Merge pull request #769 from openziti/release-2.5.2.2-more-ui-tweaks

Release 2.5.2.2 more UI tweaks

DesktopEdge/MainWindow.xaml

@@ -296,6 +296,7 @@
                                Recovery="ShowRecovery"
                                OnLoading="DoLoading"
                                OnShowMFA="ShowAuthenticate"
+                               ShowBlurb="IdentityMenu_ShowBlurb"
                                CompleteExternalAuth="CompleteExternalAuthEvent"
         />
 

DesktopEdge/MainWindow.xaml.cs

@@ -68,7 +68,7 @@ public partial class MainWindow : Window {
         private int _top = 30;
         private int defaultHeight = 560;
         public int NotificationsShownCount = 0;
-        private double _maxHeight = 800d;
+        private double _maxHeight = 805d;
         public string CurrentIcon = "white";
         private string[] suffixes = { "Bps", "kBps", "mBps", "gBps", "tBps", "pBps" };
         private string _blurbUrl = "";
@@ -121,7 +121,7 @@ private List<ZitiIdentity> identities {
         /// The MFA Toggle was toggled
         /// </summary>
         /// <param name="isOn">True if the toggle was on</param>
-        private async void MFAToggled(bool isOn) {
+        private async void MFAToggled(ZitiIdentity id, bool isOn) {
             if (isOn) {
                 ShowLoad("Generating MFA", "MFA Setup Commencing, please wait");
 
@@ -201,7 +201,7 @@ private void ServiceClient_OnMfaEvent(object sender, MfaEvent mfa) {
                             }
                         }
                         if (this.IdentityMenu.Identity != null && this.IdentityMenu.Identity.Identifier == mfa.Identifier) this.IdentityMenu.Identity = found;
-                        await ShowBlurbAsync("MFA Disabled, Service Access Can Be Limited", "");
+                        await ShowBlurbAsync("MFA disabled, access may be limited", "");
                     } else {
                         await ShowBlurbAsync("MFA Removal Failed", "");
                     }
@@ -589,11 +589,16 @@ private void NotifyIcon_BalloonTipClosed(object sender, EventArgs e) {
             thisIcon.Dispose();
         }
 
+        System.Windows.Point positionAtDetatch;
         private void Window_MouseDown(object sender, MouseButtonEventArgs e) {
+            if (!UIUtils.IsLeftClick(e)) return;
+            if (!UIUtils.MouseUpForMouseDown(e)) return;
+            positionAtDetatch = new System.Windows.Point(App.Current.MainWindow.Left, App.Current.MainWindow.Top);
             HandleDetached(e);
         }
 
         private void HandleAttach(object sender, MouseButtonEventArgs e) {
+            if (!UIUtils.MouseUpForMouseDown(e)) return;
             if (e.ChangedButton == MouseButton.Right) {
                 _isAttached = true;
                 IdentityMenu.Arrow.Visibility = Visibility.Visible;
@@ -1504,12 +1509,14 @@ private void LoadIdentities(Boolean repaint) {
                 if (_maxHeight < 100) {
                     _maxHeight = 100;
                 }
-                IdList.MaxHeight = _maxHeight - 520;
+                IdList.MaxHeight = _maxHeight - 480;
                 ZitiIdentity[] ids = identities.OrderBy(i => (i.Name != null) ? i.Name.ToLower() : i.Name).ToArray();
                 MainMenu.SetupIdList(ids);
                 if (ids.Length > 0 && serviceClient.Connected) {
                     double height = defaultHeight + (ids.Length * 60);
-                    if (height > _maxHeight) height = _maxHeight;
+                    if (height > _maxHeight) {
+                        height = _maxHeight;
+                    }
                     this.Height = height;
                     IdentityMenu.SetHeight(this.Height - 160);
                     MainMenu.IdentitiesButton.Visibility = Visibility.Visible;
@@ -1928,7 +1935,10 @@ public async Task ShowBlurbAsync(string message, string url, string level = "err
                 logger.Error(e);
             }
         }
-
+        public async Task ShowBlurbAsync(Blurb blurb) {
+            await ShowBlurbAsync(blurb.Message, null, blurb.Level);
+        }
+
         /// <summary>
         /// Execute the hide operation wihout an action from the growler
         /// </summary>
@@ -2005,9 +2015,7 @@ private void WithJwt_Click(object sender, RoutedEventArgs e) {
             AddIdentity_Click(sender, e);
         }
 
-        void WithUrl_Click(object sender, RoutedEventArgs e) {
-            if (!UIUtils.IsLeftClick(e)) return;
-            if (!UIUtils.MouseUpForMouseDown(e)) return;
+        void WithUrl_Click(object sender, RoutedEventArgs e) {
             ShowJoinByUrl();
         }
         void With3rdPartyCA_Click(object sender, RoutedEventArgs e) {
@@ -2047,6 +2055,10 @@ private async void CompleteExternalAuthEvent(ZitiIdentity identity, string provi
         private void MainUI_PreviewMouseDown(object sender, MouseButtonEventArgs e) {
             UIUtils.ClickedControl = e.Source as UIElement;
         }
+
+        private async void IdentityMenu_ShowBlurb(Blurb blurb) {
+            await ShowBlurbAsync(blurb);
+        }
     }
 
     public class ActionCommand : ICommand {

DesktopEdge/Views/Controls/AddIdentityCA.xaml

@@ -61,8 +61,27 @@
         </Border>
 
         <StackPanel x:Name="MFAAuthArea" Margin="5,10,5,10">
-            <Label Content="3rd Party Certificate" Foreground="White" FontSize="16" HorizontalAlignment="Center" FontWeight="Bold" />
-
+            <Grid>
+                <Grid.ColumnDefinitions>
+                    <ColumnDefinition Width="1*"/>
+                    <ColumnDefinition Width="Auto"/>
+                    <ColumnDefinition Width="1*"/>
+                </Grid.ColumnDefinitions>
+                <Label Grid.Column="1"
+                    Content="3rd Party Certificate"
+                    Foreground="White" FontSize="16"
+                    HorizontalAlignment="Stretch"
+                    FontWeight="Bold" />
+                <Image Name="CloseThirdPartyDialog"
+                    Grid.Column="2"
+                    Cursor="Hand"
+                    Source="/Assets/Images/x.png"
+                    Width="20" Height="20"
+                    HorizontalAlignment="Right"
+                    Margin="0,0,10,0"
+                    MouseUp="ExecuteClose"
+                />
+            </Grid>
             <!-- Certificate File -->
             <Label Content="Certificate File" Foreground="White" Opacity="0.7" FontSize="12" HorizontalAlignment="Left" />
             <StackPanel Orientation="Horizontal" HorizontalAlignment="Center" Margin="0,0,0,0">
@@ -95,7 +114,7 @@
                             IsTabStop="True"/>
             </StackPanel>
 
-            <!-- Alias -->
+            <!-- Alias >
             <Label Content="Alias" Foreground="White" Opacity="0.7" FontSize="12" HorizontalAlignment="Left" />
             <StackPanel Orientation="Horizontal" HorizontalAlignment="Center" Margin="0,0,0,0">
                 <TextBox x:Name="Alias"
@@ -104,7 +123,7 @@
                              IsTabStop="True" />
                 <Label Margin="10,0,0,0"
                            Width="{Binding ElementName=BrowseKeyBtn, Path=ActualWidth}"/>
-            </StackPanel>
+            </StackPanel-->
             <local:StyledButton x:Name="JoinNetworkBtn" 
                                     OnClick="JoinNetworkUrl" 
                                     Label="Join Network" 

DesktopEdge/Views/Controls/AddIdentityCA.xaml.cs

@@ -53,7 +53,6 @@ private void JoinNetworkUrl(object sender, MouseButtonEventArgs e) {
 
             Payload.Certificate = CertificateFile.Text;
             Payload.Key = KeyFile.Text;
-            Payload.IdentityFilename = Alias.Text;
             OnAddIdentity(Payload, this);
         }
         static string GetCertificateFingerprint(string filePath) {

DesktopEdge/Views/Controls/Toggler.xaml.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Windows;
 using System.Windows.Controls;
+using ZitiDesktopEdge.DataStructures;
 
 namespace ZitiDesktopEdge {
     /// <summary>

DesktopEdge/Views/ItemRenderers/IdentityItem.xaml.cs

@@ -238,7 +238,7 @@ public void RefreshUI() {
                     }
                 }
                 if (_identity.NeedsExtAuth) {
-                    ServiceCountAreaLabel.Content = "authorize idp";
+                    ServiceCountAreaLabel.Content = "authorize IdP";
                     MainArea.Opacity = 0.6;
                     hideMfa();
                     ServiceCountArea.Visibility = Visibility.Collapsed; //hide bubbles

DesktopEdge/Views/ItemRenderers/MenuEditToggle.xaml.cs

@@ -12,6 +12,7 @@
 using System.Windows.Media.Imaging;
 using System.Windows.Navigation;
 using System.Windows.Shapes;
+using ZitiDesktopEdge.DataStructures;
 using ZitiDesktopEdge.Models;
 using ZitiDesktopEdge.ServiceClient;
 

DesktopEdge/Views/Screens/IdentityDetails.xaml

@@ -24,12 +24,17 @@
         <!-- Background Color for Pop Overs -->
         <Rectangle x:Name="MainCanvas" Margin="10,10,10,10" Fill="White" RadiusY="10" RadiusX="10"></Rectangle>
 
-        <Grid Margin="0,30,0,0" d:Visibility="Visible"
-        >
+        <Grid Margin="0,30,0,0" d:Visibility="Visible">
             <Grid.ColumnDefinitions>
                 <ColumnDefinition Width="*"/>
             </Grid.ColumnDefinitions>
-            <StackPanel Grid.Column="0" Orientation="Vertical" HorizontalAlignment="Stretch" Margin="0,0,0,30">
+            <Grid.RowDefinitions>
+                <RowDefinition Height="1*"/>
+                <!-- Content before -->
+                <RowDefinition Height="*" />
+                <!-- Space for the StackPanel -->
+            </Grid.RowDefinitions>
+            <StackPanel Grid.Column="0" Orientation="Vertical" HorizontalAlignment="Stretch" Margin="0,0,0,0">
                 <!-- Header Controls -->
                 <Grid Margin="0,0,0,10">
                     <Grid.ColumnDefinitions>
@@ -88,7 +93,7 @@
                 <Rectangle Margin="40,0,40,10" Fill="#070826" Height="1" RadiusY="10" RadiusX="10" Opacity="0.1"></Rectangle>
                 <local:MenuEditItem x:Name="IdServer" Label="Network" IsLocked="True" />
                 <Rectangle Margin="40,0,40,10" Fill="#070826" Height="1" RadiusY="10" RadiusX="10" Opacity="0.1"></Rectangle>
-                <local:MenuEditToggle x:Name="IdentityMFA" HorizontalAlignment="Stretch" Label="Multi Factor Auth"
+                <local:MenuEditToggle x:Name="IdentityMFA" HorizontalAlignment="Stretch" Label="Multi Factor Auth" PreviewMouseDown="IdentityMFA_PreviewMouseDown" PreviewMouseUp="IdentityMFA_PreviewMouseUp"
                                       Margin="0,0,0,0" Recovery="MFARecovery" Authenticate="MFAAuthenticate"
                                       Toggle="ToggleMFA"></local:MenuEditToggle>
                 <local:Filter x:Name="FilterServices" OnFilter="DoFilter" VerticalAlignment="Top" Margin="10,5,10,0" />
@@ -288,12 +293,12 @@
                     </Grid>
                 </StackPanel>
             </StackPanel>
-            <local:StyledButton x:Name="ForgetIdentityButton"
+            <local:StyledButton x:Name="ForgetIdentityButton" Grid.Row="1"
                                 MinWidth="310"
                                 BgColor="#F4044D"
                                 Label="Forget This Identity"
                                 ButtonMargin="30,0,30,0"
-                                Margin="0,0,0,22"
+                                Margin="0,10,0,20"
                                 OnClick="ForgetIdentity"
                                 HorizontalAlignment="Center"
                                 VerticalAlignment="Bottom"

DesktopEdge/Views/Screens/IdentityDetails.xaml.cs

@@ -51,7 +51,7 @@ public partial class IdentityDetails : UserControl {
         public event Forgot OnForgot;
         public delegate void ErrorOccurred(string message);
         public event ErrorOccurred OnError;
-        public delegate void MFAToggled(bool isOn);
+        public delegate void MFAToggled(ZitiIdentity id, bool isOn);
         public event MFAToggled OnMFAToggled;
         public delegate void Detched(MouseButtonEventArgs e);
         public event Detched OnDetach;
@@ -397,6 +397,10 @@ public void SetHeight(double height) {
         }
 
         private void ForgetIdentity(object sender, MouseButtonEventArgs e) {
+            if(_identity.IsMFAEnabled) {
+                ShowBlurb?.Invoke(new Blurb { Message = "Disable MFA before forgetting identity" });
+                return;
+            }
             if (this.Visibility == Visibility.Visible && ForgetIdentityConfirmView.Visibility == Visibility.Collapsed) {
                 ForgetIdentityConfirmView.Visibility = Visibility.Visible;
             }
@@ -432,8 +436,11 @@ async private void ConfirmButton_Click(object sender, RoutedEventArgs e) {
             }
         }
 
-        private void ToggleMFA(bool isOn) { 
-            this.OnMFAToggled?.Invoke(isOn);
+        private void ToggleMFA(bool isOn) {
+            if (_identity.IsConnected && _identity.NeedsExtAuth) {
+                return;
+            }
+            this.OnMFAToggled?.Invoke(_identity, isOn);
         }
 
         /* Modal UI Background visibility */
@@ -590,9 +597,7 @@ async private void DoDisconnect(object sender, MouseButtonEventArgs e) {
 
         private void WarnClicked(object sender, MouseButtonEventArgs e) {
             ZitiService item = (ZitiService)(sender as FrameworkElement).DataContext;
-            ShowBlurb?.Invoke(new Blurb {
-                Message = item.WarningMessage,
-            });
+            ShowBlurb?.Invoke(new Blurb {Message = item.WarningMessage});
         }
 
         private void DetailsClicked(object sender, MouseButtonEventArgs e) {
@@ -667,5 +672,24 @@ private void ExternalProviderSettingsIcon_MouseUp(object sender, MouseButtonEven
                 ExternalProviderLabel.Visibility = Visibility.Collapsed;
             }
         }
+
+        private void IdentityMFA_PreviewMouseDown(object sender, MouseButtonEventArgs e) {
+            if(_identity.NeedsExtAuth) {
+                // prevent the event
+                e.Handled = true;
+            }
+        }
+
+        private void IdentityMFA_PreviewMouseUp(object sender, MouseButtonEventArgs e) {
+            if (_identity.NeedsExtAuth) {
+                // prevent the event
+                e.Handled = true;
+                string action = "enabling";
+                if (_identity.IsMFAEnabled) {
+                    action = "disabling";
+                }
+                ShowBlurb.Invoke(new Blurb() {Message = $"You must authenticate before {action} MFA", Level= "error" });
+            }
+        }
     }
 }

Installer/ZitiDesktopEdge.aip

@@ -110,7 +110,7 @@
     <ROW File="NLog.dll" Component_="NLog.dll" FileName="NLog.dll" Attributes="0" SourcePath="..\ZitiUpdateService\bin\Release\NLog.dll" SelfReg="false"/>
     <ROW File="ZitiUpdateServicelog.config" Component_="App.config" FileName="ZITIUP~2.CON|ZitiUpdateService-log.config" Attributes="0" SourcePath="..\ZitiUpdateService\bin\Release\ZitiUpdateService-log.config" SelfReg="false"/>
     <ROW File="ZitiDesktopEdgelog.config" Component_="App.config" FileName="ZITIDE~2.CON|ZitiDesktopEdge-log.config" Attributes="0" SourcePath="..\DesktopEdge\bin\Release\ZitiDesktopEdge-log.config" SelfReg="false"/>
-    <ROW File="wintun.dll" Component_="wintun.dll" FileName="wintun.dll" Attributes="0" SourcePath="build\service\wintun.dll" SelfReg="false"/>
+    <ROW File="wintun.dll" Component_="wintun.dll" FileName="wintun.dll" Version="65535.65535.65535.65535" Attributes="0" SourcePath="build\service\wintun.dll" SelfReg="false"/>
     <ROW File="WpfMouseWheelLib.dll" Component_="WpfMouseWheelLib.dll" FileName="WPFMOU~1.DLL|WpfMouseWheelLib.dll" Attributes="0" SourcePath="..\DesktopEdge\bin\Release\WpfMouseWheelLib.dll" SelfReg="false"/>
     <ROW File="DnsClient.dll" Component_="DnsClient.dll" FileName="DNSCLI~1.DLL|DnsClient.dll" Attributes="0" SourcePath="..\ZitiUpdateService\bin\Release\DnsClient.dll" SelfReg="false"/>
     <ROW File="System.Buffers.dll" Component_="System.Buffers.dll" FileName="SYSTEM~1.DLL|System.Buffers.dll" Attributes="0" SourcePath="..\ZitiUpdateService\bin\Release\System.Buffers.dll" SelfReg="false"/>

release-notes.md

@@ -1,5 +1,63 @@
 # Release 2.5.1.1
 
+## What's New
+* Lots of new stuff in this release all centered around OIDC Auth Code Flow + PKCE
+* Add Identity button now supports adding an identity by JWT or by URl
+    * JWT behavior remains the same
+    * support has been added for joining a network by 3rd party CA
+    * support added for joining an OpenZiti network v1.2+ by URL. Note, the URL must be
+      preconfigured with trust from the OS trust store. Unverifiable URLs cannot be used.
+* Keychain support is added! The OpenZiti C SDK uses the 
+  [tlsuv library](https://github.com/openziti/tlsuv) which as integrated with 
+  [Windows "Cryptography API: Next Generation"](https://learn.microsoft.com/en-us/windows/win32/seccng/cng-portal)
+  to support storing private key material through OS API calls.
+
+## OIDC Auth Code flow + PKCE
+
+If you are using an OpenZiti controller version 1.2 or higher, you are now able to use
+an[External JWT Signer](https://openziti.io/docs/learn/core-concepts/security/authentication/external-jwt-signers/)
+to authenticate to the overlay. When configured, you can join the network by using either
+the network JWT (downloaded from the ZAC or extracted from the controller's `/network-jwts` endpoint)
+
+If there are more than one ext-jwt-signers configured, new controls on the item details page will let
+the user configure a default external auth provider. When a default is configured, simply clicking the
+new "authorize IdP" icon.
+
+## Other changes
+* removed "add identity" button from the bottom of the screen
+* pointers now change to indicate an element is a drag point
+* tooltips added to 'Z' icon
+* right click on the main screen 'Z' icon to reattach a window
+* various UI presentation improvements
+
+## Bugs fixed:
+* the UI now knows if it's connected or disconnected and shows the label appropriately
+* when disabling the UI the lower portion no longer looks truncated
+
+## Dependencies
+
+* ziti-tunneler: v1.3.2
+* ziti-sdk:      1.3.2
+* tlsuv:         v0.32.9[OpenSSL 3.3.1 4 Jun 2024]
+
+# Release 2.5.1.2
+
+## What's New
+* nothing - bugfix
+
+## Other changes
+* none
+
+## Bugs fixed:
+* Rolls back the TLS engine to mbedTLS for now, so identities can write a new CA bundle if needed
+
+## Dependencies
+
+* ziti-tunneler:  v1.1.4.2
+* ziti-sdk:       1.0.9
+
+# Release 2.5.1.1
+
 ## What's New
 * bugfix
 
@@ -9,9 +67,11 @@
 ## Bugs fixed:
 * [issue 760](https://github.com/openziti/desktop-edge-win/issues/760) - stall detector operated too quickly. tamed to 60s from 15s and allowed for configuration
 
-## Dependency Updates
+## Dependencies
 
-n/a
+* ziti-tunneler: v1.3.2
+* ziti-sdk:      1.3.2
+* tlsuv:         v0.32.9[OpenSSL 3.3.1 4 Jun 2024]
 
 # Release 2.5.1.0