Commit Graph

10 Commits

Author SHA1 Message Date
Todd Beets
aed99441c6 Use preferred value tests (equal, not equal) rather than booleans for better fail logs 2023-09-15 14:41:41 -07:00
Todd Beets
40cf145ee6 Map both 127.0.0.1 and 127.0.1.1 to localhost for HTTPS server host validate 2023-09-15 13:13:24 -07:00
Todd Beets
75d2ddb26b AuthCallout request should include TLS data when client is NATS WS client 2023-09-15 12:36:34 -07:00
Ivan Kozlovic
b32d6b4e44 Fixed callout tests that were not doing cleanup causing data races
Because of the lack of `defer ac.Cleanup()` in some tests, the
accounts would still try to send conn updates, which was possibly
causing data races with some of the tests that change the
eventsHBInterval global variable.

Signed-off-by: Ivan Kozlovic <ivan@synadia.com>
2023-04-03 09:32:28 -06:00
Alberto Ricart
30afb48c2a [FEAT] enable callout service to generate users for any account 2023-03-23 16:01:18 -05:00
Alberto Ricart
52b023d993 bumped to latest version of jwt branch
removed server_key as name/id are already the right values
2023-03-16 17:29:14 -05:00
aricart
769dd15f06 [CHANGE] simplify auth callout response to use headers and a regular user jwt 2023-02-20 09:45:58 -04:00
Derek Collison
acad660540 Make sure connection events during auth callouts correct.
Fixed one extraneous account update for $G. We sent for the addition before switching but suppressed the change back to 0.
We now suppress all for $G as was designed.

Signed-off-by: Derek Collison <derek@nats.io>
2023-01-20 18:42:36 -08:00
Derek Collison
a63929c528 Add in account scoped auth error event. If external auth, supply reason from the callout service.
Signed-off-by: Derek Collison <derek@nats.io>
2023-01-02 17:18:45 -08:00
Derek Collison
2daf90493b Authentication and Authorization callouts for server configuration mode.
This adds the ability to augment or override the NATS auth system.

A server will send a signed request to $SYS.REQ.USER.AUTH on the specified account. The request will contain client information, all client options sent to the server, and optionally TLS information and client certificates.
The external auth service will respond with an empty message if not authorized, or a signed User JWT that the user will bind to.

The response can change the account the client will be bound to.

Signed-off-by: Derek Collison <derek@nats.io>
2022-12-28 10:32:45 -08:00