Skip to content

feat: new webauth and mfa flows#1370

Merged
chance-coleman merged 5 commits intomainfrom
webauthn-mfa
Mar 27, 2025
Merged

feat: new webauth and mfa flows#1370
chance-coleman merged 5 commits intomainfrom
webauthn-mfa

Conversation

@chance-coleman
Copy link
Copy Markdown
Contributor

@chance-coleman chance-coleman commented Mar 19, 2025

Description

Related PR to the uds-identity-config PR. This allows for new templated values to be passed in to the identity config for configuring webauthn MFA as well as MFA for everywhere ( x509 included).

Related Issue

Related: uds-identity-config PR
Related: Issue

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Other (security config, docs update, etc)

Steps to Validate

  • not much to verify here other than deploying uds-core and making sure that new values are present in the keycloak realm secret. additional testing steps present in the identity-config PR.

Checklist before merging

@chance-coleman chance-coleman self-assigned this Mar 19, 2025
@chance-coleman chance-coleman mentioned this pull request Mar 19, 2025
Merged
5 tasks
@chance-coleman chance-coleman marked this pull request as ready for review March 20, 2025 14:53
@chance-coleman chance-coleman requested a review from a team as a code owner March 20, 2025 14:53
noahpb
noahpb approved these changes Mar 24, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@noahpb noahpb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

mjnagel
mjnagel approved these changes Mar 25, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@mjnagel mjnagel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - I assume any documentation for these overrides will be included in either the identity-config updates or the follow on PR to pull the new identity-config version in.

slaskawi
slaskawi reviewed Mar 26, 2025
View reviewed changes
Comment thread src/keycloak/chart/values.yaml
@chance-coleman chance-coleman merged commit 1ac1b03 into main Mar 27, 2025
15 checks passed
@chance-coleman chance-coleman deleted the webauthn-mfa branch March 27, 2025 20:41
@github-actions github-actions Bot mentioned this pull request Mar 27, 2025
Merged
chance-coleman pushed a commit that referenced this pull request Apr 1, 2025
@github-actions
chore(main): release 0.39.0 (#1373)
0fa1587 
🤖 I have created a release *beep* *boop*
---


##
[0.39.0](v0.38.0...v0.39.0)
(2025-04-01)


### ⚠ BREAKING CHANGES

* dynamic generation of Istio AuthorizationPolicy resources in ambient
mode based on the configuration defined in a UDSPackage. ALL requests to
a pod with authservice protection MUST have a jwt from Keycloak. More
fine-grained protection can be done with additional DENY policies, but
there will always be a requirement for a Keycloak JWT in addition.

### Features

* add alertmanager datasource to grafana
([#1374](#1374))
([818a3a0](818a3a0))
* ambient mesh authorization policy generation
(#1384)
([b47daba](b47daba))
* new webauth and mfa flows
([#1370](#1370))
([1ac1b03](1ac1b03))
* theme customization
([#1382](#1382))
([55ef41b](55ef41b))
* use Client Credentials for managing Keycloak Clients
([#1341](#1341))
([4db9cc7](4db9cc7))


### Bug Fixes

* add delete credential keycloak secret value
([#1398](#1398))
([d45b3e6](d45b3e6))
* broken selectors for internal dependencies on charts
([#1403](#1403))
([d72b194](d72b194))


### Miscellaneous

* add additionalNetworkAllow to keycloak and loki
([#1379](#1379))
([8200bce](8200bce))
* add docs for layer selection
([#1216](#1216))
([c170322](c170322))
* **deps:** update grafana
([#1383](#1383))
([122dc58](122dc58))
* **deps:** update grafana to v8.10.4
([#1363](#1363))
([fb163bd](fb163bd))
* **deps:** update istio to v1.25.0
([#1335](#1335))
([1803ea7](1803ea7))
* **deps:** update keycloak to v0.11.1
([#1400](#1400))
([6fdcd0c](6fdcd0c))
* **deps:** update keycloak to v26.1.4
([#1356](#1356))
([31152f7](31152f7))
* **deps:** update pepr to v0.46.3
([#1365](#1365))
([304a556](304a556))
* **deps:** update prometheus-stack
([#1362](#1362))
([ae40b27](ae40b27))
* **deps:** update prometheus-stack
([#1380](#1380))
([eec3337](eec3337))
* **deps:** update support dependencies to v22.13.17
([#1401](#1401))
([8a81eec](8a81eec))
* **deps:** update support-deps
([#1364](#1364))
([7819bec](7819bec))
* **deps:** update support-deps
([#1376](#1376))
([dd22589](dd22589))
* **deps:** update support-deps
([#1390](#1390))
([f06bb70](f06bb70))
* **deps:** update support-deps
([#1392](#1392))
([c0762a3](c0762a3))
* **deps:** update ts-jest to v29.3.0
([#1377](#1377))
([8b2174a](8b2174a))
* **deps:** update velero to v8.6.0
([#1371](#1371))
([93a44e6](93a44e6))
* remove kiali and tempo references from repo
([#1375](#1375))
([8374de3](8374de3))
* update how to scrape metrics
([#1378](#1378))
([e808f7d](e808f7d))
* update unicorn ztunnel image to 1.25.0
([#1389](#1389))
([7e446cb](7e446cb))


### Documentation

* velero csi vsphere backups
([#1385](#1385))
([5ae33b2](5ae33b2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
noahpb pushed a commit that referenced this pull request Apr 2, 2025
@github-actions @noahpb
chore(main): release 0.39.0 (#1373)
66af94c 
🤖 I have created a release *beep* *boop*
---


##
[0.39.0](v0.38.0...v0.39.0)
(2025-04-01)


### ⚠ BREAKING CHANGES

* dynamic generation of Istio AuthorizationPolicy resources in ambient
mode based on the configuration defined in a UDSPackage. ALL requests to
a pod with authservice protection MUST have a jwt from Keycloak. More
fine-grained protection can be done with additional DENY policies, but
there will always be a requirement for a Keycloak JWT in addition.

### Features

* add alertmanager datasource to grafana
([#1374](#1374))
([818a3a0](818a3a0))
* ambient mesh authorization policy generation
(#1384)
([b47daba](b47daba))
* new webauth and mfa flows
([#1370](#1370))
([1ac1b03](1ac1b03))
* theme customization
([#1382](#1382))
([55ef41b](55ef41b))
* use Client Credentials for managing Keycloak Clients
([#1341](#1341))
([4db9cc7](4db9cc7))


### Bug Fixes

* add delete credential keycloak secret value
([#1398](#1398))
([d45b3e6](d45b3e6))
* broken selectors for internal dependencies on charts
([#1403](#1403))
([d72b194](d72b194))


### Miscellaneous

* add additionalNetworkAllow to keycloak and loki
([#1379](#1379))
([8200bce](8200bce))
* add docs for layer selection
([#1216](#1216))
([c170322](c170322))
* **deps:** update grafana
([#1383](#1383))
([122dc58](122dc58))
* **deps:** update grafana to v8.10.4
([#1363](#1363))
([fb163bd](fb163bd))
* **deps:** update istio to v1.25.0
([#1335](#1335))
([1803ea7](1803ea7))
* **deps:** update keycloak to v0.11.1
([#1400](#1400))
([6fdcd0c](6fdcd0c))
* **deps:** update keycloak to v26.1.4
([#1356](#1356))
([31152f7](31152f7))
* **deps:** update pepr to v0.46.3
([#1365](#1365))
([304a556](304a556))
* **deps:** update prometheus-stack
([#1362](#1362))
([ae40b27](ae40b27))
* **deps:** update prometheus-stack
([#1380](#1380))
([eec3337](eec3337))
* **deps:** update support dependencies to v22.13.17
([#1401](#1401))
([8a81eec](8a81eec))
* **deps:** update support-deps
([#1364](#1364))
([7819bec](7819bec))
* **deps:** update support-deps
([#1376](#1376))
([dd22589](dd22589))
* **deps:** update support-deps
([#1390](#1390))
([f06bb70](f06bb70))
* **deps:** update support-deps
([#1392](#1392))
([c0762a3](c0762a3))
* **deps:** update ts-jest to v29.3.0
([#1377](#1377))
([8b2174a](8b2174a))
* **deps:** update velero to v8.6.0
([#1371](#1371))
([93a44e6](93a44e6))
* remove kiali and tempo references from repo
([#1375](#1375))
([8374de3](8374de3))
* update how to scrape metrics
([#1378](#1378))
([e808f7d](e808f7d))
* update unicorn ztunnel image to 1.25.0
([#1389](#1389))
([7e446cb](7e446cb))


### Documentation

* velero csi vsphere backups
([#1385](#1385))
([5ae33b2](5ae33b2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
mjnagel pushed a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@chance-coleman @mjnagel
feat: new webauth and mfa flows (defenseunicorns#1370)
0ccbb73 
## Description
Related PR to the [uds-identity-config
PR](defenseunicorns/uds-identity-config#380).
This allows for new templated values to be passed in to the identity
config for configuring webauthn MFA as well as MFA for everywhere ( x509
included).

## Related Issue

Related: [uds-identity-config
PR](defenseunicorns/uds-identity-config#380)
Related:
[Issue](defenseunicorns/uds-identity-config#236)

## Type of change

- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)

## Steps to Validate
- not much to verify here other than deploying uds-core and making sure
that new values are present in the keycloak realm secret. additional
testing steps present in the identity-config PR.

## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [x] [Contributor
Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)
followed
mjnagel pushed a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@github-actions @mjnagel
chore(main): release 0.39.0 (defenseunicorns#1373)
536fb97 
🤖 I have created a release *beep* *boop*
---


##
[0.39.0](defenseunicorns/uds-core@v0.38.0...v0.39.0)
(2025-04-01)


### ⚠ BREAKING CHANGES

* dynamic generation of Istio AuthorizationPolicy resources in ambient
mode based on the configuration defined in a UDSPackage. ALL requests to
a pod with authservice protection MUST have a jwt from Keycloak. More
fine-grained protection can be done with additional DENY policies, but
there will always be a requirement for a Keycloak JWT in addition.

### Features

* add alertmanager datasource to grafana
([defenseunicorns#1374](defenseunicorns#1374))
([818a3a0](defenseunicorns@818a3a0))
* ambient mesh authorization policy generation
(defenseunicorns#1384)
([b47daba](defenseunicorns@b47daba))
* new webauth and mfa flows
([defenseunicorns#1370](defenseunicorns#1370))
([1ac1b03](defenseunicorns@1ac1b03))
* theme customization
([defenseunicorns#1382](defenseunicorns#1382))
([55ef41b](defenseunicorns@55ef41b))
* use Client Credentials for managing Keycloak Clients
([defenseunicorns#1341](defenseunicorns#1341))
([4db9cc7](defenseunicorns@4db9cc7))


### Bug Fixes

* add delete credential keycloak secret value
([defenseunicorns#1398](defenseunicorns#1398))
([d45b3e6](defenseunicorns@d45b3e6))
* broken selectors for internal dependencies on charts
([defenseunicorns#1403](defenseunicorns#1403))
([d72b194](defenseunicorns@d72b194))


### Miscellaneous

* add additionalNetworkAllow to keycloak and loki
([defenseunicorns#1379](defenseunicorns#1379))
([8200bce](defenseunicorns@8200bce))
* add docs for layer selection
([defenseunicorns#1216](defenseunicorns#1216))
([c170322](defenseunicorns@c170322))
* **deps:** update grafana
([defenseunicorns#1383](defenseunicorns#1383))
([122dc58](defenseunicorns@122dc58))
* **deps:** update grafana to v8.10.4
([defenseunicorns#1363](defenseunicorns#1363))
([fb163bd](defenseunicorns@fb163bd))
* **deps:** update istio to v1.25.0
([defenseunicorns#1335](defenseunicorns#1335))
([1803ea7](defenseunicorns@1803ea7))
* **deps:** update keycloak to v0.11.1
([defenseunicorns#1400](defenseunicorns#1400))
([6fdcd0c](defenseunicorns@6fdcd0c))
* **deps:** update keycloak to v26.1.4
([defenseunicorns#1356](defenseunicorns#1356))
([31152f7](defenseunicorns@31152f7))
* **deps:** update pepr to v0.46.3
([defenseunicorns#1365](defenseunicorns#1365))
([304a556](defenseunicorns@304a556))
* **deps:** update prometheus-stack
([defenseunicorns#1362](defenseunicorns#1362))
([ae40b27](defenseunicorns@ae40b27))
* **deps:** update prometheus-stack
([defenseunicorns#1380](defenseunicorns#1380))
([eec3337](defenseunicorns@eec3337))
* **deps:** update support dependencies to v22.13.17
([defenseunicorns#1401](defenseunicorns#1401))
([8a81eec](defenseunicorns@8a81eec))
* **deps:** update support-deps
([defenseunicorns#1364](defenseunicorns#1364))
([7819bec](defenseunicorns@7819bec))
* **deps:** update support-deps
([defenseunicorns#1376](defenseunicorns#1376))
([dd22589](defenseunicorns@dd22589))
* **deps:** update support-deps
([defenseunicorns#1390](defenseunicorns#1390))
([f06bb70](defenseunicorns@f06bb70))
* **deps:** update support-deps
([defenseunicorns#1392](defenseunicorns#1392))
([c0762a3](defenseunicorns@c0762a3))
* **deps:** update ts-jest to v29.3.0
([defenseunicorns#1377](defenseunicorns#1377))
([8b2174a](defenseunicorns@8b2174a))
* **deps:** update velero to v8.6.0
([defenseunicorns#1371](defenseunicorns#1371))
([93a44e6](defenseunicorns@93a44e6))
* remove kiali and tempo references from repo
([defenseunicorns#1375](defenseunicorns#1375))
([8374de3](defenseunicorns@8374de3))
* update how to scrape metrics
([defenseunicorns#1378](defenseunicorns#1378))
([e808f7d](defenseunicorns@e808f7d))
* update unicorn ztunnel image to 1.25.0
([defenseunicorns#1389](defenseunicorns#1389))
([7e446cb](defenseunicorns@7e446cb))


### Documentation

* velero csi vsphere backups
([defenseunicorns#1385](defenseunicorns#1385))
([5ae33b2](defenseunicorns@5ae33b2))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@slaskawi slaskawi slaskawi approved these changes

@mjnagel mjnagel mjnagel approved these changes

+1 more reviewer

@noahpb noahpb noahpb approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@chance-coleman chance-coleman

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@chance-coleman @slaskawi @mjnagel @noahpb