* Make possible set IdpSignKeyRefreshEnabled from setup.env
IdpSignKeyRefreshEnabled is default to false but with some idps on token
expire of logged users netbird always give error and return usable only
on server restart so I think is useful make easier/faster set it on
server configuration
* add template IdpSignKeyRefreshEnabled value test
* Move StoreKind under own StoreConfig configuration parameter
* Rename StoreKind option to Engine
* Rename StoreKind internal methods and types to Engine
* Add template engine value test
---------
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>
Because we provide the option to regenerate the config files, the encryption key could be lost.
- The configure.sh read the existing key and write it back during the config generation
- Backup the previously generated config files before overwrite it
- Fix invalid json output in the Extras field
- Reduce the error logs in case if the encryption key is invalid
- Response in the events API with valid user info in any cases
- Add extra error handling to the configure.sh. I.e. handle the invalid OpenID urls
added intergration with JumpCloud User API. Use the steps in setup.md for configuration.
Additional changes:
- Enhance compatibility for providers that lack audience support in the Authorization Code Flow and the Authorization - - Code Flow with Proof Key for Code Exchange (PKCE) using NETBIRD_DASH_AUTH_USE_AUDIENCE=falseenv
- Verify tokens by utilizing the client ID when audience support is absent in providers
Use NETBIRD_SIGNAL_PORT variable instead of the static port for signal
container in the docker-compose template to make setting of custom
signal port working
Signed-off-by: Fabio Fantoni <fabio.fantoni@m2r.biz>
This adds a basic wxs file to build MSI installer
This file was created using docs
from https://wixtoolset.org/docs/schema/wxs/ and
examples from gsudo, qemu-shoggoth, and many others.
The main difference between this and the .exe installer
is that we don't use the netbird service command to install
the daemon
Enhance the user experience by enabling authentication to Netbird using Single Sign-On (SSO) with any Identity Provider (IDP) provider. Current client offers this capability through the Device Authorization Flow, however, is not widely supported by many IDPs, and even some that do support it do not provide a complete verification URL.
To address these challenges, this pull request enable Authorization Code Flow with Proof Key for Code Exchange (PKCE) for client logins, which is a more widely adopted and secure approach to facilitate SSO with various IDP providers.
* Refactor: Configurable supported scopes
Previously, supported scopes were hardcoded and limited to Auth0
and Keycloak. This update removes the default set of values,
providing flexibility. The value to be set for each Identity
Provider (IDP) is specified in their respective documentation.
* correct var
* correct var
* skip fetching scopes from openid-configuration
Supporting new dashboard option to configure a source token.
Adding configuration support for setting
a different audience for device authorization flow.
fix custom id claim variable
This feature allows using the custom claim in the JWT token as a user ID.
Refactor claims extractor with options support
Add is_current to the user API response
This will help us understand usage on self-hosted deployments
The collection may be disabled by using the flag --disable-anonymous-metrics or
NETBIRD_DISABLE_ANONYMOUS_METRICS in setup.env
Right now Signal Service runs the Let'sEncrypt manager on port 80
and a gRPC server on port 10000. There are two separate listeners.
This PR combines these listeners into one with a cmux lib.
The gRPC server runs on either 443 with TLS or 80 without TLS.
Let's Encrypt manager always runs on port 80.
split setup.env with example and base
add setup.env to .gitignore to avoid overwrite from new versions
Added test workflow for docker-compose
and validated configure.sh generated variables
* rename wiretrustee-signal to netbird-signal
* Rename Signal repositories and source bin
* Adjust docker-compose with signal volume [skip ci]
Co-authored-by: mlsmaycon <mlsmaycon@gmail.com>
Rename documentation and goreleaser build names
Added a migration function for when the old path exists and the new one doesn't
updated the configure.sh to generate the docker-compose with a new path only
if no pre-existing volume with old name exists
* Updated self-hosted scripts and documentation
Added more variables to setup.env and
Updated the documentation.
We are now configuring turn server
with template as well.
* Updated self-hosted scripts and documentation
Added more variables to setup.env and
Updated the documentation.
We are now configuring turn server
with template as well.
* Updated self-hosted scripts and documentation
Added more variables to setup.env and
Updated the documentation.
We are now configuring turn server
with template as well.
* Updated self-hosted scripts and documentation
Added more variables to setup.env and
Updated the documentation.
We are now configuring turn server
with template as well.
