* SPIFFE X.509 issuer override: CRUD
* tctl support for workload_identity_x509_issuer_override
* Define audit log events
* Emit audit log events
* Add comments to point at the e implementation
* audit events fixtures
* Use DisallowUnknown in tctl
* Support automatic_approval in AMR spec
* Support filter by automatic_approval_name
* Update AMR validation
* Update terraform schema
* Fix import
* Add additional test case
* Improve amr spec godocs
* make -C integrations/terraform docs
* wiring the API client through
* tctl stable-unix-users ls
* stable UID fallback for Teleport SSHD
* stable_unix_user.create event
* fix-license
* Require and test audit log message
* Add stable_unix_user_config to fileconf
* Avoid saying "fallback UID" in logs
* Avoid saying "fallback UID" in error messages
* Avoid racing writes in the mock emitter
* pnpm lint-fix
* fix lib/auth tests that broken during rebase
* Protobuf and configuration for Access Graph Azure Discovery
* Fixing rebase after protobuf gen
* Updating to use existing msgraph client
* PR feedback
* Using variadic options
* Removing memberOf expansion
* Expanding memberships by calling memberOf on each user
* PR feedback
* Rebase go.sum stuff
* Go mod tidy
* Fixing go.mod
* Update lib/msgraph/paginated.go
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* PR feedback
* Protobuf and configuration for Access Graph Azure Discovery
* Adding Azure sync functionality which can be called by the Azure fetcher
* Protobuf update
* Linting
* PR feedback
* PR feedback
* Updating to use existing msgraph client
* PR feedback
* Using variadic options
* Removing memberOf expansion
* Expanding memberships by calling memberOf on each user
* PR feedback
* Rebase go.sum stuff
* PR feedback
* Protobuf and configuration for Access Graph Azure Discovery
* Protobuf gen fix
* Rebase fixes
* More cleanup
* e ref update
* Invoking token generation and returning the response
* Quick test with a message to make sure RPC is invoked
* Skeleton of new Azure OIDC RPC call
* Fetching the Azure OIDC token during fetcher creation and establishing a credential assertion approach
* PR feedback; restricting token requests to auth, discovery, and proxy roles.
* Lint
* Fixing mocks
* Fix imports
* Fix test
* Rebase fxes
* Adding back OIDC fetching, accidentally removed it during rebase
* e ref
* Lint
* Fix imports
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* GitHub proxy part 6: proxing Git using SSH transport
* better command parsing and update suite
* refactor
* revert unnecearrty files
* address review comments
* ut fix
* revert localsite_test.go
* change special suffix to teleport-github-org for routing
* fix routing ut
* minor typo edit
* fix ut after sshca change
* add UT to sshutils
* minor review comments
* fix api ut because of special suffix change
* GitServerReadOnlyClient
* downgrade error to warning
* run go mod tidy. not sure why it's needed
* rename mock.go to mock_test.go
* Vendor gravitational/trace/trail in api
Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.
There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.
* fix: appease linters
* Add UpsertTrustedClusterV2 rpc
This supersedes UpsertTrustedCluster rpc. V2 performs resource name
validation.
* Replace confusing UpsertValidationTrustedCluster name
* Use UpsertTrustedClusterV2 in tests
* Address feedback
- Remove unnecessary ping
- Update error messages
- Use skipNameValidation consts
- Validate cluster name before establishing trust
- Do not reveal cluster name in error message
- Use BadParameter instead of CompareFailed
* Use webclient.Find
* Fix test/lint
* Allow label updates
* Fix test
* Fix error handling
* Implement CreateTrustedClusterV2 and UpdateTrustedClusterV2
* Address feedback
* Minor fixes
* Move V2 RPCs to the trust service
* Update comment
* Drop V2 suffix
* Require matching revision
* Fix upsert/update revision
* Drop V2 from Create and Update APIs
* Lint: Fix typo
* First pass at trying to generate terraform provider
* Wire up types
* Fix generation of docs
* Add godoc comments
* Add tests
* Tflint and add example
Host resolution performed because labels, fuzzy search, or predicate
expressions were supplied to commands that establish connections to
a single host has historically been performed client side in tsh.
While that works in most cases, it can prevent correctly
resolving hosts in some situations, i.e. when there are ambiguous
hosts and tsh is unaware that the cluster routing strategy is set
to ROUTE_TO_MOST_RECENT.
To improve the experience, a new ResolveSSHTarget was added to
Auth to allow host resolution to be performed server side. The
resolution works in a similar manner to, and was inspired by
GetSSHTargets. In the event that the new RPC is not implemented,
because the client is newer than Auth, tsh has also been updated
to pull the cluster networking config and address any host
ambiguity if allowed.
As a result tsh scp and tsh proxy ssh should be much more
tolerant to, and still permit access in situations where
ambiguous hosts are present for some amount of time. Prior to
this the only way to connect in these situations was to find
the UUID of the correct target instance and try again after
seeing an ambiguous host error.
* Add the decisionv1.Service boilerplate
* Wire decisionv1.Service to auth.GRPCServer
* Wire decisionpb.DecisionServiceClient to client.Client
* Add basic service testing
Adds Identity Center Account Assignments to the Unified resource cache
so they can be requested in access requests.
Unfortunately we can't just include an `identitycenterv1.AccountAssignment`
directly in the resource cache ListResources output because the legacy
protobuf codegen used for the authservice and the new codegen used for
identitycenter/v1 produce incompatible serialization code, so resulting
generated code does not compile.
To get around this issue, this change introduces a parallel (and slightly
simplified) definition of an IdentityCenterAccountAssignment in the authservice
protobuf spec to act as the wire format for this type. The cached
`identitycenterv1.AccountAssignment` resources are copied into a
`proto.IdentityCenterAccountAssignment` on a cache read.
Includes:
- adding resources to cache
- adding account assignment paginated resource
- account assignment role condition matching for RBAC
* Exposes Identity Center accounts as Apps in Unified Resource Cache
For the purposes of the UI, Identity Center accounts and account
assignments are treated like special Apps. This patch exposes
Account Assignments to the UI via the Unified Resource Cache.
Includes:
- Generating an App resource from an Identity Center Account resource
- General plumbing from backend through to cache and UI
* lint
* Add TargetPort to RouteToApp and AppMetadata proto messages
* Pass TargetPort during cert generation
* Refactor Pack.makeTLSConfig to accept struct
This will make it easier to add targetPort to it.
* Add labels to UUIDs used by appaccess test pack app servers
This makes them easier to distinguish when routing doesn't work as expected.
* Refactor Pack.CreateAppSession to accept a struct
* TestTCP: Create app session within test
If we kept the old code, we'd need to manually create a session for each
target port, which would create a lot of duplication.
* Prepare integration test fixtures for multi-port tests
* Add api/utils/net.IsPortInRange
* Use TargetPort when routing TCP connections
* Inline dialMultiPortTCPApp, centralize logic
* Check target port when connecting to single-port app
* Reorder check in IsPortInRange
* Use int instead of uint16
* Extract picking dialTarget to separate function
* addr → uriAddr
* Improve err msg for single-port apps when targetPort != uriPort
* Fix unnecessary conversion to int
* Add monitoring of the servers time drifting
* Refactor monitor to use inventory stream
* Add command for inventory control stream for time reconciliation
* Reuse ping/pong logic for time reconciliation
* Add integration test to check if global notification is created
* Limits notification length, renaming
* Return system clock instead of time difference
Add parallel requests to ping the nodes
Fix issue with locking inventory store while making ping request
* Refactor to make time reconciliation part of the inventory control stream
* Fix tests
* Rewrite tests
Return inventory store iterator
* Naming adjustments
* Fix test
* Drop timeReconciliation in order to use direct handler functions
* Make time reconciliation with variable duration
* Replace with duration type in proto
Add test cleanup for possible goroutine leak
Add comment about half request duration
* Format notification message
* Add UpstreamInventoryPong.SystemClock check
* git_server resource and role.allow.github_permissions
* implicit RO on KindGitServer
* review comments
* fix ut
* make -C integrations/operator crd
* fix ut again
* make crds-up-to-date and make -C integrations/terraform docs
* Revert "Add unstable envvar to disable server keepalives (#43342)"
This reverts commit 1e2d7724e7.
* Allow changing a VariableDuration by more than one
* Get rid of control log pings
* Dedicated lightweight jittered ticker for the inventory
* Split off per-protocol tickers
* Tests for jittered ticker
* Use a start barrier in TestVariableDurationIncDec
* Explain value to be passed to Advance
* Add explanations in jitteredticker tests
* Rename jitteredticker to delay
Edoardo Spadolini