-
-
Notifications
You must be signed in to change notification settings - Fork 6.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add OMNIAUTH_ONLY environment variable to enforce externa log-in #17288
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes mastodon#15959 Introduced in mastodon#6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by mastodon#10232 from appearing, and completely broke with the introduction of mastodon#15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being.
22d5975
to
ddac9be
Compare
This was referenced Jan 14, 2022
0429f0f
to
67a3dfd
Compare
Gargron
approved these changes
Jan 23, 2022
jesseplusplus
pushed a commit
to jesseplusplus/decodon
that referenced
this pull request
Feb 10, 2022
…todon#17288) * Remove support for OAUTH_REDIRECT_AT_SIGN_IN Fixes mastodon#15959 Introduced in mastodon#6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form to instead redirect to the external OmniAuth login provider. However, it did not prevent the log-in form on /about introduced by mastodon#10232 from appearing, and completely broke with the introduction of mastodon#15228. As I restoring that previous log-in flow without introducing a security vulnerability may require extensive care and knowledge of how OmniAuth works, this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time being. * Add OMNIAUTH_ONLY environment variable to enforce external log-in only * Disable user registration when OMNIAUTH_ONLY is set to true * Replace log-in links When OMNIAUTH_ONLY is set with exactly one OmniAuth provider
SISheogorath
added a commit
to SISheogorath/mastodon
that referenced
this pull request
Nov 15, 2022
This patch adjusts the helm chart to use the new `OMNIAUTH_ONLY` variable, which replaced the former `OAUTH_REDIRECT_AT_SIGN_IN` variable in the following commit: mastodon#17288 mastodon@3c88579
Gargron
pushed a commit
that referenced
this pull request
Nov 24, 2022
…and more (#20733) * fix(chart): Remove non-functional Horizontal Pod Autoscaler The Horizontal Pod Autoscaler (HPA) refers to a Deployment that doesn't exist and therefore can not work. As a result it's pointless to carry it around in this chart and give the wrong impression it could work. This patch removes it from the helm chart and drops all references to it. * refactor(chart): Refactor sidekiq deployments to scale This patch reworks how the sidekiq deployment is set up, by splitting it into many sidekiq deployments, but at least one, which should allow to scale the number of sidekiq jobs as expected while being friendly to single user instances as well as larger ones. Further it introduces per deployment overwrites for the most relevant pod fields like resources, affinities and processed queues, number of jobs and the sidekiq security contexts. The exact implementation was inspired by an upstream issue: https://github.com/mastodon/mastodon/issues/20453 * fix(chart): Remove linode default values from values This patch drops the linode defaults from the values.yaml since these are not obvious and can cause unexpected connections as well as leaking secrets to linode, when other s3 storage backends are used and don't explicitly configure these options by accident. Mastodon will then try to authenticate to the linode backends and therefore disclose the authentication secrets. * refactor(chart): Rework reduce value reference duplication Since most of the values are simply setup like this: ``` {{- if .Values.someVariable }} SOME_VARIABLE: {{ .Values.someVariable }} {{- end }} ``` There is a lot of duplication in the references in order to full in the variables. There is an equivalent notation, which reduces the usage of the variable name to just once: ``` {{- with .Values.someVariable }} SOME_VARIABLE: {{ . }} {{- end }} ``` What seems like a pointless replacement, will reduce potential mistakes down the line by possibly only adjusting one of the two references. * fix(chart): Switch to new OMNIAUTH_ONLY variable This patch adjusts the helm chart to use the new `OMNIAUTH_ONLY` variable, which replaced the former `OAUTH_REDIRECT_AT_SIGN_IN` variable in the following commit: #17288 3c88579 * fix(chart): Repair connection test to existing service Currently the connect test can't work, since it's connecting to a non-existing service this patch fixes the service name to make the job connect to the mastodon web service to verify the connection. * docs(chart): Adjust values.yaml to support helm-docs This patch updates most values to prepare an introduction of helm-docs. This should help to make the chart more user friendly by explaining the variables and provide a standardised README file, like many other helm charts do. References: https://github.com/norwoodj/helm-docs * refactor(chart): Allow individual overwrites for streaming and web deployment This patch works how the streaming and web deployments work by adding various fields to overwrite values such as affinities, resources, replica count, and security contexts. BREAKING CHANGE: This commit removes `.Values.replicaCount` in favour of `.Values.mastodon.web.replicas` and `.Values.mastodon.streaming.values`. * feat(chart): Add option for authorized fetch Currently the helm chart doesn't support authorized fetch aka. "Secure Mode" this patch fixes that by adding the needed config option to the values file and the configmap. * docs(chart): Improve helm-docs compatiblity This patch adjust a few more comments in the values.yaml to be picked up by helm-docs. This way, future adoption is properly prepared. * fix(chart): Add automatic detection of scheduler sidekiq queue This patch adds an automatic switch to the `Recreate` strategy for the sidekiq Pod in order to prevent accidental concurrency for the scheduler queue. * fix(chart): Repair broken DB_POOL variable
deepy
pushed a commit
to deepy/mastodon-filtered-chart-repo
that referenced
this pull request
Nov 27, 2022
…and more (#20733) * fix(chart): Remove non-functional Horizontal Pod Autoscaler The Horizontal Pod Autoscaler (HPA) refers to a Deployment that doesn't exist and therefore can not work. As a result it's pointless to carry it around in this chart and give the wrong impression it could work. This patch removes it from the helm chart and drops all references to it. * refactor(chart): Refactor sidekiq deployments to scale This patch reworks how the sidekiq deployment is set up, by splitting it into many sidekiq deployments, but at least one, which should allow to scale the number of sidekiq jobs as expected while being friendly to single user instances as well as larger ones. Further it introduces per deployment overwrites for the most relevant pod fields like resources, affinities and processed queues, number of jobs and the sidekiq security contexts. The exact implementation was inspired by an upstream issue: https://github.com/mastodon/mastodon/issues/20453 * fix(chart): Remove linode default values from values This patch drops the linode defaults from the values.yaml since these are not obvious and can cause unexpected connections as well as leaking secrets to linode, when other s3 storage backends are used and don't explicitly configure these options by accident. Mastodon will then try to authenticate to the linode backends and therefore disclose the authentication secrets. * refactor(chart): Rework reduce value reference duplication Since most of the values are simply setup like this: ``` {{- if .Values.someVariable }} SOME_VARIABLE: {{ .Values.someVariable }} {{- end }} ``` There is a lot of duplication in the references in order to full in the variables. There is an equivalent notation, which reduces the usage of the variable name to just once: ``` {{- with .Values.someVariable }} SOME_VARIABLE: {{ . }} {{- end }} ``` What seems like a pointless replacement, will reduce potential mistakes down the line by possibly only adjusting one of the two references. * fix(chart): Switch to new OMNIAUTH_ONLY variable This patch adjusts the helm chart to use the new `OMNIAUTH_ONLY` variable, which replaced the former `OAUTH_REDIRECT_AT_SIGN_IN` variable in the following commit: mastodon/mastodon#17288 mastodon/mastodon@3c88579 * fix(chart): Repair connection test to existing service Currently the connect test can't work, since it's connecting to a non-existing service this patch fixes the service name to make the job connect to the mastodon web service to verify the connection. * docs(chart): Adjust values.yaml to support helm-docs This patch updates most values to prepare an introduction of helm-docs. This should help to make the chart more user friendly by explaining the variables and provide a standardised README file, like many other helm charts do. References: https://github.com/norwoodj/helm-docs * refactor(chart): Allow individual overwrites for streaming and web deployment This patch works how the streaming and web deployments work by adding various fields to overwrite values such as affinities, resources, replica count, and security contexts. BREAKING CHANGE: This commit removes `.Values.replicaCount` in favour of `.Values.mastodon.web.replicas` and `.Values.mastodon.streaming.values`. * feat(chart): Add option for authorized fetch Currently the helm chart doesn't support authorized fetch aka. "Secure Mode" this patch fixes that by adding the needed config option to the values file and the configmap. * docs(chart): Improve helm-docs compatiblity This patch adjust a few more comments in the values.yaml to be picked up by helm-docs. This way, future adoption is properly prepared. * fix(chart): Add automatic detection of scheduler sidekiq queue This patch adds an automatic switch to the `Recreate` strategy for the sidekiq Pod in order to prevent accidental concurrency for the scheduler queue. * fix(chart): Repair broken DB_POOL variable
deepy
pushed a commit
to deepy/mastodon-filtered-chart-repo
that referenced
this pull request
Nov 27, 2022
…and more (#20733) * fix(chart): Remove non-functional Horizontal Pod Autoscaler The Horizontal Pod Autoscaler (HPA) refers to a Deployment that doesn't exist and therefore can not work. As a result it's pointless to carry it around in this chart and give the wrong impression it could work. This patch removes it from the helm chart and drops all references to it. * refactor(chart): Refactor sidekiq deployments to scale This patch reworks how the sidekiq deployment is set up, by splitting it into many sidekiq deployments, but at least one, which should allow to scale the number of sidekiq jobs as expected while being friendly to single user instances as well as larger ones. Further it introduces per deployment overwrites for the most relevant pod fields like resources, affinities and processed queues, number of jobs and the sidekiq security contexts. The exact implementation was inspired by an upstream issue: https://github.com/mastodon/mastodon/issues/20453 * fix(chart): Remove linode default values from values This patch drops the linode defaults from the values.yaml since these are not obvious and can cause unexpected connections as well as leaking secrets to linode, when other s3 storage backends are used and don't explicitly configure these options by accident. Mastodon will then try to authenticate to the linode backends and therefore disclose the authentication secrets. * refactor(chart): Rework reduce value reference duplication Since most of the values are simply setup like this: ``` {{- if .Values.someVariable }} SOME_VARIABLE: {{ .Values.someVariable }} {{- end }} ``` There is a lot of duplication in the references in order to full in the variables. There is an equivalent notation, which reduces the usage of the variable name to just once: ``` {{- with .Values.someVariable }} SOME_VARIABLE: {{ . }} {{- end }} ``` What seems like a pointless replacement, will reduce potential mistakes down the line by possibly only adjusting one of the two references. * fix(chart): Switch to new OMNIAUTH_ONLY variable This patch adjusts the helm chart to use the new `OMNIAUTH_ONLY` variable, which replaced the former `OAUTH_REDIRECT_AT_SIGN_IN` variable in the following commit: mastodon/mastodon#17288 mastodon/mastodon@3c88579 * fix(chart): Repair connection test to existing service Currently the connect test can't work, since it's connecting to a non-existing service this patch fixes the service name to make the job connect to the mastodon web service to verify the connection. * docs(chart): Adjust values.yaml to support helm-docs This patch updates most values to prepare an introduction of helm-docs. This should help to make the chart more user friendly by explaining the variables and provide a standardised README file, like many other helm charts do. References: https://github.com/norwoodj/helm-docs * refactor(chart): Allow individual overwrites for streaming and web deployment This patch works how the streaming and web deployments work by adding various fields to overwrite values such as affinities, resources, replica count, and security contexts. BREAKING CHANGE: This commit removes `.Values.replicaCount` in favour of `.Values.mastodon.web.replicas` and `.Values.mastodon.streaming.values`. * feat(chart): Add option for authorized fetch Currently the helm chart doesn't support authorized fetch aka. "Secure Mode" this patch fixes that by adding the needed config option to the values file and the configmap. * docs(chart): Improve helm-docs compatiblity This patch adjust a few more comments in the values.yaml to be picked up by helm-docs. This way, future adoption is properly prepared. * fix(chart): Add automatic detection of scheduler sidekiq queue This patch adds an automatic switch to the `Recreate` strategy for the sidekiq Pod in order to prevent accidental concurrency for the scheduler queue. * fix(chart): Repair broken DB_POOL variable
nametoolong
pushed a commit
to nametoolong/nuage
that referenced
this pull request
Jan 12, 2023
…and more (mastodon#20733) * fix(chart): Remove non-functional Horizontal Pod Autoscaler The Horizontal Pod Autoscaler (HPA) refers to a Deployment that doesn't exist and therefore can not work. As a result it's pointless to carry it around in this chart and give the wrong impression it could work. This patch removes it from the helm chart and drops all references to it. * refactor(chart): Refactor sidekiq deployments to scale This patch reworks how the sidekiq deployment is set up, by splitting it into many sidekiq deployments, but at least one, which should allow to scale the number of sidekiq jobs as expected while being friendly to single user instances as well as larger ones. Further it introduces per deployment overwrites for the most relevant pod fields like resources, affinities and processed queues, number of jobs and the sidekiq security contexts. The exact implementation was inspired by an upstream issue: https://github.com/mastodon/mastodon/issues/20453 * fix(chart): Remove linode default values from values This patch drops the linode defaults from the values.yaml since these are not obvious and can cause unexpected connections as well as leaking secrets to linode, when other s3 storage backends are used and don't explicitly configure these options by accident. Mastodon will then try to authenticate to the linode backends and therefore disclose the authentication secrets. * refactor(chart): Rework reduce value reference duplication Since most of the values are simply setup like this: ``` {{- if .Values.someVariable }} SOME_VARIABLE: {{ .Values.someVariable }} {{- end }} ``` There is a lot of duplication in the references in order to full in the variables. There is an equivalent notation, which reduces the usage of the variable name to just once: ``` {{- with .Values.someVariable }} SOME_VARIABLE: {{ . }} {{- end }} ``` What seems like a pointless replacement, will reduce potential mistakes down the line by possibly only adjusting one of the two references. * fix(chart): Switch to new OMNIAUTH_ONLY variable This patch adjusts the helm chart to use the new `OMNIAUTH_ONLY` variable, which replaced the former `OAUTH_REDIRECT_AT_SIGN_IN` variable in the following commit: mastodon#17288 mastodon@3c88579 * fix(chart): Repair connection test to existing service Currently the connect test can't work, since it's connecting to a non-existing service this patch fixes the service name to make the job connect to the mastodon web service to verify the connection. * docs(chart): Adjust values.yaml to support helm-docs This patch updates most values to prepare an introduction of helm-docs. This should help to make the chart more user friendly by explaining the variables and provide a standardised README file, like many other helm charts do. References: https://github.com/norwoodj/helm-docs * refactor(chart): Allow individual overwrites for streaming and web deployment This patch works how the streaming and web deployments work by adding various fields to overwrite values such as affinities, resources, replica count, and security contexts. BREAKING CHANGE: This commit removes `.Values.replicaCount` in favour of `.Values.mastodon.web.replicas` and `.Values.mastodon.streaming.values`. * feat(chart): Add option for authorized fetch Currently the helm chart doesn't support authorized fetch aka. "Secure Mode" this patch fixes that by adding the needed config option to the values file and the configmap. * docs(chart): Improve helm-docs compatiblity This patch adjust a few more comments in the values.yaml to be picked up by helm-docs. This way, future adoption is properly prepared. * fix(chart): Add automatic detection of scheduler sidekiq queue This patch adds an automatic switch to the `Recreate` strategy for the sidekiq Pod in order to prevent accidental concurrency for the scheduler queue. * fix(chart): Repair broken DB_POOL variable # Conflicts: # chart/templates/deployment-sidekiq.yaml
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #15959
Introduced in #6540,
OAUTH_REDIRECT_AT_SIGN_IN
allowed skipping the log-in form to instead redirect to the external OmniAuth login provider.However, it did not prevent the log-in form on
/about
introduced by #10232 from appearing. It also completely broke with the introduction of #15228 to fix CVE-2015-9284.Restoring the previous log-in flow in all generality is not possible without also re-introducing CVE-2015-9284. Indeed, if a user is already logged in and goes through a OmniAuth external login page, the external identity will be given access to that local account. Doing this automatically without user intervention (through the redirect) is a security issue, as explained in omniauth/omniauth#809.
This PR replaces the broken
OAUTH_REDIRECT_AT_SIGN_IN
with anOMNIAUTH_ONLY
environment variable, which purpose is similar, but avoids CVE-2015-9284 by always requiring at least one click from a legitimate page on the instance before being logged in, and also addresses other UX concerns by avoiding confusing log-in forms that are not applicable to OmniAuth-only installations.When
OMNIAUTH_ONLY
istrue
:/auth/sign_in
and/about
to display only external log-in buttons/auth/sign_in
withmethod: :post
links to auth provider when a single one is defined