ checksum = "f5d4a7da358eff58addd2877a45865158f0d78c911d43a5784ceb7bbf52833b0" [[package]] name = "js-sys" -version = "0.3.74" +version = "0.3.76" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a865e038f7f6ed956f788f0d7d60c541fff74c7bd74272c5d4cf15c63743e705" +checksum = "6717b6b5b077764fb5966237269cb3c64edddde4b14ce42647430a78ced9e7b7" dependencies = [ "once_cell", "wasm-bindgen", @@ -3136,9 +3135,9 @@ dependencies = [ [[package]] name = "jwt-simple" -version = "0.12.10" +version = "0.12.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "50ae7e0018905a795d6f2a60ac32a547490abdd8df509906a8c6171e6d861711" +checksum = "b00e03c08ce71da10a3ad9267b963c03fc4234a56713d87648547b3fdda872a6" dependencies = [ "anyhow", "binstring", @@ -3156,7 +3155,7 @@ dependencies = [ "serde", "serde_json", "superboring", - "thiserror 1.0.69", + "thiserror 2.0.7", "zeroize", ] @@ -3176,9 +3175,9 @@ dependencies = [ [[package]] name = "konst" -version = "0.3.14" +version = "0.3.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b65f00fb3910881e52bf0850ae2a82aea411488a557e1c02820ceaa60963dce3" +checksum = "298ddf99f06a97c1ecd0e910932662b7842855046234b0d0376d35d93add087f" dependencies = [ "const_panic", "konst_kernel", @@ -3187,9 +3186,9 @@ dependencies = [ [[package]] name = "konst_kernel" -version = "0.3.12" +version = "0.3.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "599c1232f55c72c7fc378335a3efe1c878c92720838c8e6a4fd87784ef7764de" +checksum = "e4b1eb7788f3824c629b1116a7a9060d6e898c358ebff59070093d51103dcc3c" dependencies = [ "typewit", ] @@ -3217,9 +3216,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55" [[package]] name = "lettre" -version = "0.11.10" +version = "0.11.11" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0161e452348e399deb685ba05e55ee116cae9410f4f51fe42d597361444521d9" +checksum = "ab4c9a167ff73df98a5ecc07e8bf5ce90b583665da3d1762eb1f775ad4d0d6f5" dependencies = [ "async-trait", "base64 0.22.1", @@ -3235,12 +3234,12 @@ dependencies = [ "nom", "percent-encoding", "quoted_printable", - "rustls 0.23.19", + "rustls 0.23.20", "rustls-pemfile 2.2.0", "rustls-pki-types", "socket2", "tokio", - "tokio-rustls 0.26.0", + "tokio-rustls 0.26.1", "tracing", "url", "webpki-roots", @@ -3248,9 +3247,9 @@ dependencies = [ [[package]] name = "libc" -version = "0.2.167" +version = "0.2.168" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09d6582e104315a817dff97f75133544b2e094ee22447d2acf4a74e189ba06fc" +checksum = "5aaeb2981e0606ca11d79718f8bb01164f1d6ed75080182d3abf017e6d244b6d" [[package]] name = "libfuzzer-sys" @@ -3498,7 +3497,7 @@ dependencies = [ "bytes", "encoding_rs", "futures-util", - "http 1.1.0", + "http 1.2.0", "httparse", "memchr", "mime", @@ -3957,9 +3956,9 @@ checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2" [[package]] name = "png" -version = "0.17.14" +version = "0.17.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52f9d46a34a05a6a57566bc2bfae066ef07585a6e3fa30fbbdff5936380623f0" +checksum = "b67582bd5b65bdff614270e2ea89a1cf15bef71245cc1e5f7ea126977144211d" dependencies = [ "bitflags 1.3.2", "crc32fast", @@ -4179,9 +4178,9 @@ dependencies = [ "quinn-proto", "quinn-udp", "rustc-hash 2.1.0", - "rustls 0.23.19", + "rustls 0.23.20", "socket2", - "thiserror 2.0.3", + "thiserror 2.0.7", "tokio", "tracing", ] @@ -4197,10 +4196,10 @@ dependencies = [ "rand", "ring", "rustc-hash 2.1.0", - "rustls 0.23.19", + "rustls 0.23.20", "rustls-pki-types", "slab", - "thiserror 2.0.3", + "thiserror 2.0.7", "tinyvec", "tracing", "web-time", @@ -4208,9 +4207,9 @@ dependencies = [ [[package]] name = "quinn-udp" -version = "0.5.7" +version = "0.5.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7d5a626c6807713b15cac82a6acaccd6043c9a5408c24baae07611fec3f243da" +checksum = "52cd4b1eff68bf27940dd39811292c49e007f4d0b4c357358dc9b0197be6b527" dependencies = [ "cfg_aliases", "libc", @@ -4273,7 +4272,7 @@ dependencies = [ [[package]] name = "rauthy" -version = "0.27.0" +version = "0.27.2" dependencies = [ "actix-service", "actix-web", @@ -4298,7 +4297,7 @@ dependencies = [ "rauthy-service", "reqwest", "ring", - "rustls 0.23.19", + "rustls 0.23.20", "rustls-pemfile 2.2.0", "rustls-pki-types", "serde", @@ -4314,7 +4313,7 @@ dependencies = [ [[package]] name = "rauthy-api-types" -version = "0.27.0" +version = "0.27.2" dependencies = [ "actix-web", "chrono", @@ -4335,7 +4334,7 @@ dependencies = [ [[package]] name = "rauthy-common" -version = "0.27.0" +version = "0.27.2" dependencies = [ "actix-web", "argon2", @@ -4361,7 +4360,7 @@ dependencies = [ [[package]] name = "rauthy-error" -version = "0.27.0" +version = "0.27.2" dependencies = [ "actix-multipart", "actix-web", @@ -4397,7 +4396,7 @@ dependencies = [ [[package]] name = "rauthy-handlers" -version = "0.27.0" +version = "0.27.2" dependencies = [ "actix-multipart", "actix-web", @@ -4427,7 +4426,7 @@ dependencies = [ [[package]] name = "rauthy-middlewares" -version = "0.27.0" +version = "0.27.2" dependencies = [ "actix-web", "chrono", @@ -4446,7 +4445,7 @@ dependencies = [ [[package]] name = "rauthy-models" -version = "0.27.0" +version = "0.27.2" dependencies = [ "accept-language", "actix", @@ -4522,7 +4521,7 @@ dependencies = [ [[package]] name = "rauthy-notify" -version = "0.27.0" +version = "0.27.2" dependencies = [ "async-trait", "chrono", @@ -4542,7 +4541,7 @@ dependencies = [ [[package]] name = "rauthy-schedulers" -version = "0.27.0" +version = "0.27.2" dependencies = [ "actix-web", "chrono", @@ -4560,7 +4559,7 @@ dependencies = [ [[package]] name = "rauthy-service" -version = "0.27.0" +version = "0.27.2" dependencies = [ "actix-web", "argon2", @@ -4664,9 +4663,9 @@ dependencies = [ [[package]] name = "redox_syscall" -version = "0.5.7" +version = "0.5.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f" +checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834" dependencies = [ "bitflags 2.6.0", ] @@ -4748,7 +4747,7 @@ dependencies = [ "futures-core", "futures-util", "h2 0.4.7", - "http 1.1.0", + "http 1.2.0", "http-body 1.0.1", "http-body-util", "hyper 1.5.1", @@ -4762,15 +4761,15 @@ dependencies = [ "percent-encoding", "pin-project-lite", "quinn", - "rustls 0.23.19", + "rustls 0.23.20", "rustls-pemfile 2.2.0", "rustls-pki-types", "serde", "serde_json", "serde_urlencoded", - "sync_wrapper 1.0.2", + "sync_wrapper", "tokio", - "tokio-rustls 0.26.0", + "tokio-rustls 0.26.1", "tokio-util", "tower-service", "url", @@ -4947,7 +4946,7 @@ dependencies = [ "async-stream", "bytes", "futures-core", - "http 1.1.0", + "http 1.2.0", "reqwest", "ruma-client-api", "ruma-common", @@ -4965,7 +4964,7 @@ dependencies = [ "assign", "bytes", "date_header", - "http 1.1.0", + "http 1.2.0", "js_int", "js_option", "maplit", @@ -4989,7 +4988,7 @@ dependencies = [ "base64 0.22.1", "bytes", "form_urlencoded", - "http 1.1.0", + "http 1.2.0", "indexmap 2.7.0", "js_int", "konst", @@ -5168,15 +5167,15 @@ dependencies = [ [[package]] name = "rustix" -version = "0.38.41" +version = "0.38.42" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d7f649912bc1495e167a6edee79151c84b1bad49748cb4f1f1167f459f6224f6" +checksum = "f93dc38ecbab2eb790ff964bb77fa94faf256fd3e73285fd7ba0903b76bedb85" dependencies = [ "bitflags 2.6.0", "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.59.0", ] [[package]] @@ -5193,9 +5192,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.19" +version = "0.23.20" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "934b404430bb06b3fae2cba809eb45a1ab1aecd64491213d7c3301b88393f8d1" +checksum = "5065c3f250cbd332cd894be57c40fa52387247659b14a2d6041d121547903b1b" dependencies = [ "aws-lc-rs", "log", @@ -5239,9 +5238,9 @@ dependencies = [ [[package]] name = "rustls-pki-types" -version = "1.10.0" +version = "1.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "16f1201b3c9a7ee8039bcadc17b7e605e2945b27eee7631788c1bd2b0643674b" +checksum = "d2bf47e6ff922db3825eb750c4e2ff784c6ff8fb9e13046ef6a1d1c5401b0b37" dependencies = [ "web-time", ] @@ -5294,7 +5293,7 @@ dependencies = [ "futures-util", "hex", "hmac", - "http 1.1.0", + "http 1.2.0", "md5", "percent-encoding", "quick-xml", @@ -5387,18 +5386,18 @@ dependencies = [ [[package]] name = "semver" -version = "1.0.23" +version = "1.0.24" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61697e0a1c7e512e84a621326239844a24d8207b4669b41bc18b32ea5cbf988b" +checksum = "3cb6eb87a131f756572d7fb904f6e7b68633f09cca868c5df1c4b8d1a694bbba" dependencies = [ "serde", ] [[package]] name = "serde" -version = "1.0.215" +version = "1.0.216" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f" +checksum = "0b9781016e935a97e8beecf0c933758c97a5520d32930e460142b4cd80c6338e" dependencies = [ "serde_derive", ] @@ -5415,9 +5414,9 @@ dependencies = [ [[package]] name = "serde_derive" -version = "1.0.215" +version = "1.0.216" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0" +checksum = "46f859dbbf73865c6627ed570e78961cd3ac92407a2d117204c49232485da55e" dependencies = [ "proc-macro2", "quote", @@ -5792,7 +5791,7 @@ dependencies = [ "once_cell", "paste", "percent-encoding", - "rustls 0.23.19", + "rustls 0.23.20", "rustls-pemfile 2.2.0", "serde", "serde_json", @@ -6025,9 +6024,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292" [[package]] name = "superboring" -version = "0.1.3" +version = "0.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cee25cd9d145d2c1ef92a52720376eeb510c8870dfa0f84edb371901ec6a12ca" +checksum = "515cce34a781d7250b8a65706e0f2a5b99236ea605cb235d4baed6685820478f" dependencies = [ "getrandom", "hmac-sha256", @@ -6072,12 +6071,6 @@ dependencies = [ "unicode-ident", ] -[[package]] -name = "sync_wrapper" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160" - [[package]] name = "sync_wrapper" version = "1.0.2" @@ -6159,11 +6152,11 @@ dependencies = [ [[package]] name = "thiserror" -version = "2.0.3" +version = "2.0.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c006c85c7651b3cf2ada4584faa36773bd07bac24acfb39f3c431b36d7e667aa" +checksum = "93605438cbd668185516ab499d589afb7ee1859ea3d5fc8f6b0755e1c7443767" dependencies = [ - "thiserror-impl 2.0.3", + "thiserror-impl 2.0.7", ] [[package]] @@ -6179,9 +6172,9 @@ dependencies = [ [[package]] name = "thiserror-impl" -version = "2.0.3" +version = "2.0.7" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f077553d607adc1caf65430528a576c757a71ed73944b66ebb58ef2bbd243568" +checksum = "e1d8749b4531af2117677a5fcd12b1348a3fe2b81e36e61ffeac5c4aa3273e36" dependencies = [ "proc-macro2", "quote", @@ -6211,9 +6204,9 @@ dependencies = [ [[package]] name = "time" -version = "0.3.36" +version = "0.3.37" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885" +checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21" dependencies = [ "deranged", "itoa", @@ -6234,9 +6227,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3" [[package]] name = "time-macros" -version = "0.2.18" +version = "0.2.19" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf" +checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de" dependencies = [ "num-conv", "time-core", @@ -6269,9 +6262,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.41.1" +version = "1.42.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22cfb5bee7a6a52939ca9224d6ac897bb669134078daa8735560897f69de4d33" +checksum = "5cec9b21b0450273377fc97bd4c33a8acffc8c996c987a7c5b319a0083707551" dependencies = [ "backtrace", "bytes", @@ -6318,20 +6311,19 @@ dependencies = [ [[package]] name = "tokio-rustls" -version = "0.26.0" +version = "0.26.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4" +checksum = "5f6d0975eaace0cf0fcadee4e4aaa5da15b5c079146f2cffb67c113be122bf37" dependencies = [ - "rustls 0.23.19", - "rustls-pki-types", + "rustls 0.23.20", "tokio", ] [[package]] name = "tokio-stream" -version = "0.1.16" +version = "0.1.17" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4f4e6ce100d0eb49a2734f8c0812bcd324cf357d21810932c5df6b96ef2b86f1" +checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047" dependencies = [ "futures-core", "pin-project-lite", @@ -6353,9 +6345,9 @@ dependencies = [ [[package]] name = "tokio-util" -version = "0.7.12" +version = "0.7.13" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61e7c3654c13bcd040d4a03abee2c75b1d14a37b423cf5a813ceae1cc903ec6a" +checksum = "d7fcaa8d55a2bdd6b83ace262b016eca0d79ee02818c5c1bcdf0305114081078" dependencies = [ "bytes", "futures-core", @@ -6415,14 +6407,14 @@ dependencies = [ [[package]] name = "tower" -version = "0.5.1" +version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2873938d487c3cfb9aed7546dc9f2711d867c9f90c46b889989a2cb84eba6b4f" +checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9" dependencies = [ "futures-core", "futures-util", "pin-project-lite", - "sync_wrapper 0.1.2", + "sync_wrapper", "tokio", "tower-layer", "tower-service", @@ -6437,9 +6429,9 @@ checksum = "403fa3b783d4b626a8ad51d766ab03cb6d2dbfc46b1c5d4448395e6628dc9697" dependencies = [ "bitflags 2.6.0", "bytes", - "http 1.1.0", + "http 1.2.0", "pin-project-lite", - "tower 0.5.1", + "tower 0.5.2", "tower-layer", "tower-service", ] @@ -6555,9 +6547,9 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825" [[package]] name = "typewit" -version = "1.10.1" +version = "1.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d51dbd25812f740f45e2a9769f84711982e000483b13b73a8a1852e092abac8c" +checksum = "cb77c29baba9e4d3a6182d51fa75e3215c7fd1dab8f4ea9d107c716878e55fc0" dependencies = [ "typewit_proc_macros", ] @@ -6838,9 +6830,9 @@ dependencies = [ [[package]] name = "wasm-bindgen" -version = "0.2.97" +version = "0.2.99" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d15e63b4482863c109d70a7b8706c1e364eb6ea449b201a76c5b89cedcec2d5c" +checksum = "a474f6281d1d70c17ae7aa6a613c87fce69a127e2624002df63dcb39d6cf6396" dependencies = [ "cfg-if", "once_cell", @@ -6849,13 +6841,12 @@ dependencies = [ [[package]] name = "wasm-bindgen-backend" -version = "0.2.97" +version = "0.2.99" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8d36ef12e3aaca16ddd3f67922bc63e48e953f126de60bd33ccc0101ef9998cd" +checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79" dependencies = [ "bumpalo", "log", - "once_cell", "proc-macro2", "quote", "syn 2.0.90", @@ -6864,9 +6855,9 @@ dependencies = [ [[package]] name = "wasm-bindgen-futures" -version = "0.4.47" +version = "0.4.49" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9dfaf8f50e5f293737ee323940c7d8b08a66a95a419223d9f41610ca08b0833d" +checksum = "38176d9b44ea84e9184eff0bc34cc167ed044f816accfe5922e54d84cf48eca2" dependencies = [ "cfg-if", "js-sys", @@ -6877,9 +6868,9 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro" -version = "0.2.97" +version = "0.2.99" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "705440e08b42d3e4b36de7d66c944be628d579796b8090bfa3471478a2260051" +checksum = "2cc6181fd9a7492eef6fef1f33961e3695e4579b9872a6f7c83aee556666d4fe" dependencies = [ "quote", "wasm-bindgen-macro-support", @@ -6887,9 +6878,9 @@ dependencies = [ [[package]] name = "wasm-bindgen-macro-support" -version = "0.2.97" +version = "0.2.99" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "98c9ae5a76e46f4deecd0f0255cc223cfa18dc9b261213b8aa0c7b36f61b3f1d" +checksum = "30d7a95b763d3c45903ed6c81f156801839e5ee968bb07e534c44df0fcd330c2" dependencies = [ "proc-macro2", "quote", @@ -6900,9 +6891,9 @@ dependencies = [ [[package]] name = "wasm-bindgen-shared" -version = "0.2.97" +version = "0.2.99" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6ee99da9c5ba11bd675621338ef6fa52296b76b83305e9b6e5c77d4c286d6d49" +checksum = "943aab3fdaaa029a6e0271b35ea10b72b943135afe9bffca82384098ad0e06a6" [[package]] name = "wasm-streams" @@ -6919,9 +6910,9 @@ dependencies = [ [[package]] name = "web-sys" -version = "0.3.74" +version = "0.3.76" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a98bc3c33f0fe7e59ad7cd041b89034fa82a7c2d4365ca538dda6cdaf513863c" +checksum = "04dd7223427d52553d3702c004d3b2fe07c148165faa56313cb00211e31c12bc" dependencies = [ "js-sys", "wasm-bindgen", @@ -7325,9 +7316,9 @@ dependencies = [ [[package]] name = "xml-rs" -version = "0.8.23" +version = "0.8.24" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "af310deaae937e48a26602b730250b4949e125f468f11e6990be3e5304ddd96f" +checksum = "ea8b391c9a790b496184c29f7f93b9ed5b16abb306c05415b68bcc16e4d06432" [[package]] name = "yansi" @@ -7442,7 +7433,7 @@ dependencies = [ "flate2", "indexmap 2.7.0", "memchr", - "thiserror 2.0.3", + "thiserror 2.0.7", "zopfli", ] @@ -7496,9 +7487,9 @@ checksum = "3f423a2c17029964870cfaabb1f13dfab7d092a62a29a89264f4d36990ca414a" [[package]] name = "zune-jpeg" -version = "0.4.13" +version = "0.4.14" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "16099418600b4d8f028622f73ff6e3deaabdff330fb9a2a131dea781ee8b0768" +checksum = "99a5bab8d7dedf81405c4bb1f2b83ea057643d9cb28778cea9eecddeedd2e028" dependencies = [ "zune-core", ] diff --git a/Cargo.toml b/Cargo.toml index 5975b90c..7fda3474 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -4,7 +4,7 @@ members = ["src/*"] exclude = ["rauthy-client"] [workspace.package] -version = "0.27.0" +version = "0.27.2" edition = "2021" authors = ["Sebastian Dobe "] license = "Apache-2.0" @@ -19,7 +19,7 @@ strip = true panic = "abort" [patch.crates-io] -#hiqlite = { git = "https://github.com/sebadob/hiqlite.git", package = "hiqlite" } +#hiqlite = { git = "https://github.com/sebadob/hiqlite.git", branch = "prepare-v0.3.3", package = "hiqlite" } #hiqlite = { path = "../../hiqlite/hiqlite", package = "hiqlite" } [workspace.dependencies] @@ -54,7 +54,7 @@ futures = "0.3" futures-util = "0.3" gethostname = "0.5.0" hex = { version = "0.4", features = ["serde"] } -hiqlite = { version = "0.3.1", features = ["full"] } +hiqlite = { version = "0.3.2", features = ["full"] } hmac-sha256 = { version = "1.1.7", features = ["traits010"] } hmac-sha512 = { version = "1.1.5", features = ["traits010", "sha384"] } image = { version = "0.25.1", default-features = false, features = [ diff --git a/README.md b/README.md index 26b8f038..c5fe21d7 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,16 @@ with new versions. ## What it is -Rauthy is an OpenID Connect (OIDC) Provider and Single Sign-On solution written in Rust. +Rauthy - OpenID Connect Single Sign-On Identity & Access Management + +Rauthy is a lightweight and easy to use OpenID Connect Identity Provider. It aims to be simple to both set up and +operate, with very secure defaults and lots of config options, if you need the flexibility. It puts heavy emphasis on +Passkeys and a very strong security in general. The project is written in Rust to be as memory efficient, secure and +fast as possible, and it can run on basically any hardware. If you need Single Sign-On support for IoT or headless +CLI tools, it's got you covered as well. +You get High-Availability, client branding, UI translation, a nice Admin UI, Events and Auditing, and many more +features. By default, it runs on top of [Hiqlite](https://github.com/sebadob/hiqlite) and does not depend on an external +database (Postgres as an alternative) to make it even simpler to operate, while scaling up to millions of users easily. ### Secure by default @@ -189,7 +198,7 @@ the application yourself with docker on your localhost. Rauthy has pretty strict browsers treat `localhost` as being secure, therefore you should allow insecure cookies for testing locally: ``` -docker run --rm -e COOKIE_MODE=danger-insecure -p 8080:8080 ghcr.io/sebadob/rauthy:0.27.0 +docker run --rm -e COOKIE_MODE=danger-insecure -p 8080:8080 ghcr.io/sebadob/rauthy:0.27.1 ``` ## Contributing diff --git a/book/src/config/config.md b/book/src/config/config.md index f086c72b..e137740d 100644 --- a/book/src/config/config.md +++ b/book/src/config/config.md @@ -62,6 +62,22 @@ deploying with Kubernetes, extract these values into Kubernetes Secrets. # default: false #DANGER_DISABLE_INTROSPECT_AUTH=false +# By default, `refresh_token`s will have an `nbf` claim, making them valid +# at `access_token_lifetime - 60 seconds`. Any usage before this time will +# result in invalidation of not only the token itself, but also all other +# linked sessions and tokens for this user to prevent damage in case a client +# leaked the token by accident. +# However, there are bad / lazy client implementations that do not respect +# either `nbf` in the `refresh_token`, or the `exp` claim in `access_token` +# and will refresh early while the current access_token is still valid. +# This does not only waste resources and time, but also makes it possible +# to have multiple valid `access_token`s at the same time for the same +# session. You should only disable the `nbf` claim if you have a good +# reasons to do so. +# If disabled, the `nbf` claim will still exist, but always set to *now*. +# default: false +#DISABLE_REFRESH_TOKEN_NBF=false + # Can be used when 'OPEN_USER_REG=true' to restrict the domains # for a registration. For instance, set it to # 'USER_REG_DOMAIN_RESTRICTION=gmail.com' to allow only diff --git a/book/src/getting_started/docker.md b/book/src/getting_started/docker.md index d1bfc9f9..5ee66631 100644 --- a/book/src/getting_started/docker.md +++ b/book/src/getting_started/docker.md @@ -12,7 +12,7 @@ docker run --rm \ -e COOKIE_MODE=danger-insecure \ -p 8080:8080 \ --name rauthy \ - ghcr.io/sebadob/rauthy:0.27.0 + ghcr.io/sebadob/rauthy:0.27.1 ``` This will start the container in interactive mode with the [Hiqlite](https://github.com/sebadob/hiqlite) database. Just @@ -25,7 +25,7 @@ docker run -d \ -e COOKIE_MODE=danger-insecure \ -p 8080:8080 \ --name rauthy \ - ghcr.io/sebadob/rauthy:0.27.0 + ghcr.io/sebadob/rauthy:0.27.1 ``` ```admonish note @@ -132,7 +132,7 @@ docker run -d \ -v $(pwd)/rauthy/data:/app/data \ -p 8080:8080 \ --name rauthy \ - ghcr.io/sebadob/rauthy:0.27.0 + ghcr.io/sebadob/rauthy:0.27.1 ``` - `-v $(pwd)/rauthy/rauthy.cfg:/app/rauthy.cfg` makes sure to overwrite the testing config inside the container diff --git a/book/src/getting_started/k8s.md b/book/src/getting_started/k8s.md index 5d3cfe24..90149726 100644 --- a/book/src/getting_started/k8s.md +++ b/book/src/getting_started/k8s.md @@ -251,7 +251,7 @@ spec: fsGroup: 10001 containers: - name: rauthy - image: ghcr.io/sebadob/rauthy:0.27.0 + image: ghcr.io/sebadob/rauthy:0.27.1 imagePullPolicy: IfNotPresent securityContext: # User ID 10001 is actually built into the container at the creation for @@ -351,17 +351,6 @@ spec: subPath: rauthy.cfg name: rauthy-config readOnly: true - readinessProbe: - httpGet: - # You may need to adjust this, if you decide to start in https only - # mode or use another port - scheme: HTTP - port: 8080 - #scheme: HTTPS - #port: 8443 - path: /auth/v1/ping - initialDelaySeconds: 1 - periodSeconds: 10 livenessProbe: httpGet: # You may need to adjust this, if you decide to start in https only diff --git a/docs/404.html b/docs/404.html index 569f7f6f..fde4abb0 100644 --- a/docs/404.html +++ b/docs/404.html @@ -1,5 +1,5 @@ - + @@ -8,7 +8,7 @@ - + @@ -32,15 +32,17 @@ - - -
+ - + + + + +
- - -
- +