diff --git a/docs/img/sso/teleportauditlogssofailed.png b/docs/img/sso/teleportauditlogssofailed.png new file mode 100644 index 00000000000..6488882188e Binary files /dev/null and b/docs/img/sso/teleportauditlogssofailed.png differ diff --git a/docs/pages/enterprise/sso/adfs.mdx b/docs/pages/enterprise/sso/adfs.mdx index 0e08fd0ea8f..a1a2271a7af 100644 --- a/docs/pages/enterprise/sso/adfs.mdx +++ b/docs/pages/enterprise/sso/adfs.mdx @@ -185,16 +185,4 @@ automatically in a browser. ## Troubleshooting -If you get "access denied" errors, the number one place to check is the audit -log on the Teleport Auth Server. It is located in `/var/lib/teleport/log` by -default and it will contain the detailed reason why a user's login was denied. - -Some errors (like filesystem permissions or misconfigured network) can be -diagnosed using Teleport's `stderr` log, which is usually available via: - -```bsh -$ sudo journalctl -fu teleport -``` - -If you wish to increase the verbosity of Teleport's syslog, you can pass -`--debug` flag to the `teleport start` command. +(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!) diff --git a/docs/pages/enterprise/sso/azuread.mdx b/docs/pages/enterprise/sso/azuread.mdx index 7a4a56330b1..8a5657571e9 100644 --- a/docs/pages/enterprise/sso/azuread.mdx +++ b/docs/pages/enterprise/sso/azuread.mdx @@ -61,7 +61,7 @@ Before you get started you’ll need: ![Edit Basic SAML Configuration](../../../img/azuread/azuread-7-editbasicsaml.png) 8. For **Entity ID** and **Reply URL**, enter the same proxy URL. - + For self-hosted deployments, the URL will be similar to `https://teleport.example.com:3080/v1/webapi/saml/acs`. For Teleport Cloud users, the URL will be similar to `https://mytenant.teleport.sh`. @@ -329,7 +329,7 @@ spec: private_key: | -----BEGIN RSA PRIVATE KEY----- New private key - -----END RSA PRIVATE KEY----- + -----END RSA PRIVATE KEY----- signing_key_pair: cert: | -----BEGIN CERTIFICATE----- @@ -346,7 +346,7 @@ version: v2 Update the connector: ```code -$ tctl create -f azure-out.yaml +$ tctl create -f azure-out.yaml ``` ### Activate token encryption @@ -367,41 +367,7 @@ If the SSO login with this connector is successful, the encryption works. ## Troubleshooting -### Access denied - - - -If you get "access denied" errors, the number one place to check is the audit -log on the Teleport Auth Server. It is located in `/var/lib/teleport/log` by -default and will contain a detailed reason why a user's login was denied. - -Example of a user being denied because the role `clusteradmin` wasn't set up: - -```json -{"code":"T1001W","error":"role clusteradmin is not found","event":"user.login","method":"saml","success":false,"time":"2019-06-15T19:38:07Z","uid":"cd9e45d0-b68c-43c3-87cf-73c4e0ec37e9"} -``` - -Some errors (like file-system permissions or a misconfigured network) can be -diagnosed using Teleport's `stderr` log, which is usually available via: - -```code -$ sudo journalctl -fu teleport -``` - -If you wish to increase the verbosity of Teleport's logs, you can pass the -[`--debug`](../../setup/reference/cli.mdx#teleport-start) flag to the `teleport start` command. - - -If you get "access denied" errors, the number one place to check is the audit -log on the Teleport Auth Server. You can find it in the **Activity** tab of the Teleport Web UI. - -Example of a user being denied because the role `clusteradmin` wasn't set up: - -```json -{"code":"T1001W","error":"role clusteradmin is not found","event":"user.login","method":"saml","success":false,"time":"2019-06-15T19:38:07Z","uid":"cd9e45d0-b68c-43c3-87cf-73c4e0ec37e9"} -``` - - +(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!) ### Failed to process SAML callback @@ -420,4 +386,4 @@ Change the Name ID format to use email instead: ## Further reading -- [Teleport Configuration Resources Reference](../../setup/reference/resources.mdx) \ No newline at end of file +- [Teleport Configuration Resources Reference](../../setup/reference/resources.mdx) diff --git a/docs/pages/enterprise/sso/gitlab.mdx b/docs/pages/enterprise/sso/gitlab.mdx index c3b74696f41..bb6b91b1221 100644 --- a/docs/pages/enterprise/sso/gitlab.mdx +++ b/docs/pages/enterprise/sso/gitlab.mdx @@ -176,16 +176,4 @@ automatically in a browser). ## Troubleshooting -If you get "access denied errors" the number one place to check is the events in the audit -log on the Teleport auth server. The audit events log is located in `/var/lib/teleport/log/events.log` by -default and it will contain the detailed reason why a user's login was denied. - -Some errors (like filesystem permissions or misconfigured network) can be -diagnosed using Teleport's `stderr` log, which is usually available via: - -```bsh -$ sudo journalctl -fu teleport -``` - -If you wish to increase the verbosity of Teleport's syslog, you can pass -`--debug` flag to `teleport start` command. +(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!) diff --git a/docs/pages/enterprise/sso/google-workspace.mdx b/docs/pages/enterprise/sso/google-workspace.mdx index f2325d9569d..eea8be445dc 100644 --- a/docs/pages/enterprise/sso/google-workspace.mdx +++ b/docs/pages/enterprise/sso/google-workspace.mdx @@ -77,7 +77,7 @@ to `v3`. ![configuration of the OAuth consent screen](../../../img/googleoidc/consent-screen-1.png) Configure the appearence of your connector by picking a visible name, user support email, etc. - + Select the `.../auth/userinfo.email` and `openid` scopes. ![select email and openid scopes](../../../img/googleoidc/consent-screen-2.png) @@ -95,7 +95,7 @@ to `v3`. Pick a name for your service account. Leave project access grants and user access grants empty. ![service account creation](../../../img/googleoidc/serviceacct-creation.png) - + Click the newly-created account to view its details, and copy the Unique ID for later. ![service account unique ID](../../../img/googleoidc/serviceacct-uniqueid.png) @@ -201,36 +201,4 @@ automatically in a browser). ## Troubleshooting - - -If you get "access denied" errors, the number one place to check is the audit -log on the Teleport Auth Server. It is located in `/var/lib/teleport/log` by -default and it will contain a detailed reason why a user's login was denied. - -Example of a user being denied because the role `clusteradmin` wasn't set up. - -```json -{"code":"T1001W","error":"role clusteradmin is not found","event":"user.login","method":"oidc","success":false,"time":"2019-06-15T19:38:07Z","uid":"cd9e45d0-b68c-43c3-87cf-73c4e0ec37e9"} -``` - -Some errors (like filesystem permissions or a misconfigured network) can be -diagnosed using Teleport's `stderr` log, which is usually available via: - -```code -$ sudo journalctl -fu teleport -``` - -If you wish to increase the verbosity of Teleport's logs, you can pass the -[`--debug`](../../setup/reference/cli.mdx#teleport-start) flag to the `teleport start` command. - - -If you get "access denied" errors, the number one place to check is the audit -log on the Teleport Auth Server. You can find it in the **Activity** tab of the Teleport Web UI. - -Example of a user being denied because the role `clusteradmin` wasn't set up. - -```json -{"code":"T1001W","error":"role clusteradmin is not found","event":"user.login","method":"oidc","success":false,"time":"2019-06-15T19:38:07Z","uid":"cd9e45d0-b68c-43c3-87cf-73c4e0ec37e9"} -``` - - \ No newline at end of file +(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!) diff --git a/docs/pages/enterprise/sso/oidc.mdx b/docs/pages/enterprise/sso/oidc.mdx index 59ab7f14261..ccbfbcf1e01 100644 --- a/docs/pages/enterprise/sso/oidc.mdx +++ b/docs/pages/enterprise/sso/oidc.mdx @@ -218,16 +218,4 @@ identity provider if you are not automatically redirected. ## Troubleshooting -If you get "access denied errors" the number one place to check is the audit -log on the Teleport auth server. It is located in `/var/lib/teleport/log` by -default and it will contain the detailed reason why a user's login was denied. - -Some errors (like filesystem permissions or misconfigured network) can be -diagnosed using Teleport's `stderr` log, which is usually available via: - -```bsh -$ sudo journalctl -fu teleport -``` - -If you wish to increase the verbosity of Teleport's syslog, you can pass -`--debug` flag to `teleport start` command. +(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!) diff --git a/docs/pages/enterprise/sso/okta.mdx b/docs/pages/enterprise/sso/okta.mdx index 318891f41f8..dd0183ba1d0 100644 --- a/docs/pages/enterprise/sso/okta.mdx +++ b/docs/pages/enterprise/sso/okta.mdx @@ -106,11 +106,11 @@ $ tctl create okta-connector.yaml ## Create a Developer Teleport Role -We are going to create a new role that'll pull in external information from Okta. Notice -`{{external.username}}` login. It configures Teleport to look at *"username"* Okta claim -and use that field as an allowed login for each user. This example uses email as the -username format. The `email.local(external.trait)` function will remove the `@domain` -and just have the username prefix. +We are going to create a new role that'll pull in external information from Okta. Notice +`{{external.username}}` login. It configures Teleport to look at *"username"* Okta claim +and use that field as an allowed login for each user. This example uses email as the +username format. The `email.local(external.trait)` function will remove the `@domain` +and just have the username prefix. ```yaml kind: role @@ -168,16 +168,4 @@ automatically in a browser). ## Troubleshooting -If you get "access denied errors" the number one place to check is the audit -log on the Teleport auth server. It is located in `/var/lib/teleport/log` by -default and it will contain the detailed reason why a user's login was denied. - -Some errors (like filesystem permissions or misconfigured network) can be -diagnosed using Teleport's `stderr` log, which is usually available via: - -```bsh -$ sudo journalctl -fu teleport -``` - -If you wish to increase the verbosity of Teleport's syslog, you can pass -`--debug` flag to `teleport start` command. +(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!) diff --git a/docs/pages/enterprise/sso/one-login.mdx b/docs/pages/enterprise/sso/one-login.mdx index 37e0f863148..ccb3de326fe 100644 --- a/docs/pages/enterprise/sso/one-login.mdx +++ b/docs/pages/enterprise/sso/one-login.mdx @@ -114,7 +114,7 @@ $ tctl create onelogin-connector.yaml ## Create a new Teleport Role We are going to create a new that'll use external username data from OneLogin -to map to a host linux login. +to map to a host linux login. In the below role, Devs are only allowed to login to nodes labelled with `access: relaxed` Teleport label. Developers can log in as either `ubuntu` to a username that @@ -174,16 +174,4 @@ automatically in a browser). ## Troubleshooting -If you get "access denied errors" the number one place to check is the audit -log on the Teleport auth server. It is located in `/var/lib/teleport/log` by -default and it will contain the detailed reason why a user's login was denied. - -Some errors (like filesystem permissions or misconfigured network) can be -diagnosed using Teleport's `stderr` log, which is usually available via: - -```bsh -$ sudo journalctl -fu teleport -``` - -If you wish to increase the verbosity of Teleport's syslog, you can pass -`--debug` flag to `teleport start` command. +(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!) diff --git a/docs/pages/includes/sso/loginerrortroubleshooting.mdx b/docs/pages/includes/sso/loginerrortroubleshooting.mdx new file mode 100644 index 00000000000..d294b001d43 --- /dev/null +++ b/docs/pages/includes/sso/loginerrortroubleshooting.mdx @@ -0,0 +1,83 @@ + + + +### Using the Web UI + +If you get "access denied" or other login errors, the number one place to check is the Audit +Log on the Teleport Auth Server. You can access it in the **Activity** tab of the Teleport Web UI. + +![Audit Log Entry for SSO Login error](../../../img/sso/teleportauditlogssofailed.png) + +Example of a user being denied because the role `clusteradmin` wasn't set up: + +```json +{ + "code": "T1001W", + "error": "role clusteradmin is not found", + "event": "user.login", + "method": "oidc", + "success": false, + "time": "2019-06-15T19:38:07Z", + "uid": "cd9e45d0-b68c-43c3-87cf-73c4e0ec37e9" +} +``` + +### On the Auth Service host +You can monitor Audit Log file entries and process logs on the Teleport Auth Server. +The Audit Log is located in `/var/lib/teleport/log` by +default and it will contain a detailed reason why a user's login was denied. + + + If you are using a Teleport storage configuration that does not store log entries locally, this will not appear. You can look at the `teleport` +process logs to see `ERROR` and `INFO` entries. + + +Example of a user being denied because the role `clusteradmin` wasn't set up: + + +```json +{ + "code": "T1001W", + "error": "role clusteradmin is not found", + "event": "user.login", + "method": "oidc", + "success": false, + "time": "2019-06-15T19:38:07Z", + "uid": "cd9e45d0-b68c-43c3-87cf-73c4e0ec37e9" +} +``` + +Some errors (like filesystem permissions or a misconfigured network) can be +diagnosed using Teleport's `stderr` log, which is usually available via: + +```code +$ sudo journalctl -fu teleport +``` + +If you wish to increase the verbosity of Teleport's logs, you can pass the +[`--debug`](../../setup/reference/cli.mdx#teleport-start) flag to the `teleport start` command. + + +If you get "access denied" or other login errors, the number one place to check is the Audit +Log on the Teleport Auth Server. You can access it in the **Activity** tab of the Teleport Web UI. + +![Audit Log Entry for SSO Login error](../../../img/sso/teleportauditlogssofailed.png) + +Example of a user being denied because the role `clusteradmin` wasn't set up: + +```json +{ + "code": "T1001W", + "error": "role clusteradmin is not found", + "event": "user.login", + "method": "oidc", + "success": false, + "time": "2019-06-15T19:38:07Z", + "uid": "cd9e45d0-b68c-43c3-87cf-73c4e0ec37e9" +} +``` + + diff --git a/docs/pages/setup/admin/github-sso.mdx b/docs/pages/setup/admin/github-sso.mdx index ef0d68de25c..022e027c6e7 100644 --- a/docs/pages/setup/admin/github-sso.mdx +++ b/docs/pages/setup/admin/github-sso.mdx @@ -21,7 +21,7 @@ This guide explains how to set up Github Single Sign On (SSO) for Teleport. Ensure that your OAuth App's "Authentication callback URL" is `https://PROXY_ADDRESS/v1/webapi/github/`, where `PROXY_ADDRESS` is the public - address of the Teleport Proxy Service. + address of the Teleport Proxy Service. @@ -29,7 +29,7 @@ This guide explains how to set up Github Single Sign On (SSO) for Teleport. To download Teleport Enterprise, visit the [customer portal](https://dashboard.gravitational.com/web/login). - + - Create and register a GitHub OAuth App. To do so, follow the instructions in GitHub's documentation. @@ -37,7 +37,7 @@ This guide explains how to set up Github Single Sign On (SSO) for Teleport. Ensure that your OAuth App's "Authentication callback URL" is `https://PROXY_ADDRESS/v1/webapi/github/`, where `PROXY_ADDRESS` is the public - address of the Teleport Proxy Service. + address of the Teleport Proxy Service. @@ -45,7 +45,7 @@ This guide explains how to set up Github Single Sign On (SSO) for Teleport. - Sign up for a Teleport Cloud account. If you do not have one, visit the [sign up page](https://goteleport.com/signup/) to begin your free trial. -- Create and register a GitHub OAuth App. To do so, follow the instructions in GitHub's documentation. +- Create and register a GitHub OAuth App. To do so, follow the instructions in GitHub's documentation. [Creating an OAuth App](https://docs.github.com/en/developers/apps/building-oauth-apps/creating-an-oauth-app) @@ -144,3 +144,7 @@ auth_service: You can now log in with Teleport using GitHub SSO. + +## Troubleshooting + +(!docs/pages/includes/sso/loginerrortroubleshooting.mdx!)