* feat: tolerate unknown resource constraint kinds
Certs carrying constraint kinds unknown to the current build previously
failed the whole identity decode, and stored access requests carrying
them failed reads outright. Unknown content now degrades to a non-nil
Constraints with nil Details. Enforcement denies only the affected
resource, re-encoding preserves the marker, and stored requests stay
readable. Creation and storage writes remain strict, keeping the marker
from overwriting newer constraint content in the backend.
* refac: Address review feedback
* feat(certs): thread beam_id through identity certificates
Carries the beam identifier from a delegation session's BeamIDLabel into
issued SSH/TLS certificates and back out via the cert extensions/ASN.1 OID,
exposes it on tlsca/sshca Identity and the decision PDP identities, propagates
it through scoped cert reissue (auth_with_roles), and surfaces it on event
UserMetadata for attribution.
* handle missing event cases
* prevent overriding beams_id cert extension with roles cert extensions
* handle code review comment
check manager for kube service, and porting
GetClusterNetworkingConfig, GetClusterName, InventoryControlStream,
WatchEvents, and GetSessionRecordingConfig RPCs
* Convert existing non-gogo codegen to the Hybrid API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Initial migration to the Opaque API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All of the changes here are mechanical conversions generated from
`open2opaque rewrite -levels=green ./...`. There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=yellow followed by
-levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more
details.
* fix: Always populate AllowedResourceIDs on decoded Identity
- TLS and SSH cert decoders populated AllowedResourceAccessIDs but left
AllowedResourceIDs nil. Any path decoding an identity and re-encoding
via Subject() would result in the encoder injecting a sentinel value
into the legacy field, and storing all resources under the new
AllowedResourceAccessIDs field only.
This specifically broke database access in mixed-version clusters:
Proxy would decode user cert, build a CSR (Subject()), send it to Auth
for signing (FromSubject() then Subject() again). This dropped
AllowedResourceIDs, storing all under the new extension, so older
database agents received the cert with only the sentinel in the legacy
extension, and unaware of the new extension, denied access.
Fix by populating AllowedResourceIDs at decode time in both decoders
via UnwrapResourceAccessIDs, ensuring and unconstrained resources
persist across decode-re-encode cycles.
* refac: tidy ca_test encode/decode test
* Fix headless login when in-band MFA is required.
* Set HeadlessAuthenticationID in headless cert and allow bypass of in-band MFA if set.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Update proto to fix test.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Delete useless assert.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
---------
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Add `DelegationSessionService` protobuf definition
* Implement `GenerateCerts` RPC
* Prevent restricted delegation sessions from inheriting administrative privileges
Previously, the `resources` list on a delegation session would restrict regular
access to resources that weren't explicitly included, but not administrative
actions.
Now, we explicitly deny all administrative (rule-authorized) actions for
delegation sessions unless you include a wildcard in `resources`.
* Only permit list/read/readnosecrets for allow-listed resource kinds
* Fix reused extension OID
* Add a small amount of tolerance for clock skew
* Make the "expires must be in the future" message clearer
* Fix linter errors
* Access to a windows desktop implies access to the desktop service
* Add `DelegationSessionID` to the decision package's `SSHIdentity` and `TLSIdentity`
* Wrap `ExtractConditionForIdentifier` for delegation sessions too
* Prevent calling `GenerateCerts` inside a delegation session
* No need for indirection with GenerateUserCerts method now
* Fix import ordering
* Stop delegation service from returning CA certificates
Per @strideynet's request, to avoid replicating existing bad patterns around
conflating the user and host CAs.
* Error messages should start with lowercase letters
* Add `RouteToKubernetes` wrapping message
* Replace expires parameter with TTL
* Remove unnesasary error check
* Fix `AgentScope` extension type assertion
* feat: Extend `AWSRole` struct w/ `RequiresRequest`
- Differentiate between already-granted vs. requestable AWSRoles when
including requestable resources in `clusterUnifiedResourcesGet`
req
* feat: Implement Resource Constraints support for Proxy, Auth
* fixup: Fix tests
* test: Add tests for resourceaccessid-related helpers
* fixup: Address code review feedback
* test: Update identity/events tests for new `ResourceAccessID` fields
* fixup: Expand/improve godocs/comments for sentinel ResourceID handling
* fixup: Address code review feedback
* feat: Conv ResourceID->ResourceAccessID at cert decoding
- Convert ResourceIDs present on certs to ResourceAccessIDs at decoding
time, rather than at each callsite. Update tests/usages of tlsca/sshca
Identities to reflect this.
* Device Trust: add `required-human` mode
* Add `device_trust.mode=required-human` to the test plan
* Add `IsBot` methods to TLS and SSH identities
* Fix `required-human` mode on roles
* Rename mode to `required-for-humans` for clarity
* Undo premature changes to device trust guides
* Default `deviceVerificationPassed` false to avoid accidents when adding new modes
* Handle `BotName` and `BotInstanceID` in `lib/auth/authtest`
* Fix stray reference in test
* Fix reference to `config.DestinationMemory`
* Handle empty device trust mode
* MWI: Add lock targets for join token name and bot instance ID
This adds two new lock targets meant to help lock specific bot
instances without affecting all bots sharing a single user:
- Bot Instance ID: Targets a bot instance UUID, which has been
assigned automatically to unique bot instances for some time
- Join token name: Targets the join token through which the bot
joined
Bot instance ID locks are most useful for traditional token-joined
bots, since tokens are single use and bots have no way to onboard
again without human intervention if their old certs (and old bot
instance) expire.
Join token locks are useful for bots using delegated join methods.
They are particularly useful for bound keypair joining, where there
is a direct 1:1 relationship between a "bot instance" and a token,
even though that bot ID will change each time a recovery takes place.
Note that this does not currently set the join token for nodes even
though that would theoretically be possible. We could consider
supporting node locking in the future if there's demand.
* Set join token cert request field for non-renewable bot identities
* Fix ASN ID and pass through join token name in impersonated certs
* Tweak docstrings and add missing references for lib/decision
* Clarify docstrings
Clarifies various docstrings and makes sure they mention `token`
joined bots cannot be targeted.
* Fix failing tests
This commit introduced mutual TLS authentication
for auth server API server.
Auth server multiplexes HTTP over SSH - existing
protocol and HTTP over TLS - new protocol
on the same listening socket.
Nodes and users authenticate with 2.5.0 Teleport
using TLS mutual TLS except backwards-compatibility
cases.
Maxim