Now 'verify-full', 'verify-ca' and 'insecure' modes can be used when connecting to a database. 'verify-full` is the default on and it's the most strict. 'verify-ca' skips the server-name check. 'insecure' accepts any certificate provided by a database.
* Add access requests to tlsca.Identity, and store them in TLS certs
This mirrors what we already do for SSH certs.
* Keep track of access requests in web sessions
* Keep track of access requests in app sessions
* Include the current access requests when issuing new user certs
This is necessary because we extend the list of current roles
instead of starting from the statically assigned ones, so we should
also keep track of all the potential ways that those roles were
granted to the user.
* fix: pass access requests through PreAuthenticatedSignIn
* Tests for access requests in TLS certs
Prior to this change, desktop access only respected locks
on users or roles. This introduces a desktop as a lock target,
preventing new connections and terminating existing connections
to a locked desktop.
Note: when a lock is created, connection attempts will fail
with the generic "websocket connection failed" error.
This will be addressed with #8584.
Updates #8742
* Refactor component heartbeat callbacks
Consolidate the OK/degraded broadcasts so the same logic isn't
duplicated for each component.
* Periodically update discovered desktops
Fixes#8644
* Allow customizing the desktop search
With this change, we support a discovery base DN other than '*',
and add support for further filtering the results with additional
LDAP filters.
Additionally, we filter out group managed service accounts, which
show up in LDAP searches for (objectClass=computer), despite not
being comptuers. (This is mostly harmless, as the service accounts
aren't present in DNS, so Teleport just ignores them. It does, however,
log a DNS error message that could be confusing, so we explicitly
filter these out just to be safe. This was discovered when testing
on AWS managed AD, which creates a gMSA for DNS.
This new feature in Go 1.17 automatically restores the environment
variable to its previous value when a test ends, making it simpler
to set up the environment for tests and less likely that we accidentally
leave behind global state.
Also convert some of the remaining uses of check to standard Go tests.
Some integration tests modify global "constants" to speed up test
execution (e.g. shortening polling intervals). This is occasionally
tripping the Go data race detector, so I have added explicit
serialisation to reading and writing these global settings.
These values are only ever changed in a test environment, and there
should be zero contention for them in a non-test environment.
The default user verification setting, "preferred", leaves it open for
client-side implementations whether to to perform verification checks.
In theory it sounds reasonable, but in practice it takes a variety of
forms: Chrome will perform PIN checks if a PIN is configured, a
redundant check in face of our existing password checks. Windows goes a
step further and directs user to set a PIN, a further deviation from the
usual security key workflow.
The traditional workflow is achieved by setting user verification to
discouraged, implemented here.
Reference:
- https://chromium.googlesource.com/chromium/src/+/refs/heads/main/content/browser/webauth/uv_preferred.md
* Set user verification to "discouraged" for WebAuthn
* Add user verification to CredentialAssertion proto
* Add authenticator selection to CredentialCreation proto
Allow users to opt in to changing routing behavior when duplicate
nodes are present. Legacy behavior is to return an error when multiple
nodes are matched by the routing logic in proxyToHost. A new RouteToMostRecent
flag in ClusterNetworkingConfig can be set to allow users to opt in to returning
the most recent node instead of an error. By default, the legacy behavior
is preserved.
* Add RBAC for Windows desktop access
This commit adds RBAC checks for Windows Desktops as described in
RFD 33 and RFD 34:
- add Windows desktop logins & labels to role definition
- introduce new file config for host labels based on a regexp match
- auth server API performs access checking for Windows desktop resources
- add RDP client callback to authorize the user
- support user/role locks
- respect the client idle timeout setting
Note: in cases where an connection is terminated to to RBAC, the web UI
currently displays "websocket connection failed" because the connection
is closed from the server. We'll need to follow up with a nice error
message for the client side to improve the UX here.
Other changes:
* Remove OSS RBAC migration marked for deletion
* Stop creating a default admin role
* add wildcard desktop access to the preset access role
Updates #7761
Before this change, second_factor types 'on' and 'optional' required U2F.
Starting at the next Teleport version, those settings require Webauthn by
default and treat U2F as optional.
Group second factor tests by second factor type, which is a more natural way to
think about configuration and cuts some repetition in testing.
* Simplify and extend second factor config tests
* Allow second_factor 'on' and 'optional' without U2F
* Make teleport.yaml parsing correctly reflect absent U2F
* Simplify uses of GetSecondFactor when applicable
We can take advantage of the IsSecondFactor*Allowed functions to do some
heavy lifting for us.
* Additional error handling
* PIV authentication for RDP
This uncomfortably large change fully implements smartcard PIV
authentication for RDP clients using the Teleport CA:
- PIV applet implementation in emulated RDP smartcard
- generating Windows-compatible certificates using Teleport CA with a
dedicated RPC
- generating dummy CRLs for Teleport CA and publishing it via LDAP
The CRLs are required by Windows for any smartcard login certificate, we
can't avoid that. But we can avoid making it public: the CRL can live in
ActiveDirectory instead of a public endpoint of a Teleport service.
Here, we use LDAP to publish the CRL on startup, valid for a year.
There are a few unhandled cases in the current implementation:
- LDAP server certificate is not validated when upgrading to TLS
- multiple active CAs (with HSMs) are not supported, only one CRL is
published
- CA rotation is not supported, CRL is not re-published on rotation
All of the above issues will be handled in future PRs as this one is
already too large.
* Address review feedback
* Fix linter errors
Give Teleport clients a consistent hint of which MFA method they should
favor when facing multiple options.
To be used by tsh and Web UI to decide whether they should refer to
"U2F" or "WebAuthn" during the transitional period.
* Return preferred MFA method on ping endpoints
Prior to this change, we have several variants of CheckAccessTo*
methods for each resource type that uses RBAC.
This change reduces duplication and the potential for RBAC to behave
differently for different resources by implementing a common
CheckAccess method that can check access to a variety of resources.
This implementation is also sometimes faster than the original
implementation, because it is careful to avoid checking unnecessary
matchers after a role has already denied access.
This includes a new resource for KubernetesClusterV3 and a conversion func.
Note: plumbing the KubernetesClusterV3 resource through existing protos
and deprecating the original resource is out of scope for this change.
- Rename ApproveAccountRecovery to VerifyAccountRecovery
to match the language we use for the UI
- Use generic TokenID field naming for requests where more
than one type of token is accepted or a single token use
may be unlikely (MFA related rpcs)
Following allows for UI dashboard mfa and recovery code management:
- Adds new rpc AddMFADeviceSync (nonstream) so users can add device
- Adds new rpc GetAccountRecoveryCodes to retrieve nonsensitive data
about a users recovery codes e.g. created date to display in the users
dashboard
- Added privilege access to DeleteMFADeviceSync and
CreateAccountRecoveryCodes
One endpoint is now responsible for creating/returning
MFA register challenges:
- Deprecates RotateUserTokenSecrets
- Deprecates GetSignupU2FRegisterRequest
Add Webauthn support to a few outstanding endpoints and RPCs.
* Refactor and add Webauthn support to ChangePassword
* Add explicit JSON tag to AuthenticateUserRequest.Webauthn
* Add Webauthn support to /webapi/users/password/token
* Add Webauthn to /webapi/ping
* Add default Webauthn device name to ChangeUserAuthentication
* Tidy Ping tests
Isaiah Becker-Mayer