* Add support for removing shared directories to Windows Desktop Service (TDPB only)
* Advertise support for shared directory removal
* Gracefully handle unknown device errors when removing RDPDR devices, but log a warning as this is probably caused by a bug.
* Add `DelegationSessionService` protobuf definition
* Implement `GenerateCerts` RPC
* Prevent restricted delegation sessions from inheriting administrative privileges
Previously, the `resources` list on a delegation session would restrict regular
access to resources that weren't explicitly included, but not administrative
actions.
Now, we explicitly deny all administrative (rule-authorized) actions for
delegation sessions unless you include a wildcard in `resources`.
* Only permit list/read/readnosecrets for allow-listed resource kinds
* Fix reused extension OID
* Add a small amount of tolerance for clock skew
* Make the "expires must be in the future" message clearer
* Fix linter errors
* Access to a windows desktop implies access to the desktop service
* Add `DelegationSessionID` to the decision package's `SSHIdentity` and `TLSIdentity`
* Wrap `ExtractConditionForIdentifier` for delegation sessions too
* Prevent calling `GenerateCerts` inside a delegation session
* No need for indirection with GenerateUserCerts method now
* Fix import ordering
* Stop delegation service from returning CA certificates
Per @strideynet's request, to avoid replicating existing bad patterns around
conflating the user and host CAs.
* Error messages should start with lowercase letters
* Add `RouteToKubernetes` wrapping message
* Replace expires parameter with TTL
* Remove unnesasary error check
* Fix `AgentScope` extension type assertion
Adds two proto files that together define the session summary search
feature.
proto/accessgraph/v1/session_search.proto — internal, Auth->Access Graph
Used exclusively by the Auth server. Defines SessionRecordingService
with two RPCs:
- SearchSessionSummaries: a bidirectional streaming RPC the Auth
server uses to paginate through session summaries stored in the
Access Graph. The Auth server sends search_params on the first
message, receives batches of SessionSummary results each
terminated by a PageComplete, and sends FetchMore to advance pages.
Each SessionSummary includes session_end_event — the raw audit
event the Auth server evaluates against the requesting user's RBAC
permissions before deciding whether to forward the result to client.
- StoreSessionSummary: used by the summarizer pipeline to persist
session summaries and their vector embeddings to the Access Graph.
api/proto/teleport/sessionsearch/v1/session_search.proto — public, Client->Auth
Used by Teleport clients (tsh, web UI handler, etc.). Defines
SessionSearchService.SearchSessionSummaries as a unary-request /
server-streaming RPC. The Auth server implements this service: it
receives the client's filter criteria, fans out to the Access Graph
via the internal bidi stream above (handling all pagination
internally), filters each result using session_end_event, and streams
only the permitted SessionSummary results back. Clients see a single
continuous stream with no pagination mechanics exposed to them.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Introduces the RetrievalModel proto resource, which configures the
embeddings provider (OpenAI or Amazon Bedrock) and inference model used
for session search. Adds Create/Get/Update/Upsert/Delete RPCs to
SummarizerService.
Part of https://github.com/gravitational/teleport.e/pull/8046
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
`(AccessRequestV3) IsEqual` was added with a partially goderived
implementation to remove go-cmp comparisons outside test files.
This was not as straightforward as other resources due to
goderive not being able to handle interfaces. Due to the
oneof in AccessRequestsV3 goderive would silently fail
with a partially generated equality function for access requests.
The TeleportEqual derive plugin was updated to ignore the details
field. They are manually validated in `(AccessRequestV3) IsEqual`
if all other fields match.
`resourceAccessIDEqual` manually validates the constraints fields and
relies on goderived equality functions for each concrete type.
This change makes accesslists.GetInheritedGrants properly collect
inherited scoped role grants, in addition to the existing role and trait
grants.
Also exports grant conversion helpers to they can be called from e.
* Add `Beam` resource protobuf definition
* Add beams backend service
* Fix test and lint failures
* Delete all beam alias leases on `DeleteAllBeams`
* Apply PR feedback
* Restructure beam storage service
Following comments on the PR and a Slack conversation with Edorado, this commit
restructures the storage service interface to reflect how it'll actually be used.
For example, we now write the beam and its supporting resources in one atomic
operation, rather than lots of little fallible writes.
It also incorporates other feedback such as adding a field to track the
provision state of the actual beam VM.
* Use `types.GetExpiry` helper to avoid protobuf epoch issues
* Fix linting errors
* Store `DelegationSession` with beam resources
Also remove duplicate `itemFromWorkloadIdentity` definition
* Remove cross-service dependency
Following @espadolini's comment, the `BeamService` is no longer responsible for
writing the actual node, app, token, etc. records to the backend. Instead, those
services expose `AppendPut*Actions` and `AppendDelete*Actions` methods and it's
the caller's responsibility to call `Backend.AtomicWrite` with them.
* Move `Append*Actions` methods to "internal" service interfaces
* Fix test errors in tests
* Store users without secrets
* Rename user methods for clarity about what's included or not
* Fix accidental cache usage
* Fix broken reference from master
* Do not set an expiry on beam alias
In case the alias gets reassigned before the original beam is cleaned up
* Move the reexec parts of lib/srv to session/reexec
* Update references to the moved bits of lib/srv
* Avoid testutils in session/reexec
* Shuffle some constants around to avoid imports in session/reexec
* Vendor in the relevant parts of logutils in session/reexec
* Remove unnecessary symlink checks when opening files
* Inline the last two things from lib/utils in session/reexec
* Inline moved constants
* Deprecate group name consts and fix missed inlines
* Add missing session/reexec.TestMain with reexec check
* Reuse existing constants from the log constants package in session
* Fix broken godoc link
* Add visible labels for Azure and GCP VMs
Auto-discovered Azure and GCP VM nodes now emit user-visible labels
with the teleport.dev/ prefix alongside the existing hidden labels
that use the teleport.internal/ prefix. The new labels appear in the
UI and CLI and can be used in RBAC role definitions and for resource
filtering. Previously only hidden internal-prefix labels were set,
so users had no way to reference them in access policies.
The docs label reference tables are updated to show the new prefix
and an incorrect "Azure AKS" heading in the GCP Kubernetes clusters
section is corrected to "GCP GKE".
* Rename Azure VM label constants for clarity
The visible labels (teleport.dev/ prefix) now use the short canonical
names SubscriptionIDLabel, VMIDLabel, RegionLabel, and the internal
labels (teleport.internal/ prefix) are renamed with an Internal suffix
such as SubscriptionIDLabelInternal and VMIDLabelInternal. Previously
the short names pointed to the internal prefix and the visible variants
carried a "Visible" suffix, which inverted the expected importance
hierarchy. The node filter still matches on internal labels so nodes
that were enrolled before this rename remain discoverable.
* enforce region validation on all AWS config loading
Replace direct uses of `github.com/aws/aws-sdk-go-v2/config.LoadDefaultConfig`
with the internal `lib/cloud/aws/config.LoadDefaultConfig` wrapper, which
validates any explicitly requested AWS region before use. Enforces this via a
new forbidigo linter rule.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* fix unit tests
* include underscores and uppercase letters
* add ConfigureRegion
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Nic Klaassen <nic@nicklaassen.ca>
* Add the api/client.Client.SubCAClient() method
* Implement tctl resource support for cert_authority_override
* Remove `false` booleans
* Change "tctl create" message according to action
* Add support for all 3 forms of "tctl get"
* Define new access list UI related events
* Web: add access list related events
* Fix lint and review
* Address CR
* Address CR
- Added condition to check integrate is always defined for integrate event
- Added nil checks
* Teleport Connect now speaks TDPB.
* fix incorrect mousewheel encoding on web client
* Refactor tdpb protocol string to constant
* Populate FSO object in shared sirectory info response even when the file/directory does not exist
* Slightly cleaner TDP translation setup
* Refactor excessive function parameters to struct
* Fix unset 'Operation' on shared directory move response
* Fix backwards compatibility with v17 desktop service
* Guard against nil screenspec in ClientHello message
* Discovery Config Status: add sync and end time per resource type
* fix flaky test
* review pt1
* print sync timers in human readable format
* fix flaky test
The connector name becomes part of the backend key for storage,
and some of Teleport's backends have a maximum key length. As a
result, writing connectors with extremely long names fails, but
discloses the underlying backend error.
Restrict the length of a connector name (for OIDC, SAML, and GitHub)
prior to attempting the backend write.
It is unlikely that there are existing connectors in the wild with
names short enough to write to storage but long enough to exceed
our newly enforced maximum, but if such a connector exists it will
continue to function after this change - users will need to change
the name before they can apply additional changes.
rhammonds-teleport