Skip to content

v0.14.7

Choose a tag to compare

View all tags
@TechDufus TechDufus released this 06 Nov 03:05
· 136 commits to main since this release
v0.14.7
This tag was signed with the committer’s verified signature.
TechDufus Matthew DeGarmo
SSH Key Fingerprint: kfWmC1mt2f9FtwtRlPl4nhawEyxgiV82rpTOtA/7cLU
Verified
Learn about vigilant mode.
c238634
This commit was signed with the committer’s verified signature.
TechDufus Matthew DeGarmo
SSH Key Fingerprint: kfWmC1mt2f9FtwtRlPl4nhawEyxgiV82rpTOtA/7cLU
Verified
Learn about vigilant mode.

dash can now authorize apps itself (#37). This release adds a built-in OAuth 2.1 server: apps such as the dash Android app, clients you configure, and clients that publish a metadata document can ask a signed-in user for a scoped, revocable grant. It is a patch and is off by default: nothing changes until you set auth.oauth.enabled.

New

  • OAuth 2.1 server (auth.oauth.enabled, default off):
    • authorization code with PKCE (S256 only), resource indicators, refresh tokens that rotate (reuse revokes the grant), RFC 7009 revocation, and the RFC 8414 and RFC 9728 discovery documents;
    • access tokens last 15 minutes;
    • it needs a writable data dir and a mode other than none; set DASH_SECRET_KEY so access tokens survive a restart.
  • Clients:
    • the built-in dash-android;
    • clients you list in auth.oauth.clients;
    • clients that publish a metadata document. dash fetches it only for a signed-in user, from global addresses only (unless auth.oauth.cimdAllowPrivate), and refuses a name that imitates a known client.
  • The consent screen shows the client, its kind ("Built in", "Configured by your admin", or "Unverified · metadata from <host>"), and the scopes it asks for. Only read is pre-ticked, and scopes your role can't grant are named.
  • Settings → Connected apps lists your grants: client, audience, scopes, created and last used. You can revoke them, and administrators can see and revoke every user's.
  • Logout scopes:
    • "Log out everywhere" also disconnects your apps;
    • "Sign out all users" (administrators) ends every session and grant;
    • personal access tokens are untouched.
  • Behind an identity proxy: server.directURL and the Helm chart's routes.direct give machine clients a host that skips the proxy, while sign-in and consent stay behind it. dash never trusts identity headers on that host.
  • Limits:
    • /oauth/token and /oauth/revoke are rate limited per grant, per code or per client, and can't be exhausted by invented client IDs;
    • pending authorizations are kept only for signed-in users (20 each);
    • 20 grants per user.
  • Dependencies: prometheus/common 0.73.0, and security overrides for development-only web dependencies (glob, minimatch).

Upgrade notes

  • No step needed. In proxy mode with OAuth on and no server.directURL, dash warns at start, because clients couldn't reach the token endpoint through the proxy.

  • Rolling back to v0.14.6 after using OAuth:

    • revoke every user's connected apps (Settings → Connected apps → All users);
    • then remove auth.oauth, server.directURL and the chart's routes (a helm rollback does this).

    See docs/upgrading.md.

Assets 2
Loading