* Prevent creation of invalid App for AWS OIDC Integration
When enabling AWS Access using an integration, the final address will be
a concatenation of the integration name and the proxy's public address.
The proxy must present a certificate valid for that address.
However, when the integration name has a dot, it will usually not work
with the proxy's certificate.
We know it won't work for Teleport Cloud, where the certificates only
allow for `<app>.<tenant>.teleport.sh`.
So, for Teleport Cloud enabling AWS Access is not possible.
For self-hosted, a warning is emitted.
* prevent new aws oidc integrations with invalid DNS labels
* add integration name to error message
* improve readability of validation.IsDNS1035Label call
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* AWS OIDC: Accept custom issuers
This PR adds a new field into the AWS OIDC fields:
- issuer
This is the issuer that was configured in AWS.
It is used by teleport to set the `issuer/iss` field when generating the
JWT.
This way we'll be able to set a custom issuer.
As an example, we could set this to be a public S3 bucket which doesn't
suffer from the thumbprint validation issuer.
* ensure issuer is a valid https url
* use s3 uri instead of any url for issuer
* typo and require s3 fields
* add missing s3 location when creating integration
* improve error messages
In addition to adding server and backend handling for create and
update roles, the services.Access interface was updated to return
a role from the existing Create/UpsertRole methods. Bumps the e
ref to incorporate the associated changes needed there to prevent
breaking the build.
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
Marek Smoliński