LDAP attributes aren't always a single-key to single-value mapping.
Prior to this change, Teleport would take the first value for attributes
that specify multiple values.
This change introduces a new opt-in discovery config setting that allows
users to configure Teleport to join multiple values into a single value.
* Move plugin CheckAndSetDefaults from marshal to write path
CheckAndSetDefaults was being called inside MarshalPlugin as a side
effect of serialization, which caused defaults (e.g. Namespace) to be
applied to the in-memory object after roundtrip but not at construction
time. Move the call to CreatePlugin and updateAndSwap where mutations
belong, and call setStaticFields in NewPluginV1 so constructed objects
are consistent from the start.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add test coverage
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Refactor Azure VM discovery metadata and status
Move immutable Azure VM discovery metadata into a dedicated embedded
AzureInstancesMetadata type. This lets enrollment, status, audit, usage event,
and user-task paths pass metadata separately from the mutable Instances slice,
which is filtered during enrollment.
Change the resource status from a primitive map type into a struct. This
will make the status map more flexible for further changes that
introduce parallel installation and status updates.
This also logs the instance count after filtering enrolled instances.
* Update AzureInstances godoc
* Make metadata an unembedded field
* rename loop var from group to status
* revert failed azure enrollment func to lambda
* re-eval VMs log value iff some VMs were filtered
* Add a Configuring Teleport docs section
Make the how-to guides for managing Teleport resources with
Infrastructure as Code tools more prominent by placing them in a
Configuring Teleport section next to other foundational docs sections,
e.g., Installation and Upgrading. Frame the task of managing Teleport
with IaC as part of the broader task of configuring Teleport.
To do so, move the introduction of the "Static and Dynamic Resources"
page to a landing page for the new Configuration section. Move the
remaining part of that page to the References section, since it's an
advanced guide and more of a reference than a set of how-to
instructions.
This change also structures the Infrastructure as Code landing page into
a Configure Teleport landing page by including links to guides for
static as well as dynamic configuration. This adds clarity to the docs
since users won't immediately know that Teleport exposes these two
configuration variants.
* Update internal links
* Fix issues with the Configuring Teleport section
- Update the static/dynamic field table to use the correct field name,
`spec.mode`.
- Change "Managing Resources" to "Resource Guides" for clarity, since
all sections in Configuring Teleport would be about managing
resources.
- Reorder Configuration sidebar sections to move Resource Guides last
and tctl before Terraform and Kubernetes.
* feat: text output, geo, and `--skill` support
Layer three orthogonal additions on top of the core command:
- Text rendering: period header, matches summary, wrapped facet
panel, events table. `--all-facets` opts out of the top-5
truncation.
- Geo filter (`--latitude`/`--longitude`/`--radius`, all three
required together). Geo applies to events only; the stats endpoint
has no geo params, so facet counts and `total` cover the
window+query without geo. Text output prints a Note when geo is
active.
- `--skill` prints an embedded Markdown skill for LLM agents and
skips the backend entirely.
* fix: update skill to follow RFD 0037e
* fix: small fixes reported in PR review
* fix: small suggestion about code comment
* feat: iteration based on notion/customer request
* feat: add sanitization to text rendering
* fix: small fix to the access request review
* fix: typos and PR suggestions
* fix: help message indentation
We are standardizing docs guides to add a `page_type` frontmatter field,
with values for how-to guides, references, etc. We can then use this
field to apply linting rules that ensure each guide type follows
type-specific docs site conventions. The first convention is that each
docs page must have an outcome statement, the structure of which depends
on the guide's type. Human and AI agent readers can determine from the
outcome statement whether to continue reading the guide or not.
This change assigns the `page_type` frontmatter field to 47 guides.
Where an outcome statement is missing, it adds one. Where an outcome
statement exists, it ensures that the statement matches the standard
structure so we can add a linter later on.
Of the 47 guides:
- 28 guides already included the expected outcome statement, but needed
a page_type frontmatter field.
- 11 guides included an outcome statement but required tweaking so it
followed the expected structure.
- 8 guides had no outcome statement at all
In the Jenkins guide, also change "Architecture" to "How it works" to
accommodate the page structure linter (instead of disabling it). In the
current plan, this linter will also run the outcome statement check.
* checkpoints for docker getting started guide
* adding verification commands with expected output preceeding the troubleshooting checkpoints
* adding a few more checkpoint tips
* lint error with heading
* lint error with heading
* removing duplicate suggestion and reorganizing
* pulled in master to resolve conflicts as the directory structure changed since I started drafting these updates
* edited checkpoints, formatting, and moved k8 content
* cut down the number of items in the checkpoints, rephrased some sentences, fixed link paths as they were added before the pages was moved
* created a section forcommon troubleshooting items vs so many checkpoints
* changing container to variable
* adding back the sidebar label, and added '-t' (tty) flag to docker exec command to improve text output/alignment
* post-feedback: formatting, troubleshooting content revisions
* post-feedback: formatting, and slimming down troubleshooting content
* post-feedback: formatting, and slimming down troubleshooting content
* rephrasing intro paragraph, as most prod Teleport deployments in containers are running on k8s
* followed AI suggestions and implemented suggestions on removing previous k8 content and streamlining
* cleanup, restored backup guidance
* linter flagged for list spacing - added lines
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@gmail.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@gmail.com>
* feat: add `tctl investigate` command
Add a tctl subcommand that searches Teleport's Identity Security
activity logs. The command exposes structured filter flags mirroring
the Identity Security UI: ~19 include/exclude pairs mapping to Lucene
fields (user, resource, IP, country, etc.). Multiple values on the
same flag are OR'd; different flags are AND'd.
`--query` accepts a raw Lucene expression for cases the structured
flags can't express (wildcards, regex, OR across fields) and is
mutually exclusive with the structured filters.
Facets and events are fetched in parallel via errgroup. `total` is
derived from the `event_type` facet on the stats endpoint, so it can
drift a few percent from `len(data)` on long windows.
This PR ships JSON/YAML output only. Text rendering, the geo filter,
and the `--skill` flag land in the next PR in the stack.
* fix: address codex suggestions
* fix: update flag description
* docs: add prereqs to selinux guide
* reduced verbiage, streamlined bullets, and split the agent requirement
* minor sentence edits. also removed dupe info, we already have the first header with the rhel requirements
* Update docs/pages/zero-trust-access/management/security/selinux.mdx
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Run the connection upgrade test with reversetunnelv2
* Use unwrapped connections to the auth in multiplex listener mode
* Clarify wording in debug log
* Add a test for ALPN used in direct and proxy mode
* Update godocs
* Change struct names for better clarity
* hack on migrating list RPC
* Fix tests
* Tidy up/fix tests
* Use `clientutils.CollectWithFallback`
* Use clearer c.APIClient rather than rely on embeding
* Cover ListTunnelConnections in cache test
* tweak logging
* update deprecation version
* Move fallback impls
* fix span ctx prop
* fix pagination bug when unmarshal bad
* USe t.Context()
* fix ctx propagation
* Update tunn conns to use range pattern - thanks luke
* fix unneeded dependency
* fix deprecation
* env: dev
use opaque API
* Add property-based testing for thumbnails/metadata generation
* Convert the resize test to a normal table test
* Increase the timeouts
* Reduce dimensions to avoid CI from dying
* Factor teleport-proxy-lib library chart out of teleport-cluster helm chart
* Remove 'FQDN' suffix from variable name and clean up comments
* Restored $proxy in config templates to minimize differences in review.
* Restored unnecessary changes to ingress template
* Fix unnecessary change in predeploy job
* used deep copy for .Values
* Explain renter-time _validation in comment
* Set domain for proxy config test
* Fixed snapshot and test differences
* Cleaned up comments
* Replace mistakenly removed asserts
* Added forceHAReplicas tests
* Fixed edge case of replicas=0, preserving previous behavior
* Eliminated intermediate version/majorVersion templates and used util lib templates directly
* Update examples/chart/lib/teleport-proxy-lib/templates/_ingress.tpl
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Removed unneeded alias for teleport-proxy-lib
* Corrected teleport-cluster schema bugs and removed teleport-proxy-lib validation not also done by schema
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* docs: distinguish host user creation from host sudoers in SSH guides
* clarified conflicting language, added missing comma to yaml as it was causing syntax errors when testing, and clarified examples
* post-feedback: clarifications and corrections
* added note about insecure-drop users
Rename encodeSessionRecordingThumbnail and its result type
sessionRecordingThumbnailResponse to the exported
EncodeSessionRecordingThumbnail and SessionRecordingThumbnailResponse so
the enterprise session search web handler can reuse the proto-to-JSON
thumbnail conversion instead of duplicating it.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Composite the cursor in Rust during ResizeCrop
* Apply code review feedback
* Update test
* Move CursorBitmap to an enum, remove Cow, avoid cloning the bitmap
* Remove dereference
* Invalidate E2E Rust cache on decoder changes
VERSION can be empty if there is an error running get-version.
Quote the arg so that empty VERSION is detected and returns
an error when running make docs.
* MWI: Ignore `user_login_state` for bots
This change is part of a fix for gravitational/teleport#63920, where
the Okta usermonitor will inadvertently create unneccessary ULS
entries for bots when they are deleted. Normally, these ULS entries
are sane, but if the bot is deleted and recreated too quickly, there's
a race.
Here's the sequence of events:
1. The user creates a bot (`tctl bots add` or similar)
2. The usermonitor watcher catches the OpPut and creates a sane ULS
entry
3. The user deletes the bot (`tctl bots rm ...`)
4. The usermonitor watcher catches the OpDelete and replaces the sane
ULS with an empty variant, with no roles or labels.
5. The user recreates the bot (`tctl bots add ...`)
6. One of two events happens first:
1. The usermonitor watcher catches the OpPut and replaces the bad
ULS with a sane variant.
2. The bot joins and receives certificates
If 6.1 occurs before 6.2, the bot joins normally and receives valid
certificates. If 6.2 occurs before 6.2, the bot is issued certs with
roles derived from the bad ULS (i.e. empty list) and fails to start
due to the invalid cert bundle.
In my testing, the race window is ~1 second. I see a ~10% failure rate
if the bot is joined within 0.5 seconds of being recreated, and a 50%
failure rate if the bot is joined immediately (well, as immediately as
tbot can start after `tctl bot add ...` returns). Bot joins generally
succeed if there's >= 1 second between recreate and join.
The associated teleport.e makes the usermonitor ignore bots so new
invalid ULS entries won't be created. However, this isn't sufficient
to fix the bug for existing clusters. This PR adds 2 additional fixes:
- `GetUserOrLoginState()` always returns the user variant for bots,
ignoring any potential ULS.
- Deleting a bot now deletes any ULS entry for the bot
See also: https://github.com/gravitational/teleport.e/pull/8773
* Fix failing test
Zac Bergquist