* Implement granular db permissions for Postgres (RFD 151)
* docs, whitespace
* Make sure query is closed, even in case of errors along the way
* fix imports
* Add support for hardware key serial number attestation through user
trait.
* Modify AttestHardwareKey interface to return full attestation data
* Add serial number to attestation data and verify it
* Add unit test.
* Address comments.
* Don't accept partial matches.
* Fix build and test errors.
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Verify that intercepted stream Sends wrap io.EOF
* fix: Do not wrap io.EOF intercepted by stream Sends
* Use a helper func, fix duplicate Send/Recv calls
* Fix typo
* Refactor MFA ceremony logic to avoid creating challenges when the client has no way to solve it.
* Add client-side ErrMFANotSupported for better MFA ceremony error handling.
* fix: Do not attempt relogin on trace.BadParameterError
* Special case remote errors in IsErrorResolvableWithRelogin
* Do not wrap Recv EOF errors
* Fix various tests
* Use errors.Is to check for io.EOF
#36584 allowed routing to work for public addresses, however it
used GetPublicAddr to retrieve the public address. types.Server can
have multiple public addresses though which means routing was only
ever considering the first public address defined. This updates
the routing logic to use GetPublicAddrs so they are all considered.
* Support selecting db roles.
* add active roles in tsh db ls
* add select db role ut
* add a warning when connecting to older version
* review comments
* chnage slices import
* --db-roles to --db-role
* fix ut
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
* Make MFA prompt client agnostic for universal use, e.g. in Teleport Connect.
* Refactor to address CR.
* Resolve comments.
* Add tc.PromptMFA.
* Fix lint.
* Extract common high level interfaces and structs into api/mfa for better flexibility in API MFA prompts.
* Resolve comments.
* Remove unused field.
* Fix miss-set quiet field.
* Add web_session private key policy.
* Add attestation logic for web session.
* Prevent users from retrieving their own web session secrets.
* Update RFD.
* Attest extended web sessions if the original web session was attested.
* Update rfd/0080-hardware-key-support.md
Co-authored-by: Mike Jensen <jentfoo@users.noreply.github.com>
* Fix policy set unit test.
---------
Co-authored-by: Mike Jensen <jentfoo@users.noreply.github.com>
* Update RFD with hardware key pin policies.
* Consolidate policy logic and update tests.
* Add pin private key policies; Make PIV PIN/Touch prompts work together.
* Prompt user to set pin/puk from default.
* Handle unexpected PIN auth errors.
* Resolve RFD password prompt comment.
* Handle incompatible private key policy in role sets (future-proof).
* Resolve comment on require mfa type string godocs and tests.
* A satisfying change.
* Address PIN/PUK prompt comments and other code suggestions.
* Resolve comments.
* Fix test that prompts for pin twice.
* Fix test.
* Add the Access List review backend.
The Access List review backend has been added to Teleport.
* Update tests to remove frequency_changed.
* Update lib/services/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update lib/services/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Tweak errors, add gRPC client to go along with new interfaces.
* Update comments, fix errant bugs with api client, remove reviews getter.
* Fix comments in proto, tweaks to tests and backend.
* Remove call to SetName.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Make yubikey unit test interactive and add to test plan.
* Move yubikey hardware signer method tests to interactive yubikey test.
* Remove hardware key interactive unit test from testplan
This change drains unused SSH channels and requests to prevent a
situation where an attacker could repeatedly open channels and
send data that won't be read, causing Teleport to eventually run
out of memory.
* Change PIV metadata cert to be self signed by an ephemeral key so it can be signed without touch/pin.
* Refactor touch prompt logic.
* Prompt user before overwriting non-teleport certificates instead of just returning an error.
* Update RFD and Docs.
* Address CR.
* Export some methods and variables for use in tests.
* Address comments.
* Test registration with unusable devices
* Count devices according to cluster settings
* Use AddMFADeviceSync in test helpers
* Use AddMFADeviceSync on lib/auth tests
* Remove AddMFADeviceRequestInit from mfaAddTestOpts
* nit: Pass testing.T to lib/web.TestTerminalRequireSessionMFA funcs
* Ignore AddMFADevice usage in interceptor tests
* Deprecate AddMFADevice and its top-level messages
* Update generated protos
* Deprecate lib/client RPC wrapper
* Deprecate AddMFADevice in lib/auth.IdentityService
* Address deprecation warnings
* Move gRPC error intercetpors to api/utils/grpc/interceptors.
* Use error interceptors in api client and mock server.
* Apply suggestions from CR.
* Unwrap FromGRPC errors in middleware.
* Use gRPC auth service in tests instead of external example service.
* It's gRPC!!!
* Fix unit test.
* Add error interceptor to proxy client.
* Fix merge conflict.
* url checker
* add ut
* add comment in test plan
* warnOnError only when err is not nil
* fix typos etc.
* enable metadata service permission for discovered databases
* add a debug log when azure db url is validated
It was required for compatibilty reasons - v13 proxy could connect to v12 agents,
which didn't support signed PROXY headers. But we don't need it in v14.
* assist: support recording non-interactive forwarded sessions
* assist: add integration tests for assist command recording on agentless
This also fixes a bugged openssh integration test check.
* Mock OpenAI API in integration tests.
Also fixes the OpenAI mock handler that was not supporting the "/v1/*"
routes used in some web/ tests.
* Docstrings + adressing again a feedback that got lost during a rebase
* restore signer function signature
* Address Jakub's feedback + diverse improvements
- improve comments
- simpler file creation
- more efficient rsa key generation
- use assert instead of require in other goroutines
- only save env vars if they are Teleport-related
- move more logic into newTestCredentials for readability
* Update lib/srv/forward/sshserver.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Add a timeout in the ssh handler coroutine
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Krzysztof Skrzętnicki