* Add `AutoUpdateBotReport` resource definition
* Generate bot version report once per minute
* Add gRPC endpoint for reading bot report
* Add updater info to the bot heartbeat message
* Fix a couple of minor typos
* Add forgotten cache event plumbing
* Fix duplicate import
* Fix racy test
* Add missing license header
* Fill HostUUID in tests
* Rename "bot report" to "bot instance report"
* Fix formatting
* Make one of the expected values different
* Defend against expired instances being counted
* Closer align `AutoUpdateBotInstanceReport` resource with RFD 153
* Add endpoint for deleting report
* Move auth test helpers to authtest package
In an effort to remove testing symbols from the teleport binary
the auth helpers in lib/auth/helpers.go are being moved to a new
lib/auth/authtest package. This package is to be limited to only
being imported within _test.go files to prevent the helpers from
slipping back into production code.
* Convert lib/auth tests to use lib/auth/authtest
All tests within lib/auth that made use of the test helpers in
lib/auth/helpers.go now use the equivalent functionality provided
by lib/auth/authtest. To prevent import cycles the tests in lib/auth
have been moved to the auth_test package. This shift required some
extra work as a fair number of the existing tests relied on unexported
symbols. To work around this lib/auth/export_test.go has been added
for the sole purpose of exporting private types, methods, or extending
existing types with new exported received methods. This was chosen
over rewriting existing tests for time and simplicity. All future
tests should not rely on this hack and should instead stick to
testing the publicly exported items from the auth package.
* fix: allow specifying accepted usage in cert requests
* fix: restore test assertions in TestGenerateKubernetesUserCert
* fix: set remote cluster variables
* fix: restore test assertions in TestGenerateUserCertWithHardwareKeySupport
* fix: context passing to user cert generation
* fix: github connector API
* fix: pull renewable field from outer identity
* rename authtest.TestDevice authtest.Device
* fix: typos
* add clean up TODOs
* Refactor authtest helpers
* fix: convert additions to bound keypair tests
* fix: add plugin service to authtest helpers
Moves all test related logger initialization and creation to the
logtest package to reduce testing symbols in production code. The
existing helpers in lib/utils have been left in place until the
enterprise references can be converted.
Updates #51023.
The new package is meant to house a test friendly implementation
of modules.Modules. Due to the pervasive and global nature of
modules, this package also contains a copy of of
modules.SetTestModules. In a perfect world this function wouldn't
be needed and modules would be injected where required, however,
that would take considerable effort. The existing test modules
are temporarily left in place until the enterprise tests can be
updated to use modulestest.
* * Move ValidateClientRedirect from lib/auth/github.go to lib/client/sso/redirector.go
* Replace binary ssoTestFlow boolean with ceremony type to incorporate MFA ceremonies
* Validate that "/web/sso_confirm" is only used for MFA ceremonies
* Address comments.
* Add warning comment; Update error message.
* Update/Add tests.
* Require channel_id as exclusive query parameter for sso mfa web redirect.
* Update lib/client/sso/redirector.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Teleport auth should refuse to start when jumping major versions (#41782)
* linter fixes
* code review changes:
- replaced to use process storage and state itme
- regexp replaced with semver
- additional check for v18 for empty version record in storage
* code review changes:
- add integration test
- store latest version in separate key
* code review changes:
- table tests
- error message
* code review changes:
- minor changes
* code review changes:
- reuse context for write operation
* code review changes:
- simplify integration test
- add downgrade check
- minor changes
* code review changes:
- move logic to the auth init
* code review changes:
- add development env to skip version check
- init the process storage if it is not set
* code review changes:
- add interface for local process storage
- use semver in storage instead
* change interface to version storage
* add fake version storage for other tests
* Remove auth.UserTokenType aliases
* Remove auth/api.go
* Stop using auth.AccessCache aliases
* Stop using auth.Cache aliases
* Stop using auth.Announcer alias
* Stop using auth.ProxyAccessPoint alias
* Stop using auth.ReadProxyAccessPoint alias
* Stop using auth.RemoteProxyAccessPoint alias
* Stop using auth.NewRemoteProxyCachingAccessPoint alias
* Stop using auth.ReadKubernetesAccessPoint alias
* Stop using auth.KubernetesAccessPoint alias
* Stop using auth.ReadDatabaseAccessPoint alias
* Stop using auth.DatabaseAccessPoint alias
* Stop using auth.WindowsDestkopAccessPoint alias
* Stop using auth.AppsAccessPoint alias
* Stop using auth.DiscoveryAccessPoint alias
* Stop using auth.NodeAccessPoint alias
* Stop using auth.ReadAppsAccessPoint alias
* Stop using cache wrapper aliases
* fix test
* update e to include https://github.com/gravitational/teleport.e/pull/4175
* Remove authclient.Client/ClientI/NewClient aliases in lib/auth
* Remove WebSessionReq aliases in lib/auth
* Remove GithubAuthResponse aliases in lib/auth
* Remove GithubAuthRequest aliases in lib/auth
* Remove KubeCSR alias in lib/auth
* Remove KubeCSRResponse alias in lib/auth
* Remove OIDCAuthResponse alias in lib/auth
* Remove OIDCAuthRequest alias in lib/auth
* Remove ValidateOIDCAuthCallbackReq alias in lib/auth
* Remove OIDCAuthRawResponse alias in lib/auth
* Remove CreateUserTokenRequest alias in lib/auth
* Remove SAMLAuthResponse alias in lib/auth
* Remove SAMLAuthRequest alias in lib/auth
* Remove ValidateSAMLResponseReq alias in lib/auth
* Remove SAMLAuthRawResponse alias in lib/auth
* Remove ValidateTrustedClusterRequest alias in lib/auth
* Remove ValidateTrustedClusterRequestRaw alias in lib/auth
* Remove ValidateTrustedClusterResponse alias in lib/auth
* Remove ValidateTrustedClusterResponseRaw alias in lib/auth
* Remove AuthenticateUserRequest alias in lib/auth
* Remove ForwardedClientMetadata alias in lib/auth
* Remove PassCreds alias in lib/auth
* Remove OTPCreds alias in lib/auth
* Remove SessionCreds alias in lib/auth
* Remove AuthenticateSSHRequest alias in lib/auth
* Remove SSHLoginResponse alias in lib/auth
* Remove TrustedCerts alias in lib/auth
* Remove AuthoritiesToTrustedCerts alias in lib/auth
* Move auth.HostFQDN to authclient
* Move auth.WithClusterCAs, auth.DefaultClientCertPool and auth.ClientCertPool to authclient
* Switch alpn proxy to use authclient.CAGetter instead of auth.ReadProxyAccessPoint
* Use a smaller scoped interfaces in lib/proxy/peer to remove lib/auth dependency
* Move auth.TryCreateAppSessionForClientCertV15 to authclient
* Move auth.ErrNoMFADevices to authclient
* Move access point interfaces to authclient. Aliases left behind to prevent breaking builds
* remove lib/auth dependency from lib/reversetunnelclient
* fix lints
* fix license
* Bump e ref to include gravitational/teleport.e#4174
* Use authclient.Client in new tctl diag commands
* Stop using auth.UserTokenType aliases
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
* split recording session events and emitting audit events
This is a refactor of how audit events and session events are handled.
Previously, all events were emitted using the same interface,
api/types/events.Emitter. This lead to event-related code getting to be
very confusing, as it was often unclear whether a given event was being
recorded as a session event and emitted as an audit event, or only one
of the two. Naturally, a few bugs arose due to this.
To simplify event handling, a separate interface for recording session
events has been created. A api/types/events.Recorder should now only be
used to record session events, and an Emitter should now only be used to
emit audit events. Instead of using a confusing TeeWriter that would
transparently (and confusingly, given its name) hold a few event types
that only belonged in session recordings, callers can now explicitly
record and/or emit an event when necessary.
* ensure e build won't break
This commit enables login rule evaluation during login for users logging
in with a GitHub connector.
The GitHub connector is a bit different from the SAML and OIDC
connectors in that the user roles are not mapped from the traits
(claims/assertions) but from the user's GitHub organizations and teams
directly.
This makes login rules slightly less useful for GitHub logins because
they cannot affect the user's roles, only their traits.
However, GitHub login is mostly an OSS feature and login rules will be
enterprise-only.
Any enterprise users making use of GitHub login will still be able to
use some of the features (trait mapping).
Create a new type - `SAMLAuthService` - and move the implementation of
the SAML connector from the auth Service to this new type. This
decoupling will make it easier to move out of tree in a later commit.
This also lays the basic groundwork for running without the SAML
connector at all, returning a NotImplemented error for all the SAML
logic if the SAMLAuthService is not plugged in.
A number of names in the `auth` package have been exported to facilitate
moving the SAML connector out of this repository. The types exported do
not need to be exported for this commit, but for subsequent commits that
move the `SAMLAuthService` out of the `auth` package.
Also apply a small fix to to emit `apievents.SAMLConnector*` events of
`apievents.OIDCConnector*` events in the SAML connector.
Update metalinter, fix a few lint warnings and replace deprecated linters.
`deadcode`, `structcheck` and `varcheck` are abandoned and now replaced by [`unused`][1].
Since 1.19, `go fmt` reformats godocs according to https://go.dev/doc/comment. I've done a bulk-reformatting of the codebase to keep the linter happy. Backporting is mostly harmless (the exception being `lib/services/role_test.go`, that for some reason breaks the _old_ linter using the new format).
[1]: https://golangci-lint.run/usage/linters/
* Bump golangci-lint version
* Replace abandoned linters
* Fix bodyclose on lib/auth/github.com
* Fix bodyclose on lib/kube/proxy/streamproto/proto_test.go
* Fix bodyclose on lib/srv/alpnproxy/proxy_test.go
* Fix bodyclose on lib/web/conn_upgrade_test.go
* Silence staticcheck on lib/kube/proxy/forwarder_test.go
* Silence staticcheck on lib/utils/certs_test.go
* Address BuildNameToCertificate deprecation warnings
* Run `go fmt ./...`
* Run `go fmt ./...` on api/
* Ignore formatting in role_test.go
* Remove redundant initializers in lib/srv/uacc/
* Update e/
* added check that blocks enterprise Github organizations using external SSO from using Github auth connectors on Teleport OSS
* added details to docs and changelog
* move check from init to on login
* cache org sso status; address small pieces of feedback
* use utils.FnCache instead of 3rd party cache
* addressed feedback
* addressed feedback
* revised docs
* addressed more feedback
* remove notes in changelog
* removed unused interface
This change, along with gravitational/webapps#530, adds a new error message for when a user successfully authenticates with SSO but fails to match any roles.
Refactored "lib/services/suite" and "lib/services/local" packages to use
testify instead of gocheck.
Swapped backend from "lite" to "memory" to cut time to run tests in
half.
