mward4/OpenPXE
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 40 Wiki Activity

40 Releases 41 Tags

RSS Feed
  • v0.5.1 cbcd63bb14
    Compare

    OpenPXE v0.5.1 Pre-Release

    mward4 released this 2026-05-31 02:10:37 -04:00 | 26 commits to main since this release

    OpenPXE v0.5.1

    SAML SSO goes live, and the Settings/Storage tabs get a cleanup.

    ✨ Single sign-on (SAML 2.0) — now wired end-to-end

    SSO configuration has been storage-only since v0.4.5 (you could paste your
    IdP metadata, but it didn't log anyone in). v0.5.1 wires the real flow.

    • "Sign in with " on the login page now starts an SP-initiated SAML
      login: OpenPXE builds an AuthnRequest, redirects to your IdP, and the new
      /api/sso/acs endpoint consumes the signed SAMLResponse, mints an
      operator session, and drops you on the dashboard.
    • IdP-initiated login is supported too, gated behind a new
      "Allow SSO login initiated by identity provider" toggle (off by default) —
      mirroring FleetDM.
    • Pure-Rust, no OpenSSL. Signature verification + exclusive XML
      canonicalization run on the pure-Rust bergshamra
      crate (RustCrypto, #![forbid(unsafe_code)]). The container stays a fully
      static, OpenSSL-free musl binary — no xmlsec/libxml2 C dependencies.
    • Security checks are the ones that matter for an SP: the signature is
      verified against your IdP's pinned certificate only (an attacker can't swap
      in their own key via KeyInfo), with XML-Signature-Wrapping defenses, plus
      Status / Destination / Audience / time-window validation, InResponseTo
      correlation, IdP-initiated gating, and an assertion-replay guard.
    • Access model: any user your IdP authenticates and OpenPXE
      cryptographically verifies gets an operator session. OpenPXE stays
      single-tier (no user/role table); the local admin account remains a
      guaranteed fallback owner       regardless of SSO state.
    • New SSO settings: Entity ID (defaults to your public base URL) and the
      IdP-initiated toggle. A new GET /api/sso/metadata endpoint serves OpenPXE's
      SP metadata for easy import into your IdP.

    Scope for this release: assertions must be unencrypted, AuthnRequests are
    sent unsigned (your IdP must not require client signatures), and the NameID
    is the user's email. Single Logout and encrypted assertions are not yet
    supported.

    🧹 UI cleanup

    • Advanced tab folded into Settings. The standalone Advanced sidebar
      entry is gone; its webhook/email notification settings and the API reference
      now live in a collapsible "Advanced" section at the bottom of Settings.
    • Storage → "Remote shares". The separate SMB shares and NFS shares
      cards are merged into one Remote shares card with a protocol dropdown
      (SMB / NFS) and a single, protocol-badged table. Same backends, far less
      clutter — and room for Config files down the road.

    ✅ Quality

    • 17 new SAML SP unit tests (accept the valid case; reject tampered, unsigned,
      wrong-key, wrong-audience, expired, future-dated, wrong-issuer, and
      non-success responses) + 6 ACS integration tests (happy path, IdP-initiated
      gating, SP request correlation, assertion replay, garbage input).
    • Full workspace: 206 tests green, clippy clean.

    🐳 Pull it

    docker pull gitea.milesward.dev/mward4/openpxe:0.5.1
# or
docker pull gitea.milesward.dev/mward4/openpxe:latest
    Downloads