* DiscoveryService: exclusive worker per Discovery Group
This PR ensures only one DiscoveryService is running per DiscoveryGroup.
It does so using a SemaphoreLock.
This should prevent any duplicate API calls and also prevent duplicate
resources on Teleport side.
* improve eice server name and releaseGroupLockFn init
* review pt2
* improve error handling
* re-organize lock acquire
* improve eice node name handling
* simplify lock on discovery group
* Remove lock logic and rely on node name to prevent dups
* improve test comment
* change comment about skipping nodes
* DiscoveryConfig: Update status after each run
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add unit tests
* drop method by reducing interface area
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Keep track of whether the user has a real password set
* lint
* Some comments
* Fix TestCreateResources
* Fix e/ link
* Review
* Review
* Review
* Use early return on error in DeletePassword
* Fix the broken teleterm test
This PR generates the stubs for `DiscoveryConfig.Equal` function based
on goderive code generation.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Add automatic role requests
This change adds the optioin to automatically make a role access request
during tsh ssh instead of a resource access request.
* Speed up TestSSHAccessRequest
* Introduce role friendly name labels and frontend utilities.
Role friendly name labels and frontend utilities have been introduced.
* Remove unneeded sort function.
* Add the HasDeviceExtensions field to WebSessionSpecV2
* Update generated protos
* Add GetHasDeviceExtensions to the WebSession interface
* Write HasDeviceExtensions on augmented sessions
* Make NewWebSessions private
* Keep device extensions in renewed sessions
* Add a DeviceWebToken TODO to ChangeUserAuthentication
* Explicitly state we don't revalidate the certs on renewal
* Introduce plugins cleanup command line function.
tctl can now explicitly issue a plugins cleanup command, which will allow
admins to remove any extra artifacts that a plugin may have left behind
after being deleted.
* Add in a dry run command, list resources.
* GCI.
* Code cleanup, use ResourceID instead of string.
* Only allow okta cleanup, default to dry-run on.
* reserve 40, 41 tag numbers for RoleConditions
* remove GetSAMLIdPServiceProviderLabels and SetSAMLIdPServiceProviderLabels
* remove SAMLIdPServiceProviderLabels from label matchers and rolev6 test
* run make -C integrations/operator manifests
- UserSync Events have fields whose values are routinely 0, which the
JSON marshaler was omitting. This patch removes the `omitempty`
directive so these values are preserved in the serialized event.
- Typo in the UserSync event failure code
Derived equals have been added for other types within Teleport with two
notable exceptions:
- AccessLists, as there is a bug with goderive when determining equivalence
for the ResourceHeader.
- Users, as goderive's equal plugin does not support interface{} types, which
is used in the underlying UserV2 type generated by protoc.
* AutoDiscover: add support for EICE nodes
* ignore openssh nodes when updating labels from serverinfo
* downcase imports
* improve comment on why we need account/instance and subkind
* add applyovertime method
* skip nodes that wont expire in the near future
* create helper functions
* Add a generation field to plugins.
A new field has been added to the plugin object that will help uniquely
identify the plugin and its current revision, which will be used to properly
namespace Okta sourced access lists and resources.
* Undo the reformatting of types.proto.
This PR adds the `patch_type` to `KubernetesWaitingContainer` objects.
This patch type is used to decode the contents correctly depending on
different patch strategies allowed by Kubernetes clients.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Add Integration field to App resource
This PR adds the Integration field to the App resource.
This is preparation for allowing AWS App Access using the AWS OIDC
Integration credentials.
We need to store the Integration name that should be used for this
particular App.
* integration field contains the integration name
* Add events for auto user provisioning
* Prettier
* Fix typo in event formatting
* Apply suggestions from code review
Co-authored-by: Lisa Kim <lisa@goteleport.com>
* Use shared base type for db session events
---------
Co-authored-by: Lisa Kim <lisa@goteleport.com>
* add kubernetes waiting container backend service and API
* remove other resource type
* add unit test
* fix after rebasing
* address feedback
* remove KubeWaitingContainerRequest
* check for nil in validation func
* remove UnwrapResource153
* fix test
* address feedback
* address linter issues
* fix cache watch kind test
* Get and Set Preset funcs
* configure entity descriptor based on preset value
* address review comment:
- remove unused SetPreset()
- wrap error while returning configureEntityDescriptorPerPreset
- add error log
* fix typo: use semicolon in place of '.'
* use '%w' instead of '%v' for ErrorF error formatting
* Implement label templates for db objects
- Expose template parsing utilities.
- Interpolate label templates using `typical` library.
- Validate label templates as part of import rule validation.
- Refactor code to fix cyclic imports.
* Use database_service_name and object_kind for label key in preset
* revert changes to `lib/utils/parse/parse.go`
* Reimplement splitExpression locally for import rules
* Update RFD with recent changes and mark it as implemented
* rename files, add test coverage, use empty spec for validation
* Log template errors directly with debug logs, log total error count as info.
* Update logs
* AWS OIDC: Accept custom issuers
This PR adds a new field into the AWS OIDC fields:
- issuer
This is the issuer that was configured in AWS.
It is used by teleport to set the `issuer/iss` field when generating the
JWT.
This way we'll be able to set a custom issuer.
As an example, we could set this to be a public S3 bucket which doesn't
suffer from the thumbprint validation issuer.
* ensure issuer is a valid https url
* use s3 uri instead of any url for issuer
* typo and require s3 fields
* add missing s3 location when creating integration
* improve error messages
* relay state proto def
* set default relay state for supported preset
* update DefaultRelayStateGCPWorkforce val
* test case: no default relay state if 'preset' and 'relay_state' field is empty
* Changes supporting SCIM groups in Enterprise
- Adds `services.IsEqual` implementatio to AccessListMember for
easier reconciliation
- Adds `Delete` support into internal SCIM interfaces
Changelog: None
* linter appeasement
* Add cluster config update events
Introduces new audit event types to capture update to cluster
authentication preferences, networking config, and session recording
config.
* Emit cluster config update events
Ensures that audit events are emitted from the new cluster config
RPC service and from the legacy auth service.
* UI updates for new audit events
* Removes the entire notion of a DynamicAccessList from Teleport
Insurmountable security issues were found with the notion of dynamic
AccessList ownership and membership, so the entire concept is being
removed.
This PR removes all internal usage of the Dynamic access list
concept. The corresponding protobuf updates are coming in a later
PR.
Changelog: Removed Dynamic AccessList
* Fix API tests
* More API test fixes
* Fix integrations tests
* Remove incorrect client validation
* Use consistent date time display
* Create start time validation helper
* Add validation checks
The following allows modifying the start time and is where
validation is placed:
- CreateAccessRequestV2
- SubmitAccessReview
- SetAccessRequestState (used with tctl)
* Address Crs
Updates ListResources and ListUnifiedResources to optionally allow
responses to include the allowed logins per returned resource that
requesting user has access to given there roles. Logins are only
currently populated for SSH and WindowsDesktop resources. The new
types.EnrichedResource was added to facilitate transporting the
underlying resource and the additional user specific information to consumers.
Alan Parra