* DiscoveryConfig: Update status after each run
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add unit tests
* drop method by reducing interface area
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
The conversion from a proto.PaginatedResource to a types.EnrichedResource
inadvertently omitted setting logins for windows desktops. A new
test, TestGetUnifiedResourcesWithLogins, was added to validate that
if logins are provided by the server that they are passed along in
the enriched resource.
Closes#40340
Updates the proxy.Client to allow loading specific tls.Config for
individual clusters. This prevents issues when trying to access
leaf resources via the root cluster if WithAllCAs is not set.
* Implement persistence for database_object resource
* Split monolithic service test
* Add `t.Parallel()` to the tests
* lint fix
* Update copyright year
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* `make grpc`
---------
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* Add conditional update methods for `AccessList` and `AccessListMembers`
This PR adds two new methods for conditinally update an AccessList and
AccessListMember resources to avoid overriding changed resources.
This is a preparation for a ineligible status reconciler.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Update lib/services/simple/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* handle review comments and drop copy methods
* simplify code
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add protos for PresenceService and RemoteCluster CRUD
* Add service skeleton for presence service
* Add bodies for all methods
* Hook up to new backend methods
* Add presence service to auth grpc server
* Add fallback functions to call old http endpoints
* Fix tests for DeleteAllRemoteClusters
* Remove bad rebase file
* Update proto to remove Create
* Remove unused create grpc handler
* Add Patch support to Update gRPC
* Fix method missing from interface
* Add test for GetRemoteCluster
* Add test for ListRemoteClusters
* Add test for DeleteRemoteCluster
* Add tests for TestUpdateRemoteCluster
* Appease linter
* Fix GetRemoteCluster test
* Update lib/auth/httpfallback.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Update api/client/client.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Update lib/auth/httpfallback.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Fix reference to trace.Component
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
The Proxy web api now requests that Auth include allowed logins
per resource instead of guessing logins per resource based on the
information it has cached. However, due to the way SSH sessions
are authorized, the logins are not provide to users verbatim.
Any sessions created via the root web ui to a leaf resource will use
the SSH certificate created for that user in the root cluster. New
certificates are not minted per leaf cluster. This is important
because the nodes only allow os logins for a session if they are
present in the valid prinicpals of the SSH certificate. So even
though we are now capabale of displaying all allowed logins for
leaf SSH servers in the root web ui, the user is only able to use
a subset of them. To avoid any odd UX, the Proxy will filter out
any allowed logins which do not exist in the principals of the
root SSH certificate.
The above only holds for SSH, windows desktops are not as strict
and any allowed login from a leaf cluster is now visible in the
root web ui.
Fixes https://github.com/gravitational/teleport/issues/5041
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* add kubernetes waiting container backend service and API
* remove other resource type
* add unit test
* fix after rebasing
* address feedback
* remove KubeWaitingContainerRequest
* check for nil in validation func
* remove UnwrapResource153
* fix test
* address feedback
* address linter issues
* fix cache watch kind test
This PR adds the protobuf boilerplate code required to expose the
Access Graph config to all agents that require access to it.
The goal is to reduce the ammount of configuration changes required to
expose the Access Graph service connection parameters to all agents that
require it.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* AWS OIDC: Accept custom issuers
This PR adds a new field into the AWS OIDC fields:
- issuer
This is the issuer that was configured in AWS.
It is used by teleport to set the `issuer/iss` field when generating the
JWT.
This way we'll be able to set a custom issuer.
As an example, we could set this to be a public S3 bucket which doesn't
suffer from the thumbprint validation issuer.
* ensure issuer is a valid https url
* use s3 uri instead of any url for issuer
* typo and require s3 fields
* add missing s3 location when creating integration
* improve error messages
* Changes supporting SCIM groups in Enterprise
- Adds `services.IsEqual` implementatio to AccessListMember for
easier reconciliation
- Adds `Delete` support into internal SCIM interfaces
Changelog: None
* linter appeasement
Updates ListResources and ListUnifiedResources to optionally allow
responses to include the allowed logins per returned resource that
requesting user has access to given there roles. Logins are only
currently populated for SSH and WindowsDesktop resources. The new
types.EnrichedResource was added to facilitate transporting the
underlying resource and the additional user specific information to consumers.
* remove and deprecate usage of KindAppOrSAMLIdPServiceProvider unified resource view
* use SAMLIdPServiceProvider type instead of AppOrSAMLIdPServiceProvider
* update unit tests replacing AppOrSAMLIdPServiceProvider
* update teleterm unifiedresource List func to discard AppServerOrSAMLIdPServiceProvider in favor of SAMLIdPServiceProvider
* make paginated ListSAMLIdPServiceProviders in auth_with_roles and various comment updates
* add nolint to apps.go and update teleterm unifiedresources test
* remove commented code, comment copy edit, reduce switch scope
* put AppOrSAMLIdPServiceProvider handling back, push Delete schedule to v17
* add nolint, saml resource list test
* put noint getResourceFromProtoPage elseif block
* comment copy update, uncomment saml type in teleterm
* Update google.golang.org/protobuf to v1.33.0
This updates all instances of google.golang.org/protobuf to address CVE-2024-24786.
* Make grpc after update
Updates the auth gRPC server to include the new clusterconfigv1
service. The api client was also updated to allow interacting
with the new service(cluster audit config not included yet). Nothing
has yet been converted to use the new service, that will come in a
follow up.
The RPC service proto was also updated to fix a typo that was
reverted in https://github.com/gravitational/teleport/pull/38736.
Takes inspiration from https://github.com/gravitational/teleport.e/pull/1944
which addressed similar EOF error showing up when driving streams
in tests.
From https://pkg.go.dev/google.golang.org/grpc#ClientStream.SendMsg:
> // SendMsg is generally called by generated code. On error, SendMsg aborts
> // the stream. If the error was generated by the client, the status is
> // returned directly; otherwise, io.EOF is returned and the status of
> // the stream may be discovered using RecvMsg.
The access list interface now supports counting members without unmarshaling.
This method has been added to the generic backend service as well. This will
allow for quicker counts when necessary. This method has been added to the
cache.
Additionally, a status field as per RFD-153 has been added to access lists
that will house the new optional member count field.
* Add Workload Identity Service
* Fix up for recent changes this was rebased onto
* Usse atomic rather than mutex
* interface{} -> any
* Avoid concurrent read/write of experiment
* Prefer cleanup to defer
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Update lib/auth/clt.go
Co-authored-by: Tim Buckley <tim@goteleport.com>
* Fix imports
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
Co-authored-by: Tim Buckley <tim@goteleport.com>
* Implement persistence for db_object_import_rule resource
* Apply suggestions from code review
Co-authored-by: Bartosz Leper <bartosz.leper@goteleport.com>
* Use plural interface name: DatabaseObjectImportRules. Fix typos. Refactor test.
* token => pageToken
* Simplify resource command
* Fix permission checks
* add details
* refactor, rebase fixes
* better name
* Fix several issues.
- Change type of `db_labels` proto field to the new shared `label` message.
- Implement missing method.
- Cause compilation errors in case of unipmlemented methods.
- Add test coverage for `tctl` commands.
- Change output of Marshal/Unmarshal methods.
* Fix test
* Fix nondeterminism in test
* Add mising docs
* Resolve protobuf breaking changes
* Shorten component name for logging
* Add access test
* Fix test
* Update error message and tests
* Remove temp test `TestCreateUser`
---------
Co-authored-by: Bartosz Leper <bartosz.leper@goteleport.com>
* TLS routing connection upgrade using native websocket
* update ut in api
* lib/web/UT update
* fix typo, lint and race
* deal with subprotocol negotiation
* review comments round 1
* fix lint?
* add UT and address some other comments
* add env var to toggle mode
* fix lint
* Add hardware key settings to cluster auth preference.
* Parse HardwareKey auth settings from configuration file.
* Add GetRequireKnownSerialNumber method to AuthPrefence type.
* Add deprecation logic for authpref.PIVSlot, following the logic set out
in #16034.
* Address comments.
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
This PR fixes the name of the gRPC method
`StreamUnstructuredSessionEvents` from
`StreamUnstructuredSessionEventsServer` to the correct version. This
typo was introduced during the original review and was never detected
because clients implemented a fallback mechanism to old
`StreamSessionEvents` api.
This PR also partially reverts commit
386e63c584 so v15 clients can still
connect to v14 clusters.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
