Scott McKendry
3390debab7
handle edge cases
2026-07-30 07:20:51 +12:00
Scott McKendry
c5bccd0b7b
should be non-breaking now ;)
2026-07-30 07:06:54 +12:00
Scott McKendry
cce0eaa974
rework to keep regex under specific conditions
2026-07-28 19:53:16 +12:00
Scott McKendry
3d5ab54ab8
fix(acls): auth bypass via forward auth
2026-07-27 19:43:47 +12:00
Stavros
c7077a7c84
fix: do not allow empty ingresses
2026-07-21 00:37:13 +03:00
Stavros and GitHub
80bc87188e
refactor: rework acl fetching for kubernetes and docker ( #1028 )
2026-07-20 16:39:15 +03:00
Stavros and GitHub
f43d690320
refactor: rework scheme validation in oauth controller and frontend ( #1026 )
2026-07-19 00:41:28 +03:00
Stavros
a79438d6ec
fix: fix typo
2026-07-18 16:47:53 +03:00
Stavros
5091fc2d7a
fix: suppress irrelevant debugs logs in acls service
2026-07-18 16:30:12 +03:00
Stavros and GitHub
a7eba59a42
refactor: export cache package ( #1017 )
2026-07-17 02:04:34 +03:00
Stavros
589fe22138
tests: add tests for abstain in oauth whitelist
2026-07-16 14:30:48 +03:00
1165c91fcc
fix: abstain when OAuth whitelist is empty ( #1010 )
...
Co-authored-by: wwhsaber <wwhsaber@foxmail.com >
2026-07-16 14:23:07 +03:00
Stavros and GitHub
dade1e2c8f
refactor: rework rate limit logic ( #1008 )
2026-07-15 15:30:57 +03:00
Stavros and GitHub
6e095fd4f2
refactor: rework the way trusted proxies ip work ( #1007 )
2026-07-15 15:17:55 +03:00
Stavros and GitHub
c22925c2fb
fix: use constant time in user checks ( #1004 )
2026-07-14 16:49:59 +03:00
Stavros and GitHub
e75605b2c5
refactor: move domain check into small helper util ( #1000 )
2026-07-14 14:20:15 +03:00
Florian Ilch and GitHub
79bcccbe43
feat: support proxy environment variables for OAuth requests ( #999 )
2026-07-14 13:18:28 +03:00
Stavros and GitHub
0bd2821a9b
refactor: use tailscale api for user checking instead of tsnet ( #978 )
2026-07-09 01:56:09 +03:00
nv6 and GitHub
364175adc0
feat: try anonymous bind when bind credentials are empty ( #979 )
2026-07-08 17:11:30 +03:00
Stavros and GitHub
a3c4d6ac83
chore: move tailscale to experimental config ( #964 )
2026-07-02 23:17:03 +03:00
Stavros and GitHub
ffafb5bff5
feat: add a reconnect to the initial ldap connection ( #928 )
2026-06-30 15:57:41 +03:00
Stavros and GitHub
69f4206f65
refactor: remove concurrent listeners and rework cookie logic ( #950 )
2026-06-23 13:35:29 +03:00
Stavros and GitHub
efe373084f
feat: support for oidc max age ( #949 )
2026-06-20 00:21:22 +03:00
Stavros and GitHub
7f18b45e21
feat: support for the prompt parameter in the oidc flow ( #948 )
2026-06-20 00:04:41 +03:00
Stavros and GitHub
53af1b99c0
tests: don't use _test suffix in service and controller tests ( #944 )
2026-06-17 17:03:30 +03:00
Stavros and GitHub
654b5cc436
fix: use better limits in lockdown to limit dos attack window ( #943 )
2026-06-17 13:10:58 +03:00
Stavros
a9face749d
chore: remove leftover debug log line from tailscale service
2026-06-17 12:15:51 +03:00
Stavros and GitHub
f404c2ef16
feat: use dig for di in services and controllers ( #936 )
2026-06-16 13:00:48 +03:00
a0e74cd5f2
refactor: move oidc handling to backend and add support for oidc post ( #923 )
...
Co-authored-by: Claude <noreply@anthropic.com >
2026-06-13 16:45:12 +03:00
Ryc O'Chet and GitHub
49105ce5ff
feat: add ldap bind password file ( #929 )
2026-06-11 13:25:22 +03:00
Stavros and GitHub
426eac2d0b
refactor: rework oidc session storage ( #913 )
2026-06-06 16:26:08 +03:00
Stavros and GitHub
dac844595d
refactor: use new cache store in services ( #912 )
2026-05-31 18:55:06 +03:00
Stavros
940ba6dff7
fix: don't allow tagged devices in tailscale integration
2026-05-31 12:42:00 +03:00
Stavros and GitHub
faee58ca8e
feat: use ding for ordered go routine shutdown order ( #896 )
2026-05-27 12:46:28 +03:00
Stavros
e9b8ca3cf8
fix: cleanup acl logic to match stable one
2026-05-27 12:11:17 +03:00
Stavros and GitHub
0a3e7bf265
fix: use policy engine in oauth whitelist check ( #904 )
2026-05-26 00:07:46 +03:00
c3461131f5
feat: support provider-specific OAuth whitelists ( #882 )
...
Co-authored-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com >
2026-05-24 20:18:33 +03:00
Scott McKendry and GitHub
e532cde2b6
fix: potential nil pointer dereferences ( #893 )
2026-05-24 17:23:48 +03:00
Scott McKendry and GitHub
7aa25210f5
feat(config): allow global bypass by ip ( #889 )
2026-05-23 19:58:48 +03:00
Stavros and GitHub
55bef72639
fix: ensure domain defined in acls is included in host rules ( #884 )
2026-05-23 17:13:41 +03:00
Stavros
3194f4b987
chore: remove stale error from tailscale service
2026-05-20 23:04:38 +03:00
Stavros
9b50670925
fix: handle panics in tailscale service
2026-05-20 23:01:14 +03:00
Stavros and GitHub
1166a15aa7
feat: tailscale integration ( #847 )
2026-05-20 20:10:38 +03:00
Stavros and GitHub
c855f9b8ac
feat: add support for deny by default access controls ( #852 )
2026-05-19 18:07:55 +03:00
Scott McKendry and GitHub
a56c349525
refactor(db): use new store interface ( #831 )
2026-05-18 22:33:09 +03:00
Stavros
8932f2ad46
feat: ensure public key pairs with private key in oidc service
2026-05-16 20:43:50 +03:00
Stavros
5349f21212
fix: use loaded public key in oidc service, fixes #860
2026-05-16 17:09:21 +03:00
e8071a9d80
fix: bug fixes for issues #859 , 860, 861, 862, 863, 864, 865, 866 ( #867 )
...
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2026-05-16 17:04:01 +03:00
Dreddy and GitHub
f9fff24ca5
fix: oidc open redirect ( #854 )
2026-05-13 17:34:39 +03:00
a9eac7edd2
fix(ldap): pass through LDAP mail attribute instead of crafting email ( #834 )
...
* fix(ldap): pass through LDAP mail attribute instead of crafting email
TinyAuth was constructing LDAP user emails as username@CookieDomain
instead of using the mail attribute stored in the directory. This caused
OIDC clients like Grafana to receive a synthetic email rather than the
real one.
Rename GetUserDN to GetUserInfo and extend it to also fetch the mail
attribute in the same LDAP query. Thread the result through UserSearch
and use it in both the login flow and the basic auth middleware, falling
back to the crafted email only when LDAP returns no mail value.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
* chore: add ldap email logic back after main merge
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-05-11 15:40:15 +03:00
Scott McKendry
Stavros
Florian IlchandGitHub
nv6andGitHub
Ryc O'ChetandGitHub
