Adds a new variable `user.metadata.name` that can be used in role templates:
```yaml
allow:
node_labels:
owner: '{{user.metadata.name}}'
```
Or in expressions:
```yaml
allow:
node_labels_expression: |
labels["owner"] == user.metadata.name
```
So that you can create roles that allow access to user-owned resources such as
"Connect My Computer" nodes, or the upcoming Beams feature.
Enables pinning SSO users to a scope when authenticating
via the command line. The plumbing for pinning SSO logins
via the WebUI was added as well, but is explicitly rejected
with an error for now.
* Support relay transport in the proxy client
* Support generating client options at login time
* Support storing, overriding and using the relay in tsh
* Set the default relay address based on a trait
* Display relay info from the profile in tsh status
* Add relay support to tbot ssh multiplexer
* use relay_server like proxy_server
* Make the trait name similar to other internal traits
* Simplify default status, add info in debug
* Only show relay address in status if set
* Move auth test helpers to authtest package
In an effort to remove testing symbols from the teleport binary
the auth helpers in lib/auth/helpers.go are being moved to a new
lib/auth/authtest package. This package is to be limited to only
being imported within _test.go files to prevent the helpers from
slipping back into production code.
* Convert lib/auth tests to use lib/auth/authtest
All tests within lib/auth that made use of the test helpers in
lib/auth/helpers.go now use the equivalent functionality provided
by lib/auth/authtest. To prevent import cycles the tests in lib/auth
have been moved to the auth_test package. This shift required some
extra work as a fair number of the existing tests relied on unexported
symbols. To work around this lib/auth/export_test.go has been added
for the sole purpose of exporting private types, methods, or extending
existing types with new exported received methods. This was chosen
over rewriting existing tests for time and simplicity. All future
tests should not rely on this hack and should instead stick to
testing the publicly exported items from the auth package.
* fix: allow specifying accepted usage in cert requests
* fix: restore test assertions in TestGenerateKubernetesUserCert
* fix: set remote cluster variables
* fix: restore test assertions in TestGenerateUserCertWithHardwareKeySupport
* fix: context passing to user cert generation
* fix: github connector API
* fix: pull renewable field from outer identity
* rename authtest.TestDevice authtest.Device
* fix: typos
* add clean up TODOs
* Refactor authtest helpers
* fix: convert additions to bound keypair tests
* fix: add plugin service to authtest helpers
* * Move ValidateClientRedirect from lib/auth/github.go to lib/client/sso/redirector.go
* Replace binary ssoTestFlow boolean with ceremony type to incorporate MFA ceremonies
* Validate that "/web/sso_confirm" is only used for MFA ceremonies
* Address comments.
* Add warning comment; Update error message.
* Update/Add tests.
* Require channel_id as exclusive query parameter for sso mfa web redirect.
* Update lib/client/sso/redirector.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Convert auth_with_roles to use slog
* allow benchmark tests to log
* remove last use of logrus in github.go
* remove last use of logrus in rotate.go
* remove auth package logrus logger
* convert auth.go to exclusively use slog
* convert db.go to exclusively use slog
* convert methods.go to exclusively use slog
* convert password.go to exclusively use slog
* convert join_ec2.go to exclusively use slog
* convert join_iam.go to exclusively use slog
* convert kube.go to exclusively use slog
* convert oidc.go to exclusively use slog
* convert saml.go to exclusively use slog
* convert sso_diag_context.go to exclusively use slog
* convert transport_credentials.go to exclusively use slog
* convert trustedcluster.go to exclusively use slog
* convert usertoken.go to exclusively use slog
* convert user.go to exclusively use slog
* remove logrus import
* fix: pass in context
* fix: remove new use of package logrus logger
Replaces the dependency on go-oidc/oauth2 with x/oauth2 in the
github connector auth flows. One result of the switch is that it
permitted a lot of simplification - the github client cache used
by the auth server was removed entirely.
* Add SSO MFA ceremony support to WebUI per-session MFA.
* Add display name to SSO MFA device; Add SSO MFA device to SSO challenge.
* Camel case json tags for front end.
* Add sso channel ID for front end broadcast channel logic.
* Fix backwards compatiblity issue; fix error message.
* Fix test.
* Fallback to connector id if display name isn't set.
* Fix test.
* Resolve comment.
* Use uuid.NewRandom.
* go mod tidy
* Move trusted device mode calculation into CreateWebSessionFromReq
* Add the GithubAuthRequest.ClientUserAgent field
* Update generated protos
* Issue DeviceWebToken during Github authn
* Issue DeviceWebToken as part of CreateWebSessionFromReq
* nit: Move methods to sessions.go
* Remove authclient.Client/ClientI/NewClient aliases in lib/auth
* Remove WebSessionReq aliases in lib/auth
* Remove GithubAuthResponse aliases in lib/auth
* Remove GithubAuthRequest aliases in lib/auth
* Remove KubeCSR alias in lib/auth
* Remove KubeCSRResponse alias in lib/auth
* Remove OIDCAuthResponse alias in lib/auth
* Remove OIDCAuthRequest alias in lib/auth
* Remove ValidateOIDCAuthCallbackReq alias in lib/auth
* Remove OIDCAuthRawResponse alias in lib/auth
* Remove CreateUserTokenRequest alias in lib/auth
* Remove SAMLAuthResponse alias in lib/auth
* Remove SAMLAuthRequest alias in lib/auth
* Remove ValidateSAMLResponseReq alias in lib/auth
* Remove SAMLAuthRawResponse alias in lib/auth
* Remove ValidateTrustedClusterRequest alias in lib/auth
* Remove ValidateTrustedClusterRequestRaw alias in lib/auth
* Remove ValidateTrustedClusterResponse alias in lib/auth
* Remove ValidateTrustedClusterResponseRaw alias in lib/auth
* Remove AuthenticateUserRequest alias in lib/auth
* Remove ForwardedClientMetadata alias in lib/auth
* Remove PassCreds alias in lib/auth
* Remove OTPCreds alias in lib/auth
* Remove SessionCreds alias in lib/auth
* Remove AuthenticateSSHRequest alias in lib/auth
* Remove SSHLoginResponse alias in lib/auth
* Remove TrustedCerts alias in lib/auth
* Remove AuthoritiesToTrustedCerts alias in lib/auth
* Move auth.HostFQDN to authclient
* Move auth.WithClusterCAs, auth.DefaultClientCertPool and auth.ClientCertPool to authclient
* Switch alpn proxy to use authclient.CAGetter instead of auth.ReadProxyAccessPoint
* Use a smaller scoped interfaces in lib/proxy/peer to remove lib/auth dependency
* Move auth.TryCreateAppSessionForClientCertV15 to authclient
* Move auth.ErrNoMFADevices to authclient
* Move access point interfaces to authclient. Aliases left behind to prevent breaking builds
* remove lib/auth dependency from lib/reversetunnelclient
* fix lints
* fix license
* Bump e ref to include gravitational/teleport.e#4174
* Use authclient.Client in new tctl diag commands
* Stop using auth.UserTokenType aliases
This starts separating the lib/auth client and server code into
distinct packages to reduce the dependency tree of client tools.
For the time being aliases were left to all things moved into
lib/auth/authclient to reduce the changeset and ensure code still
compiles. Future changes will be built off this to convert code
to use lib/auth/authclient where applicable, this was intentionally
left to a minimum amount of changes to facilitate backports.
* Update GitHub update event code
* Handles prev github update event code in web ui
* reverts code to original github update version and handles in web ui
* ui test fix
* add comment on event code
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update GitHub Auth connector event descriptions to use camelcase
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
Some consts in the `auth` package are used in a lot of other packages.
This increases the probality of getting a cyclic dependency error.
This PR moves some of those consts to the defaults package and updates
all the required locations of their usage.
Only one is missing in the `/e/` repo, which I'm going to open a PR for
it.
After merging, we can also remove the `lib/auth.TokenLenBytes`
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legeacy UpsertGithubConnector RPC. This implements the RPC handler
and updates the signature of UpsertGithubConnector to return the
upserted connector in the same manner that Create and Update do.
Auth connectors, users, and roles have all recently had their APIs
extended to support create and update but were still only emitting
create events. This adds new update events and update metadata
and emits them instead of the create events.
Updates tctl edit and the web ui to start using optimistic locking.
The functionality to support optimistic locking already existed, the
APIs used by both clients were updated to use create/update instead
of upsert so that optimistic locking could be enforced. Most of the
changes introduced are tests to ensure that tctl edit, tctl create
and the web ui behave as expected.
Contributes to #30416.
Updates services.UserService and auth.ClientI to contain the
Create and Update methods for all auth connectors and implements
them at the client, server, and services layer. Upsert was untouched
to prevent breaking e and will be addressed in a follow up PR.
Contributes to #30416.
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
The user login state is being generated properly but not being used for
the various sessions. UserLoginState is now properly integrated into
sessions. Additionally, it was noticed that user login state was not being
used for Github logins, so it's been added there as well.
Additionally, getUserOrLoginState has been exposed for use by the
enterprise repo.
Co-authored-by: Lisa Kim <lisa@goteleport.com>
* Add login hooks.
Login hooks have been added to support performing arbitrary operations on
user login. This is done to support generating of an Okta assignment on
user login for the Okta service feature.
* Don't use error channel for calling hooks, test login hooks.
* Expose ResetLoginHooks for external testing.
* Provide user as part of login hook.
* Update lib/auth/methods.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Improve the documentation for LoginHook, AuthenticateUser returns types.User.
* Use user.GetName() instead of username in AuthenticateSSHUser response.
* Address nits and restore comments.
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
