forked from AthenZ/athenz
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CHANGELOG
1369 lines (1157 loc) · 61.9 KB
/
CHANGELOG
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Athenz v1.11.50 Release / Jan 16, 2024
--------------------------------------
#2471 UI: add scope field to micro-segmentation table
#2472 use relocated mysql artifact id
#2474 support for IMSDv2 when reading AWS metadata
#2475 delete transport policies api, optional attribute for existing api
#2476 maintain a static map of trusted roles for resource list lookup api
#2477 don't use --user flag for local
#2478 mark trust role vars as volatile
#2479 remove sia run-after script path starting with / on windows
#2481 Change transport policy delete endpoint to match with create
#2480 UI: Add GCP scope for micro-segmentation policy
#2482 UI: Bump follow-redirects from 1.15.1 to 1.15.4 in /ui
Athenz v1.11.49 Release / Jan 03, 2024
--------------------------------------
#2455 UI: add logic to handle submit of role/group review
#2456 UI: fix first time user error
#2457 support proxyForPrincipal parameter in GenerateAccessTokenRequestString
#2458 UI: add missing props timeZone for policy versions
#2459 fix zms-cli calls for get role/group for review
#2461 make role/group review days limit configurable
#2463 UI: fix functional tests pt1
#2465 UI: Add functional test support for role and group review
#2466 UI: fix functional test sd job
#2467 UI: add maxmembers and self renew fields
#2468 UI: attempt to fix functional test
#2469 UI: fix functional test, tested and works
#2470 update java and go dependencies to their latest releases
Athenz v1.11.48 Release / Dec 06, 2023
--------------------------------------
#2414 Bump axios from 1.4.0 to 1.6.0 in /clients/nodejs/zts
#2423 libs/go/sia/access/tokens: fix dropped test errors
#2424 support max member limit on roles and groups
#2425 show notification bell icon more obviously with role/group to review
#2426 fix unbound variable errors in deploy-scripts
#2428 fix invalid audit log json on adding /deleting a template
#2431 support domain contacts
#2434 self-renew option for roles/groups
#2435 Bump ch.qos.logback:logback-classic from 1.4.11 to 1.4.12 in gcp_zts_creds
#2439 simplify expiry notification lookups
#2440 update java dependencies to their latest releases
#2443 extend schema for contact type to string
#2445 sia init/rolecert command line option - report error code for failures
#2446 add role and group review tabs
#2447 enhance zms-cli update-domain to handle assertions in existing policies
#2448 extend schema to allow : (colon) in Tag keys
#2449 missing tags from policy/service requests
#2450 unique error message for invalid/reserved service names
#2451 UI: fix bug when viewing roles, group is part of with expiry
#2452 new get transport policies for a domain and service api
#2453 zms-cli: add -audit-enabled flag for role/group add operations
#2454 update java and go dependencies
This release includes required schema updates:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20231120.sql
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20231122.sql
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20231127.sql
Athenz v1.11.47 Release / Nov 20, 2023
--------------------------------------
#2398 UI: add GCP project ID in manage domains
#2399 update service provider manager test case
#2400 UI: upgrade prettier and run fix-lint
#2403 Enable use of locally built components in local Docker environment
#2405 Fix the server side authorization for the msd api to return kubernetes network policy object
#2406 UI: centre align business service column
#2408 provide Roles/ExternalCredentials interfaces for instance providers
#2409 zts gcp dns client example
#2410 UI: pull in the latest and greatest rdl endpoints
#2411 expose sandns_x509_cnames field in sia config file
#2415 simplify error messages for access tokens to avoid confusion
#2416 new role/group/domain attributes - no implementation
#2418 provide option to request issuer based on external creds attributes
#2419 update go host ip check test case to ignore docker/bridge interface
#2421 update java and go dependencies to their latest releases
#2422 new msd api to create transport policy
Athenz v1.11.46 Release / Nov 07, 2023
--------------------------------------
#2324 Extract and reuse duplicate helper function ExtractSignerInfo
#2388 for notification emails expand groups and delegated role membership
#2391 replace interface{} with string for zms-cli import operations
#2392 support proxy principal spiffe uri in access token requests
#2393 new bit to disable notifications over a week away
#2396 msd api to return kubernetes network policy object
#2397 for groups to disable expiry notfs look for both expiration/reminder tags
Athenz v1.11.45 Release / Oct 30, 2023
--------------------------------------
#2358 UI: fix add/edit tags for policy and service
#2361 Fix service tags tab hiding other tabs
#2365 failure with insert principal where 2 roles are created simultaneously with the same new member
#2366 Add GetZone from meta endpoint for gcp
#2367 oidc response - make redirect uri optional if json output is requested
#2368 failure with insert principal where 2 roles are created simultaneously with the same new member
#2370 double encoding name parameter for deleteStaticWorkload
#2372 bump awssdk from 2.20.162 to 2.21.6 for netty vuln
#2375 remove redirect-uri from fetch id token call since it's optional for json output
#2376 new zms-cli option show-domain-attrs to display domain attributes
#2377 fix membership approval email view in gmail
#2378 adding support for service_name.service_namespace.svc in K8S san dns
#2379 Temporary network issue causes aws temp creds stop refreshing
#2381 allow updating the last_reviewed_date for role/group through meta api
#2382 clean-up hostname verifier support in zts java client
#2384 replacing wix-embedded-mysql with testcontainers-java
#2386 update jetty/java/go deps to their latest releases
Athenz v1.11.44 Release / Oct 20, 2023
--------------------------------------
#2323 fetch verification key from server during access token validation
#2342 UI: Add microsegmentation to services table
#2344 Creating a PR Template file
#2345 Bump golang.org/x/net from 0.16.0 to 0.17.0
#2346 Make KeyRefresher's background thread more efficient
#2347 UI: add fetcherError null check, debug only if there is error
#2348 fix 'make deploy-local'
#2349 change the athenz-zpe-java-client jacoco coverage threshold from 0.8711 to 0.8702
#2350 Fix pr template
#2351 provide domain authz for expanded role lookup
#2352 Introduce new endpoint to search workloads by domain and services
#2355 provide zms endpoint to return list of roles and groups for review
#2356 Update go zpe README.md
#2357 updated go/grpc and java dependencies
#2360 Update LY Corporation name (formerly known as Yahoo! Japan)
#2362 msd go client sync up with rdl
Athenz v1.11.43 Release / Oct 10, 2023
--------------------------------------
#2304 UI: add role description tooltip
#2315 UI: Fix delete static workload
#2317 UI: Show msd error
#2318 DB names are lower case for last notification time check
#2319 UI: fix user service users map
#2320 UI: Make project labels selectable on GCP login page
#2321 Extract and export ClientTLSConfigFromPEM
#2322 UI: skip loading on parent component for msd edit
#2325 log x509 cert serial number in the access log files
#2326 UI: updated rdl schemas
#2327 UI: Add support for CIDR blocks and fix search for static instances
#2328 UI: When user selects scope aws, disable report mode
#2329 unit test for jwt with none algorithm by @havetisyan in #2329
#2330 UI: Fix gcp login initially loading error no roles incorrectly
#2333 UI: sanitize error logs
#2336 support omit-domain flag in sia through ATHENZ_SIA_OMIT_DOMAIN env variable
#2337 add logic to skip packages during publish
#2338 using a dedicated regex for msd static workload name validation
#2339 fix test access token signing key to 2048bit+ for valid testing
#2341 update java/go dependencies to their latest releases
Athenz v1.11.42 Release / Sep 13, 2023
--------------------------------------
#2210 UI: add support for policy tags
#2237 UI: add support for service tag
#2294 zts server code cleanup - replace deprecated calls, etc
#2295 zms server code cleanup - replace deprecated calls, etc
#2296 container library code cleanup - replace deprecated calls, etc
#2297 auth-core library code cleanup - replace deprecated calls, etc
#2298 common libraries code cleanup - replace deprecated calls, etc
#2299 server common library code cleanup - replace deprecated calls, etc
#2300 handle assertion conditions in putPolicy api
#2301 libs/go/zmscli: fix dropped errors
#2303 update jacoco code coverage percentages
#2305 make sure only one notification run per-day
#2307 new static instance type - service_subnet
#2309 Add accountId, projectNumber, launchTime in raw.Doc
#2311 Add new fields to hostdoc.Doc
#2312 utils/zts-svccert: fix dropped errors
#2313 new store-token-option to store access token without quotes
Athenz v1.11.41 Release / Sep 01, 2023
--------------------------------------
#2284 add constructor to allow proxy configuration
#2285 include assertion conditions in get policy response
#2286 use better env variable to get just the tag name
#2287 create sbom for athenz components
#2288 consolidate all email notifications so the user gets only one email per notification type
#2289 fix review group page error with expiry settings
#2290 support getting SIA access token config from env variable
#2291 new buildSSLContext method based on ca/cert/key pem strings
#2292 update jetty/java/go dependencies to their latest releases
#2293 dump description in zms-cli show-role command
Athenz v1.11.40 Release / Aug 25, 2023
--------------------------------------
#2272 UI: ability to add members by searching for their names
#2278 add a new static validator type in msd
#2279 improve error logging when validating role cert csr
#2280 UI: Add search capability for Add Group component
#2283 libs/go/sia/agent/devel/ztsmock: fix dropped error
Athenz v1.11.39 Release / Aug 18, 2023
--------------------------------------
#2270 include gcp instance name in identity cert uri
#2271 UI - Update product Id link
#2273 allow aws attestation role only include service name
#2274 [skip ci] docker build using actions
#2275 provide config option to specify external creds providers
#2276 remove item from fetch queue if zts reports bad request
#2277 avoid ConcurrentModificationExceptions when processing domain updates
Athenz v1.11.38 Release / Aug 08, 2023
--------------------------------------
#2262 new optional attribute in instance identity register/refresh request
#2263 skip tests if -DskipTests=true is provided
#2264 support adding cert to secret manager
#2265 Generic Kubernetes provider for Athenz
#2266 support external gcp access token support from registered projects
#2267 add wildcard support for ServiceSkipDomains
#2268 fix for deploying Athenz UI container locally
Athenz v1.11.37 Release / Jul 28, 2023
--------------------------------------
#2248 fix policy tags fetch + increase unit test coverage
#2249 introduce shutdown method for connection logger
#2250 introduce feature-flags system attribute for domains
#2251 support new allow service underscore feature flag
#2252 allow specifying cipher suites for the ui server via config
#2254 Add test for get policy
#2255 add set-role-description option in zms-cli
#2256 use read replica when fetching domain change list in read-only mode
#2261 support proxy auth with gcp http transport
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230724.sql
Athenz v1.11.36 Release / Jul 21, 2023
--------------------------------------
#2195 Add support in service tags
#2219 Adding policy tags
#2240 update deps and move from sun.jakarta.mail to angus-mail
#2243 Bump word-wrap from 1.2.3 to 1.2.4 in /ui
#2244 for go gcp function sia - provide method to store identity in secret manager
#2246 add support for new spiffe format in gcp java cloud function support
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230606.sql
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230717.sql
Athenz v1.11.35 Release / Jul 15, 2023
--------------------------------------
#2230 update zms-cli getDomain call to use JWS domain
#2232 extend principal role lookup api with expand option
#2233 Bump semver from 5.7.1 to 5.7.2 in /ui
#2234 extend GetSanUri method to take spiffe trust domain/namespace arguments
#2235 Initiate AthenzSslContextFactory as part of AthenzJettyContainer
#2236 Make the properties of functions.SiaCertData public (Capitalized)
#2239 support numeric and string product ids in zms-cli
Athenz v1.11.34 Release / Jul 07, 2023
--------------------------------------
#2220 Go code to get SIA certs from a CGF (Google Cloud Function)
#2221 exclude bc jdk15on from pom in favor of jdk18on
#2222 config options to specify preferred key algorithms for zts sign operations
#2223 Support PKCS#8-formatted private key in zts go tools
#2224 improve error reporting from gcp identity provider
#2228 introduce trust-domain/namespace components into service spiffe uri
Athenz v1.11.33 Release / Jun 28, 2023
--------------------------------------
#2124 UI: apply timezone settings
#2202 add wildcard support for ServiceMemberSkipDomains
#2203 increased/configure json string limit for jackson
#2204 Generic way to handle tags
#2207 log Athenz principal as part of the JettyConnectionLogger
#2209 GCP functions identity support for Java
#2211 refactor out request pkg in zts client
#2212 Prevent int/long buffer overflow returning false always
#2213 correct handling of role cert key path when service key filename is user-specified
#2214 provide capability to provide proxy host details for gcp-zts-creds
#2215 update dependency libraries to their latest releases
#2216 add license headers + full code coverage
Athenz v1.11.32 Release / Jun 05, 2023
--------------------------------------
#2197 support headless user type - managed by user authority but treated like service
#2198 disable wadl output
#2199 update java and go dependencies to their latest releases
Athenz v1.11.31 Release / May 30, 2023
--------------------------------------
#2173 Disable Microsegmentation validation checkbox for AWS env
#2177 Deriving ssh cert principals from the GCP provider attestation data to validate the incoming sshrequest
#2178 add principals from metadata in ssh cert request
#2179 add overwrite option for zms-cli
#2180 UI: replace deprecated request pkg
#2185 fix role update on expiration and review dates
#2189 UI: checked in package-lock.json was generated with old npm version
#2190 support athenz as oidc provider for aws iam
#2191 disallow by default services with _ in their names
#2193 support product id (string) format association with domains
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230528.sql
Athenz v1.11.30 Release / May 16, 2023
--------------------------------------
#2166 option to return id token in json output instead of redirect uri
#2167 for oidc redirect uri check both configured endpoint and auto-generated value
#2168 new athenz-gcp-zts-creds library to simplify fetching Google credentials based on ZTS ID Tokens
#2169 option to continuously update zts domain cache files
#2170 single command line argument for sia called init
#2174 provide run-after (cert/tokens) capability for sia
Athenz v1.11.29 Release / May 06, 2023
--------------------------------------
#2143 UI: Ensure metastore error does not interfere with UI usability
#2150 return dns suffix through method so the AWS Provider can be extended
#2151 correct handling of java client code generation for status 302
#2157 for id tokens with group scope always use full arns
#2161 sia copy if source file exists, gcp meta functions to get instance ip
#2163 expose getIdToken methods in ZTS Java Client
#2164 Update dynamodbMaxRetries to avoid Integer Overflow
#2165 better attribute name for Athenz domain in GCP project metadata
Athenz v1.11.28 Release / Apr 28, 2023
--------------------------------------
#2141 feat: code signing provider
#2142 fix NPE while setting User Authority Expiration for role without members
#2144 Set a connect timeout when fetching JWT signing keys
#2145 limit the number of entries in the zpe client library token cache
#2146 allow use of cluster names in san dns entries for eks
#2147 config setting for reserved top level domains
#2148 sia agent - exit when refresh fails after configured number of attempts
#2149 gce fix for host cert principals and x509 cert expiry
Athenz v1.11.27 Release / Apr 22, 2023
--------------------------------------
#2133 msd static services by type api
#2134 fix k8s dns svc.cluster.local entry use of spec.hostname
#2135 update jetty to latest 11.0.15 + other dependencies
#2137 remove default 120 min token expiry from access/role-token tools
#2138 if direct update option is set for go util.Update, file must be writeable by owner
#2139 update svc/role cert tests cases for macos
#2140 update zms expiry notification unit test
Athenz v1.11.26 Release / Apr 17, 2023
--------------------------------------
#2125 relax san dns check rules for k8s suffixes - svc.cluster.local/pod.cluster.local
#2126 zms/utils helper methods in athenzutils go library
#2127 designate separate action for assertions when assuming gcp service accounts
#2128 sia: use hostname -f if os.Hostname does not return fqdn
#2130 making access_management optional based on a config for EKS
#2131 for eks/gke generate san dns entries based on k8s dns spec
#2132 same openjdk version in doc as ci/cd
Athenz v1.11.25 Release / Apr 06, 2023
--------------------------------------
#2107 UI: Add support delete static instance
#2116 UI: fix static instance view
#2117 Log notification email sent details - subject and recipients
#2118 UI: Fix UI MSD policy validation
#2119 Update DB Dockerfile to fix deploy-dev
#2120 relax sandns check for aws instances to require configured suffix with domain/service values
#2121 support ssh_principals field in sia_config with cert_request object for ecdsa
#2122 allow ssh-principals with service name based dns cnames
#2123 gcp sia
Athenz v1.11.24 Release / Mar 27, 2023
--------------------------------------
#2095 UI: add related changes for gcp support
#2097 Add support for loading unencrypted pkcs8 keys
#2106 define ipv4Prefix (gcp) as alias for ip_prefix (aws) for ip documents
#2108 update ddb-local version. 1.20.0 in maven is missing classes
#2109 UI: hide the link to INSTANCES when featureFlag is set to false
#2110 Rename variables and include project id in view
#2113 store GCP project number along with project id in athenz domain metadata
#2114 convert boot timestamp from seconds to milliseconds
#2115 special resource for gcp starting with services/
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230326.sql
Athenz v1.11.23 Release / Mar 21, 2023
--------------------------------------
#2056 pending request for delete member from protected role
#2064 UI: Add scope to MSD policies
#2087 set the locale to be used for log testing
#2090 make aws/gcp assume role action values configurable
#2091 Add optional 'description' to role
#2092 rename profile_tag to profile_restrict_to
#2094 update zms server schema to set tag key column with utf8-bin collation
#2102 for id token requests, carry out full role name match and not suffix
#2103 GCP GCE & GKE provider
#2104 zms-cli online help - correctly identify gcp project id and not name
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230308.sql
Athenz v1.11.22 Release / Feb 28, 2023
--------------------------------------
#2079 set GOPATH from 'go env GOPATH' if not set
#2080 correct handling of group members that are system disabled and then enabled
#2081 UI: use user domain of config value when making requests to zms
#2082 Add profileTag support to sia-aws
#2083 add delete-protection commands to help list
#2084 allow services to get id token with max 12 hr expiry
#2085 UI: handle case where details.ipAddresses is undefined
#2086 update jetty and other java dependencies to their latest release
Athenz v1.11.21 Release / Feb 18, 2023
--------------------------------------
#2055 UI: add audit enabled setting to role
#2062 update rdl install step for latest go
#2063 add scope to the AssertionCondition for MSD
#2065 UI: add gcp project id to domain ui
#2066 UI: override the nested dependencies got and qs
#2067 extends group with deleteProtection attribute and pending group membership
#2068 extend zms-cli to set delete-protection flag for roles
#2070 UI: fix ScrollWatch test
#2071 UI: Add delete role functional tests
#2074 change zpe log level to warn when it fails to get keys from preconfigured sources
#2076 update go dependencies to their latest releases
#2077 UI: update dev jest dependency version
#2078 clarify the deprecation of role members attribute in rdl
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230207.sql
Athenz v1.11.20 Release / Feb 03, 2023
--------------------------------------
#2052 update maven plugin versions
#2053 Add a requirement for admin approval to delete members in review-enabled roles
#2054 support multiple domains when requesting oidc id tokens
#2057 correct handling of token/role cert if dirs are not default
#2061 missing primary key definition from principal_group_member table
This release includes a required schema update:
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230124.sql
https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20230203.sql
Athenz v1.11.19 Release / Jan 27, 2023
--------------------------------------
#2043 move cloud provider role generation logic out of dbstore library to dbservice
#2044 separate agent dir/process setup into a separate method
#2046 UI: Bump cookiejar from 2.1.3 to 2.1.4 in /ui
#2047 UI: Bump ua-parser-js from 1.0.32 to 1.0.33 in /ui
#2048 replace zmsTestInitializer references with local variables
#2049 adding support for user access management profile option in sia eks
#2050 support pod based dns hostname for eks
#2051 update package dependencies
Athenz v1.11.18 Release / Jan 20, 2023
--------------------------------------
#2028 UI: setup functional test with webdriverio
#2037 use correct role prefix when filtering tenant resource group roles
#2038 support role audit enabled set for domain admins using zms-cli
#2039 sia config option to update key/cert file directly instead of using rename
#2040 provide configuration options for sia key/cert/token/backup directories
#2041 Add build version to sia-ec2
#2042 update package-lock.json to match package dependencies
Athenz v1.11.17 Release / Jan 11, 2023
--------------------------------------
#1984 UI: Delete Instance from UI
#2026 validate ssh host certificate line including cert filename
#2029 support sandns_hostname for aws ec2
#2030 UI: just run the fix_lint
#2031 UI: Bump json5 from 2.2.1 to 2.2.3 in /ui
#2032 allow domain admins to enable audit flag for new roles/groups
#2033 update pkg dependencies to their latest releases
#2035 Add SIA AWS option for certificate expiry threshold check
#2036 update zms go auto-generated code for audit enabled flag
Athenz v1.11.16 Release / Dec 19, 2022
--------------------------------------
#2006 UI: fix review tab for roles to correctly handle default options
#2007 improve messaging for groups in admin roles and detect error sooner
#2011 UI: simplify way to change user's expiry/reminder dates
#2015 UI: bump decode-uri-component from 0.2.0 to 0.2.2 in /ui
#2016 fix the table overflow in the email notification's body
#2017 UI: Bump qs from 6.5.2 to 6.5.3 in /ui
#2018 remove netty override version from syncer pom.xml
#2020 UI: Separate members and pending members into 2 different maps in the view
#2021 update jetty + deps to their latest release
#2023 Return the correct response from putMembership/putGroupMembership on pending members
#2025 support ssh host key type attribute in sia config options
Athenz v1.11.15 Release / Dec 5, 2022
-------------------------------------
#1971 UI: Upgrade node from 14 to 18
#1974 UI: Bump d3-color from 3.0.1 to 3.1.0 in /ui
#2000 upgrade examples to use the latest athenz libs
#2001 ignore errors when adding a new user to an empty admin role
#2002 UI: Bump @xmldom/xmldom from 0.7.5 to 0.7.9 in /ui
#2003 Fix showing in role users page the full role name
#2004 replace golang ioutil deprecated calls
#2005 add gcp project attribute for domains
#2009 Upgrade protobuf java to fix vulnerabilities warning
#2010 UI: Bump minimatch and recursive-readdir in /ui
#2012 UI: Display input for entering justification when needed
#2013 switch from keep_privileges to drop_privileges for service identity agents
#2014 update dependency packages
Schema Update: https://github.com/AthenZ/athenz/blob/master/servers/zms/schema/updates/update-20221122.sql
Athenz v1.11.14 Release / Nov 3, 2022
-------------------------------------
#1991 UI: change the api file
#1996 aws sia: pass correct key flags to the save key method
#1997 update go dependencies to their latest releases
#1999 during role delete check policy usage against primary db
Athenz v1.11.13 Release / Oct 19, 2022
--------------------------------------
#1993 fix role key filemode in sia
#1994 deps update - address jackson databind and protobuf CVEs
Athenz v1.11.12 Release / Oct 17, 2022
--------------------------------------
#1972 Delete static workload expects resource name and not instanceId
#1985 UI: Fix pipeline
#1986 UI: Change the api file
#1987 extend role support in identity agent to specify service ownership
#1988 support new expiry threshold setting for access token refresh
#1990 expose getRdlSchema api endpoint in clients
Athenz v1.11.11 Release / Oct 10, 2022
--------------------------------------
#1973 UI: Fix spec file
#1976 UI: upgrade multer version
#1977 UI: fix integration test cases
#1978 fix putServiceIdentity logic to allow update of exising pubKey
#1980 UI: fix integration test cases
#1981 Use correct object type for role member delete notifications
#1982 fix zms-cli online help for adding temporary members
#1983 update sia-ec2 access profile logic
Athenz v1.11.10 Release / Sep 26, 2022
--------------------------------------
#1949 UI: Bump moment-timezone from 0.5.34 to 0.5.35 in /ui
#1961 Returning uniq ips from network interfaces found on the host
#1964 enable readWrite db connection for delete expired members
#1965 UI: redux support
#1966 consistent formatting of mysql commands
#1967 consistent use of The Athenz Authors copyright in all files
#1968 make server purge expiry member day configurable
#1969 update jetty and other deps to their latest release
#1970 support fetching zts/zms/key/cert values form ~/.athenz/config file
Athenz v1.11.9 Release / Sep 15, 2022
-------------------------------------
#1953 docker build upkeep
#1954 In tokens lib - return successfully refreshed tokens
#1956 use full path for id/system commands in service identity agents
#1957 fix put policy zms client api with return object argument
#1958 update dependency packages to their latest releases
#1960 Update sia-libs to fetch access profile information for EC2
Athenz v1.11.8 Release / Sep 5, 2022
------------------------------------
#1941 auto purge expired role/group members based on server/domain config
#1950 include optional attestation data string for ssh cert requests
#1951 move aws document validation into a utils class
#1952 In athenz-auth-core skip tests for arm architecture
Athenz v1.11.7 Release / Aug 28, 2022
-------------------------------------
#1945 fix returning role/group objects when requested by ui
#1946 update aws sdk + slf4j
#1947 remove unused dependencies/imports + constructor
#1948 update model generation for go 1.19
Athenz v1.11.6 Release / Aug 16, 2022
-------------------------------------
#1928 allow management of domain memberPurgeExpiryDays setting value
#1929 use auto-generated redirect uri for oidc requests
#1932 Fixes for auth history
#1936 Update log4j version in zms_syncer
#1937 Add delete MSD workload interface
#1938 update swagger-ui to 4.x
#1939 For sia access tokens - check expiry in claims
#1940 zts-rolecert: fix error message to include role key path
#1942 provide header option to return updated object in response
#1943 updated package dependencies
#1944 sort rdl headers for go client generation for defined order
Athenz v1.11.5 Release / Jul 19, 2022
-------------------------------------
#1910 Publish athenz-syncer-common package
#1911 Fixed auth history syncer + properties
#1912 report conf not found messages at info and not error level
#1913 allow users to remove themselves from roles/groups
#1914 Auth_history_syncer - prevent table creation by default
#1915 Add zms aws jws domain syncer
#1916 add zms aws json domain syncer to archive
#1917 Bump moment from 2.29.2 to 2.29.4 in /ui
#1918 update go library dependencies to their latest releases
#1919 schema update: role/policy - description, domain - purge expiry days
#1920 update dependency packages to their latest releases
#1921 update put static workload from zms to msd
#1924 Add URI parsing in createHttpClient
Athenz v1.11.4 Release / Jul 1, 2022
------------------------------------
#1889 zpu use jwk keys from sia
#1891 Implement auth_history_syncer
#1903 Disable client TLS renegotiation in UI and added strict policy header
#1904 Bump netty-codec-http from 4.1.72.Final to 4.1.77.Final in /syncers/auth_history_syncer
#1905 update zpe java library to use jwk conf file + api
#1906 fix support for aws assume roles with / in the name
#1907 Authentication History UI
#1909 verify key/cert public keys + use BC Provider for EC support
Athenz v1.11.3 Release / Jun 24, 2022
-------------------------------------
#1863 Add athenz service access token support to SIA EKS sidecar
#1892 provide option to specify a retainable byte buffer pool for jetty
#1893 UI: fix tab redirect from settings to visibility
#1894 updating go crypto version to latest
#1895 Update nodejs package winstonjs
#1896 when athenz jwk conf file does not exist we should return zero time instead current time
#1898 avoid spamming server logs with attribute not available messages
#1899 update jetty and other dependencies to latest release
#1900 make crypki connection pool settings configurable
Athenz v1.11.2 Release / Jun 3, 2022
------------------------------------
#1876 Athens JWK config
#1880 Fix for role member expiry notifications
#1881 Exposed authentication history in zms-cli and ZMS Java / go clients
#1882 support getting id tokens for tenant domains
#1883 increase test coverage and fix copyrights
#1884 athenz jwk config for sia agent
#1885 return specific error message instead of generic dns suffix failure
#1886 review all api possible resource exceptions in rdl
#1887 updated dependencies to their latest releases
#1888 AuthHistory - Return dependencies instead of list
#1890 allow config of request log retain days
Athenz v1.11.1 Release / May 19, 2022
-------------------------------------
#1866 Bump ejs from 3.1.6 to 3.1.7 in /ui
#1868 use 1.7 slf4j for clients, while 2.x for servers
#1869 validate spiffe uri for zts-svccert requests
#1870 Adding an api method to MsdStoreConnection to help in building caches
#1872 Generic metric implementation with increment change value
#1873 small timeout after starting mock meta/zts servers with unique port numbers
#1874 expose servlet context to web application
#1875 Get Auth History implementation
#1877 add /info endpoint for zms/zts servers
#1879 unit tests for the /info endpoints
Athenz v1.11.0 Release / May 11, 2022
-------------------------------------
Due to the upcoming End of Community Support for Eclipse Jetty 9.4.x on June 1st, 2022,
starting with the 1.11.0 release, Athenz services and libraries are being upgraded to
use the latest Jetty 11.x release. This release also requires the use of JDK 11.x with
the jakarta namespace and jersey 3.x instead of JDK 8.x with javax namespace and jersey 2.x.
To avoid compatibility issues with jersey 3.x and applications already running with
jersey 2.x, Athenz team has decided to rewrite our java client code generators to
remove dependency on jax-rs and jersey. Instead, the ZMS and ZTS java clients now
have a direct dependency on Apache Http Client (in the 1.10.x the clients were still
using the Jersey Apache Connectors). Unfortunately, these changes introduce a couple
of backward incompatible changes in the 1.11.x release so when upgrading your clients
to the latest release, make sure to review your code and make the necessary changes.
The following is the list of all changes that are introduced in the 1.11.x release:
- The ZMS, ZTS and ZPE java clients are built and require JDK 11. JDK 8.x is only
supported in the 1.10.x release which will continue to be supported. However,
new versions of the 1.10.x will only be released to address bug fixes or security issues.
- ZTS java client (artifact id: athenz-zts-java-client) is NO longer a shaded library.
If you’re deploying the ZTS java client as part of your application, make sure you
deploy all of its required dependencies.
- ZTS java core/non-shaded client (artifact id: athenz-zts-java-client-core) has been
removed. You can just replace your dependency with the standard ZTS client library
(artifact id: athenz-zts-java-client) since it’s no longer a shaded package and
provides the same functionality as the core package.
- The setProperty() and getClientBuilder() methods in both ZMS and ZTS client libraries
have been removed since they were used to set the javax.ws.rs.client.Client properties
and the clients no longer use the jax-rs clients.
#1857 UI: validate source/destination service in microsegmentation
#1858 Provide support to write host document in sia libs
#1859 test: use T.TempDir to create temporary test directory
#1861 fix logic in go IsExpiryAfterThreshold method
#1865 update to jetty 11, remove jersey from client impl
Athenz v1.10.54 Release / Apr 19, 2022
--------------------------------------
#1847 UI: set csp defaults to false and add form action from config
#1848 Bump moment from 2.29.1 to 2.29.2 in /ui
#1849 Make aws email provider public
#1850 When deleting tenant resource group roles, delete dependency if the only admin role left
#1851 UI: update selectAll enum and don't validate date for reject request
#1852 UI: allow adding multiple csp formAction and imgSrc
#1853 add group and membership support for zms-cli update-domain command
#1854 remove unused method arguments
#1855 access log 127.0.0.1 is addr is null, make use of x-forwarded-for configurable
Athenz v1.10.53 Release / Apr 08, 2022
--------------------------------------
#1821 sorting and filtering for roles in Add Member
#1822 add tag icon for group
#1835 UI: Visibility - Domain dependency page
#1836 do not set error state for optional ca issuer validation check
#1837 throw zts client exceptions instead of null ones for better error reporting
#1838 syscall set uid/gid api not available on windows
#1839 reset provider list if role has no members
#1840 improve auth error handling in swagger filter
#1841 NetworkPolicyChangeImpactRequest modification
#1842 remove resetting ca truststore password to avoid key refresh failures
#1843 update jetty and aws components to their latest releases
#1844 validate expiry/review date in workflow page
#1845 remove unnecessary is member check from member decision calls
#1846 no need to update domain's last mod timestamp during put dependency call
Athenz v1.10.52 Release / Mar 29, 2022
--------------------------------------
#1828 UI upkeep
#1829 UI: allow src/destination service to be empty and send assertionID
#1832 update dependencies - jackson/gradle fix
#1833 clear trust store password after sslcontext creation
#1834 drop privileges for sia user from root to configured user, if possible
Athenz v1.10.51 Release / Mar 27, 2022
--------------------------------------
#1786 UI: Bump next from 12.0.9 to 12.1.0 in /ui
#1816 Add provider webhook for verifying if domain should be allowed to be deleted
#1817 Ability to validate CA issuers in Authorities with Certificate support
#1818 Endpoint to get dependent services and resource groups
#1819 fixes to get working docker build
#1823 Allow ZMS startup even if service provider client not configured
#1825 Heap inspection - use char[] for passwords instead of Strings
#1826 making peer optional to allow explicit deny
#1827 UI: Bump minimist from 1.2.5 to 1.2.6
Athenz v1.10.50 Release / Mar 14, 2022
--------------------------------------
#1791 UI: update retry logic to get assertionId and treat 404 as success for deletion
#1805 disable role member expiry notification
#1807 Move Symlink from hostcert to futil
#1808 add to guide
#1809 Matching uncompressed IPs of the hostname during SecureBoot validation
#1811 add cert utils fir sia libs
#1812 return server template names in sorted order
Athenz v1.10.49 Release / Mar 07, 2022
--------------------------------------
#1789 Domain Dependency for Tenancy
#1795 fix lookup of sia integer env variables
#1796 parameterizing sshcaKeyId
#1797 Athenz ZTS QosFilter support for cert requests
#1798 [skip ci] Update MAINTAINERS
#1799 clarify settings for provider ssl client object
#1800 UI: add domain view for pending-approval requests
#1802 fix IAM role name in README
#1804 add ADOPTERS file
#1806 reusing sslContext from ZTS in class based InstanceProvider
Athenz v1.10.48 Release / Feb 24, 2022
--------------------------------------
#1781 For domain dependency, sys admin can be a service
#1782 UI - Bump follow-redirects from 1.14.7 to 1.14.8 in /ui
#1783 update pending member api to support getting list for a domain
#1784 for sia return uid/gid for current user instead of root
#1785 sia - for eks region provide option to use env variable first
#1787 provide option to skip adding principal when on-boarding a resource group
#1788 support athenz.client@ as user-info in provider endpoint to use zts client certs
#1790 Adding SecureBoot Provider
#1792 Adding methods to create folders and write content to file with implicit sync
#1793 adding msd service to fileprivatekeystore
#1794 support running sia as non-root
Athenz v1.10.47 Release / Feb 11, 2022
--------------------------------------
#1777 Add domain dependency functions to zms java and go clients
#1778 all refresh interval and zts region from config
#1779 make cert retry property settings dynamic
#1780 update jetty to 9.4.45 + other dep updates
Athenz v1.10.46 Release / Feb 07, 2022
--------------------------------------
#1710 UI - add retry logic and feature flag in micro-segmentation
#1758 Service Visibility - Domain Dependencies
#1759 fix fargate /task uri and use v1 metadata api only
#1760 process service/role/policy in correct order in zms-cli update-domain
#1761 specify TLS 1.2/1.3 version for RDS communication with IAM creds
#1763 remove unnecessary load of all config settings during startup
#1764 log all dynamic config changes at info level
#1765 UI - bump next from 12.0.7 to 12.0.9 in /ui
#1766 Adding methods to use ssh host keys and certs
#1767 UI - update UI tests
#1768 support kubectl ExecCredential json output support for id tokens
#1769 rfc8414 OAuth 2.0 Authorization Server Metadata
#1770 UI: fix bugs in micro-segmentation view
#1771 UI: update test and display validation errors
#1772 add HostCertificate option line to sshd if doesn't exist
#1773 Adding methods and a utility program to parse host document
#1774 support new get-stats endpoint to get per-domain/system stats
#1775 write to sds cert updates channel only if sds is enabled
#1776 add skip error option for zms-cli import domain
Athenz v1.10.45 Release / Jan 25, 2022
--------------------------------------
#1732 UI: add graphical view of micro-segmentation policies
#1750 fix zmscli case for new add-regular-role cmd
#1751 UI: Fix Dates for HistoryList and RoleHistoryList tests
#1752 make role validation config based, remove support for wildcards
#1753 Update roadmap for Q1 2022
#1754 Athenz OIDC Authentication Provider Support for AWS EKS Guide
#1755 provide signing key-type (RSA/EC) option when requesting oidc id tokes
#1756 add get private key per algorithm support for aws s3 keystore
#1757 updated package dependencies to their latest releases
Athenz v1.10.44 Release / Jan 20, 2022
--------------------------------------
#1727 role consistency check when deleting roles or adding assertions
#1740 use role/group meta api to update tags
#1742 Letting ZMSImpl initialize, when change publisher is not initialized
#1743 add NoOpTransportPolicyValidationFactory and fix assertionID to be Long
#1744 support implicit flow of oidc to issue id tokens for groups/roles
#1745 zts-idtoken utility to fetch oidc id token
#1746 use add-regular-role in zms-cli instead of add-group-role
#1748 for ecs verify the instance id based on request data
#1749 fix command case options for sia
Athenz v1.10.43 Release / Jan 07, 2022
--------------------------------------
#1705 Use Config Manager to refresh configuration
#1711 define slf4j version as property
#1712 using SSHCertRequest object in instance register/refresh requests
#1713 archive unused HttpCertSignerFactory and HttpCertSigner classes
#1714 replace go get with go install as recommended by go 1.17
#1715 protect system admin users from being removed from deleteUser api
#1716 support sshcertrequest object in instance register/refresh operations
#1717 remove abstract http cert signer class
#1722 log all ssh certificate requests with info level
#1724 add openid-configuration support for zts
#1725 validate ip from x-forwarded-for before logging
#1726 allow tokens to include openid issuer
#1729 Update manual build and development steps
#1731 Msd viplb workload type, ui dependencies update, docker fixes
#1733 correct handling of user authority if not set
#1734 remove null test case for ssmclient - fails when build is run on aws
#1735 docker-fixes
#1736 update manual install steps with fixes
#1737 allow * as service in micro-segmentation
#1738 openapi documentation update
#1739 UI: setup config for csp local source url instead of hardcoded localhost
Athenz v1.10.42 Release / Dec 19, 2021
--------------------------------------
#1708 increase publish timeout to nexus to 60 mins
#1709 update jackson/logback libraries to address CVEs
Athenz v1.10.41 Release / Dec 17, 2021
--------------------------------------
#1661 UI: add validation of micro-segmentation policies
#1682 introduce backward compatible option for x.509 cert san values
#1683 For cert priority fixed unspecified value for crypki
#1684 additional checks when converting sigs from der to p1363 format
#1685 Added comment explaining cert priority enum and link to crypki
#1686 UI: Upgrade to next-v12 and routing update to next/router
#1687 UI: Bump validator from 13.6.0 to 13.7.0 in /ui
#1688 update transport policy validation response object to add assertion id
#1689 UI: Code coverage increase
#1690 envoy sds support for sia agents
#1691 UI: Bump next from 12.0.4 to 12.0.5 in /ui
#1692 UI: update search page for Next.js 12
#1694 UI: fix history page bug
#1695 correct padding when converting sigs from der to p1363
#1696 migrate from logutil to std log package
#1697 aws imds v2 metadata api support
#1698 support multiple dns suffixes for token/role based cert requests
#1699 support role principal from uri in cert authority
#1700 correct logging of role principal in audit/access logs
#1702 add option caPubKeyAlgo for ssh cert requests
#1703 extend zpu to provide -check-status and -check-details options for monitoring
#1704 UI: fix switching between domains do not change the business service
#1706 define alphabetical order for running tests
#1707 updated deps to their latest releases
Athenz v1.10.40 Release / Nov 16, 2021
--------------------------------------
#1618 UI: remove + button to add member in micro-segmentation
#1631 UI: Advanced Settings in Role Creation Dialog
#1669 UI: group tags support
#1671 Support priority handling for cert signing
#1672 UI fix: Group settings User Authority Filter
#1673 update MSD interfaces for continuous validation of transport policies
#1674 reorganize sia agents builds using common go/sia library
#1675 Fix zms notification test
#1676 Updated mariadb to 10.5.13 in docker container
#1677 AWS Temp Creds for AWS SDK v2 users
#1678 allow * in TransportPolicySubject domain and/or service
#1679 UI: Enable Add Static Instance Button
#1680 Fix Snapshots for Enabling Adding Static Workload
Athenz v1.10.39 Release / Nov 01, 2021
--------------------------------------
#1641 UI/msd Integrating msd client in UI
#1654 For role expiry notification - record metrics daily while
#1655 Make ZMS/ZTS Binder singleton
#1657 putRoleMeta can now be called by principals
#1658 UI: Pinning specific package versions for UI
#1659 update transport policy validator interface
#1660 Group tags implementation
#1662 update cert-refresh unit test to pass with latest jdk constraints
#1663 Disable Group Expiry Notifications By Tag zms.DisableReminderNotifications
#1664 Delete zpe_policy_updater to fix docker setup
#1665 update public cloud providers to support multiple dns suffixes
#1666 UI to log msd api static instance error, enable adding static instances
#1667 support multiple dns suffix domains for aws/azure agents
#1668 command line option to force refresh when running zpu
#1670 evaluateNetworkPolicyChange api
Athenz v1.10.38 Release / Oct 18, 2021
--------------------------------------
#1646 change scope of aws provider methods/class to support extensibility
#1647 remove duplicate code from sia agent libs/packages
#1648 explicit dep on bcprov-ext to enforce version match
#1649 minor changes in ConfigManager (comments and 2 small new helper methods
#1650 method to fetch current aws region from identity document
#1651 provide capability to override dns suffix for aws provider
#1652 document Q4 Roadmap tasks
#1653 support org field in x.509 csr method in go sia libs
Athenz v1.10.37 Release / Oct 08, 2021
--------------------------------------
#1640 simplify pulsar publisher class interface and delete wrapper classes
#1642 move common code from provider/aws/sia-ec2 to libs/go/sia
#1643 correct javadoc param for role certs to be minutes, not seconds
#1645 configure option to retry cert sign requests not only for connect timeouts
Athenz v1.10.36 Release / Oct 04, 2021
--------------------------------------