* SPIFFE X.509 issuer override: CRUD
* tctl support for workload_identity_x509_issuer_override
* Define audit log events
* Emit audit log events
* Add comments to point at the e implementation
* audit events fixtures
* Use DisallowUnknown in tctl
* Support additional claims in JWT-SVIDs
* Exclude the `extra_claims` field in Terraform
* Add a maximum nesting depth
* Add comment to clarify behavior of `PrivateClaims`
* Combine declaration with nil check
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Update protobuf
* Implement and test ValidateTokenWithJWKS
* Update join logic to use new method for static jwks
* Update Terraform Provider
* Update operator docs/files
* Update goldenfile
* Capture the binary path and SHA256 checksum in the Unix workload attestor
* Increase binary size limit to 1GiB
* Make maximum binary size configurable
* Remove error-prone mount namespace check
* Document that `binary_hash` is hex-encoded
* Handle wrapped errors properly
The changes here were a result of examining CPU and memory profiles
of BenchmarkListUnifiedResources. The biggest inefficiencies stemmed
from the authorizer and `(types.Server) MatchSearch`.
When the authorizer computes lock targets it will call `(types.LockTarget) Equals`,
which was relying on proto.Equals to determine if nine strings were
equivalent. The fields are now individually checked and a test
was added to ensure that if any new fields are added they must
be added to the check for the test to pass.
ListUnifiedResources attempts to be smart and evaluate whether the
user has read/list access to a particular resource kind once. However,
it was always checking if users had access to _all_ supported resources
instead of just the resources that the user was requesting. While most
of the checks are not very expensive, checking all resources is still
worse than only checking the required resources.
Lastly, the `(types.Server) MatchSearch` implementation is no longer
allocating a slice of search fields and using `types.MatchSearch`.
Instead a variant of the loop from `types.MatchSearch` is inlined.
While this was only applied to `types.Server` it should likely
be extended to other resource types in the future - or `types.MatchSearch`
should be refactored in a way that does not require callers to allocate.
```bash
$ benchstat old.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
cpu: Apple M2 Pro
│ old.txt │ new.txt │
│ sec/op │ sec/op vs base │
ListUnifiedResourcesFilter/labels-12 195.0m ± 6% 173.3m ± 2% -11.12% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 230.6m ± 3% 210.8m ± 4% -8.57% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 229.8m ± 5% 209.0m ± 7% -9.08% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 600.6m ± 3% 364.3m ± 1% -39.35% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 687.0m ± 2% 423.4m ± 1% -38.37% (p=0.000 n=10)
geomean 335.7m 259.5m -22.69%
│ old.txt │ new.txt │
│ B/op │ B/op vs base │
ListUnifiedResourcesFilter/labels-12 868.8Ki ± 0% 414.1Ki ± 0% -52.34% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 7.731Mi ± 0% 7.287Mi ± 0% -5.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 7.731Mi ± 0% 7.288Mi ± 0% -5.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 22106.9Ki ± 0% 486.8Ki ± 0% -97.80% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 22107.0Ki ± 0% 486.3Ki ± 0% -97.80% (p=0.000 n=10)
geomean 7.494Mi 1.371Mi -81.70%
│ old.txt │ new.txt │
│ allocs/op │ allocs/op vs base │
ListUnifiedResourcesFilter/labels-12 11.401k ± 0% 4.865k ± 0% -57.32% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 161.5k ± 0% 155.0k ± 0% -4.04% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 161.5k ± 0% 155.0k ± 0% -4.04% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 162.212k ± 0% 5.277k ± 0% -96.75% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 162.224k ± 0% 5.275k ± 0% -96.75% (p=0.000 n=10)
geomean 95.22k 20.07k -78.93%
```
This adds a new field, UseAnyProxyPublicAddr, that will be used to
tell the web api/ui to rebuild the request app's FQDN based on the proxy
public addr that the request came from (upcoming PR to consume this)
* Hack on including attrs in svid issuance
* Add attrs to JWT SVID issuance
* Fix comparison in tests
* Improve comment on attributes field of event proto
* fix: make sure Fields map is not nil
* move new test to existing file, allocate map for struct up front
* make linter happy
---------
Co-authored-by: Erik Jankovic <erik.jankovic@gmail.com>
* Adds AWS Role ARN to IC Integration settings
The Identity Center integration needs to be able to assume an AWS role
when using the ambient system credentials. This patch updates the IC
integration protobuf definition to include the role ARN, by refactoring
the settings block to replace the CredentialSource enumeration with a
`Credentials` type containing a `oneof` union of System and OIDC credential blocks.
The CredentalSource value is preserved for backwards compatibility with previous
Teleport releases.
This patch includes
- the updated protobuf message and generated types
- update tests, etc
- updated `tctl` to handle new plugin settings structure
Chagnges required to actually use this information are coming in a later PR.
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Rename role ARN
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Add Systemd workload attestor
* More realistic timeout for interacting with the dbus API
* Add missing godoc comments
* Move require into same block
* Add missing godoc comments
* Rename `dialer` for clarity
* Log so the user knows something is happening
* Fix missing logger and lint warning
* Adds IC plugin status value to trigger IC group import
The IC plugin automatically imports IC groups into Teleport on its
first run, and uses the plugin status block to mark the import as complete,
and is not required the next time the plugin starts up.
New functionality in `tctl` allows Teleport admins to edit the IC plugin
resource in order to modify group, account and permission set filters.
At the moment, the group filters are only applied during tis initial import,
so changing them has no effect.
In order to allow changes to group import filters to have an effect, this this
patch adds a new value to the `AWSICGroupImportStatusCode` enueration that
indicates that the import process should be re-run the next time the plugin
restarts.
* Break out import status code validation
* Remove import status enum validation
Some fetchers might generate a lot of errors which are aggregated and
sent to the `DiscoveryConfig.Status.ErrorMessage`.
This might cause gRPC clients to fail when listing DiscoveryConfigs with
a `grpc: received message larger than max (xyz vs. 4194304)` error.
Allowing 100KB for the error message should give the user enough context
on what's causing the errors.
We added this function to mitigate slow user.Current() calls in
Windows Active Directory environments. Go 1.24 ships with an optimized
verison of user.Current, rendering this utility unnecessary.
Closes#41922
* Adds edit support for IC plugin to `tctl edit`
This patch expands the plugin resource unmarshaler in `tctl` to handle the
heterogenous filters used by the Identity Center plugin settings. It also adds
support for the IC status block.
These changes allow a user to edit the plugin resource via `tctl edit` after
installation.
* Why not use protojson? Well...
* Update collection.go
* Add json.(un)MarshalJSON implementations father than structure unpacking
* Dead code removal
* Apply suggestions from code review
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Apply review feedback
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Support automatic_approval in AMR spec
* Support filter by automatic_approval_name
* Update AMR validation
* Update terraform schema
* Fix import
* Add additional test case
* Improve amr spec godocs
* make -C integrations/terraform docs
* Add new `expression` package in workload identity service
* Add traits to the `Attrs` proto message
* Add support for user traits to the `expression` package
* Use `expression` package to template Workload Identities
* Add support for expressions to Workload Identity rules
* Update terraform docs
* Error instead of returning zero value for unset fields
* Fix linting failures
* Codify edge cases
* record access_list review event
* record access list member role grant event
* directly use AccessListReviewCreateEvent event
* update commentry
* update commentry"
gi"
* remove unused AccessListReviewEvent proto def
* fix usagereporter_test
* update test event ingester
* update role grant event commentry
* emit user_origin for local login event
* ignore unspecified origin while allowing overriding with a defined origin value
* abstract origin getter
* test: emit unspecified origin value to test the initial value is preserved
* Extract container ID resolution so it can be reused for Podman and Docker
* Support Podman mountfile parsing
* Add client for Podman's REST API
* Podman workload attestor
* Fix lint failures
* Don't recommend putting the Podman socket file in `/tmp`
* Replace `container.Engine` interface with parser function
* Wrap Podman HTTP client with otel for traces
* Set default timeout on Podman API client
* Improve wrapped error messages
* Add explicit JSON tags
* Fix copy-pasted error message
* Move regexes to top of file for discoverability
* feat: identity center resource sync event
* Web UI event formatter
* let the emitter send user message to be used in the ui
* review: plural total count names
* review: make distinctive failure event
* review suggestion:
- spell out completed and failed event description
- write resource import counts
- use code for error
* spell fix
Dan Upton