* Use testServer.MakeTestServer to fix issue with parallel runs using the same ports.
* Add deprecation comments for test server helpers outside of tools/teleport/testenv.
* Update tool/teleport/testenv/test_server.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Disable SSH resumption
Enable LoadAllCAs
Update comments
* Prevent context.Canceled from being wrapped across transport stream
trail doesn't properly handle conversions to and from errors that
are context.Canceled which results in code paths trying to evaluate
errors.Is(err, context.Canceled) failing. The error recevied is
an interceptors.RemoteError, which wraps a trace.TraceErr, which
contains a status.Status with codes.Canceled. To work around this
until trail is updated the server half of the stream was updated
to return an io.EOF if if encouters a canceled error.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
* Make the MFA for admin actions interceptor re-prompt for MFA when a request fails due to a reusable MFA response being denied by the server.
* Allow reused MFA for get/list tokens.
* Update api/utils/grpc/interceptors/mfa.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add fake yubikey private key implementation for tests.
* Add TestHardwareKeyLogin.
* Simplify Hardware Key support test plan.
* Enable piv test package in tests.
* Add TestMarshalAndParsePrivateKey.
* Address simple comments.
* Remove *testing.T from mockSSOLogin in; Add and use better helper methods for mocking sso login.
* Refactor test to dynamically set mock attestation data; revert related changes.
* Implement granular db permissions for Postgres (RFD 151)
* docs, whitespace
* Make sure query is closed, even in case of errors along the way
* fix imports
* Add support for hardware key serial number attestation through user
trait.
* Modify AttestHardwareKey interface to return full attestation data
* Add serial number to attestation data and verify it
* Add unit test.
* Address comments.
* Don't accept partial matches.
* Fix build and test errors.
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Verify that intercepted stream Sends wrap io.EOF
* fix: Do not wrap io.EOF intercepted by stream Sends
* Use a helper func, fix duplicate Send/Recv calls
* Fix typo
* Refactor MFA ceremony logic to avoid creating challenges when the client has no way to solve it.
* Add client-side ErrMFANotSupported for better MFA ceremony error handling.
* fix: Do not attempt relogin on trace.BadParameterError
* Special case remote errors in IsErrorResolvableWithRelogin
* Do not wrap Recv EOF errors
* Fix various tests
* Use errors.Is to check for io.EOF
#36584 allowed routing to work for public addresses, however it
used GetPublicAddr to retrieve the public address. types.Server can
have multiple public addresses though which means routing was only
ever considering the first public address defined. This updates
the routing logic to use GetPublicAddrs so they are all considered.
* Support selecting db roles.
* add active roles in tsh db ls
* add select db role ut
* add a warning when connecting to older version
* review comments
* chnage slices import
* --db-roles to --db-role
* fix ut
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
* Make MFA prompt client agnostic for universal use, e.g. in Teleport Connect.
* Refactor to address CR.
* Resolve comments.
* Add tc.PromptMFA.
* Fix lint.
* Extract common high level interfaces and structs into api/mfa for better flexibility in API MFA prompts.
* Resolve comments.
* Remove unused field.
* Fix miss-set quiet field.
* Add web_session private key policy.
* Add attestation logic for web session.
* Prevent users from retrieving their own web session secrets.
* Update RFD.
* Attest extended web sessions if the original web session was attested.
* Update rfd/0080-hardware-key-support.md
Co-authored-by: Mike Jensen <jentfoo@users.noreply.github.com>
* Fix policy set unit test.
---------
Co-authored-by: Mike Jensen <jentfoo@users.noreply.github.com>
* Update RFD with hardware key pin policies.
* Consolidate policy logic and update tests.
* Add pin private key policies; Make PIV PIN/Touch prompts work together.
* Prompt user to set pin/puk from default.
* Handle unexpected PIN auth errors.
* Resolve RFD password prompt comment.
* Handle incompatible private key policy in role sets (future-proof).
* Resolve comment on require mfa type string godocs and tests.
* A satisfying change.
* Address PIN/PUK prompt comments and other code suggestions.
* Resolve comments.
* Fix test that prompts for pin twice.
* Fix test.
* Add the Access List review backend.
The Access List review backend has been added to Teleport.
* Update tests to remove frequency_changed.
* Update lib/services/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update lib/services/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Tweak errors, add gRPC client to go along with new interfaces.
* Update comments, fix errant bugs with api client, remove reviews getter.
* Fix comments in proto, tweaks to tests and backend.
* Remove call to SetName.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Make yubikey unit test interactive and add to test plan.
* Move yubikey hardware signer method tests to interactive yubikey test.
* Remove hardware key interactive unit test from testplan
This change drains unused SSH channels and requests to prevent a
situation where an attacker could repeatedly open channels and
send data that won't be read, causing Teleport to eventually run
out of memory.
* Change PIV metadata cert to be self signed by an ephemeral key so it can be signed without touch/pin.
* Refactor touch prompt logic.
* Prompt user before overwriting non-teleport certificates instead of just returning an error.
* Update RFD and Docs.
* Address CR.
* Export some methods and variables for use in tests.
* Address comments.
* Test registration with unusable devices
* Count devices according to cluster settings
* Use AddMFADeviceSync in test helpers
* Use AddMFADeviceSync on lib/auth tests
* Remove AddMFADeviceRequestInit from mfaAddTestOpts
* nit: Pass testing.T to lib/web.TestTerminalRequireSessionMFA funcs
* Ignore AddMFADevice usage in interceptor tests
* Deprecate AddMFADevice and its top-level messages
* Update generated protos
* Deprecate lib/client RPC wrapper
* Deprecate AddMFADevice in lib/auth.IdentityService
* Address deprecation warnings
* Move gRPC error intercetpors to api/utils/grpc/interceptors.
* Use error interceptors in api client and mock server.
* Apply suggestions from CR.
* Unwrap FromGRPC errors in middleware.
* Use gRPC auth service in tests instead of external example service.
* It's gRPC!!!
* Fix unit test.
* Add error interceptor to proxy client.
* Fix merge conflict.
