* First Draft of teleport-session-review skill
Framework based on ACL skill
* Adds Examples and Playbook for how to use Session Search
* Add a preflight check
* Feedback from Docs
* Extra Testing on a Teleport Cloud Tenant
* Docs to Skill
* Remove local dev for now
* update locate commands to include $TSH
* Update docs/pages/identity-security/session-summaries/session-search.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove Filter caveats
These have been fixed
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Document user display names and how Teleport derives them
* remove redundant notes on display name behavior in user types documentation
* drop unnecessary word
* refine user display name mapping for Okta, Microsoft Entra ID, SAML/OIDC, and SCIM integrations
* refactor: streamline display name documentation across identity provider integrations
* update user display name documentation
* improve clarity and consistency in user display name documentation
* Add public docs for the CA override feature
* Use `code` blocks instead of `shell`
* Number steps as n/d. Move alternatives to H3.
* Move intro paragraphs to "How it works"
* Remove "Supported CAs" section, move its contents to other sections
* Mention specific commands in the info box
* Emphasize future growth
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update Go version to v1.26.4
* Rm GO_VERSION from Makefile/Dockerfile and rely on go.mod to inform Go version. Update code to adhere to 1.26 deprecation/changes.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Bump e to 54d1d0cb67b71860b943de477b3146d32ccdd74a.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
---------
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
Co-authored-by: teleport-renovate[bot] <275214890+teleport-renovate[bot]@users.noreply.github.com>
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
We are standardizing docs guides to add a page_type frontmatter field,
with values for how-to guides, references, etc. We can then use this
field to apply linting rules that ensure each guide type follows
type-specific docs site conventions. The first convention is that each
docs page must have an outcome statement, the structure of which depends
on the guide's type. Human and AI agent readers can determine from the
outcome statement whether to continue reading the guide or not.
This change assigns the `page_type` frontmatter field to 55 guides.
Where an outcome statement is missing, it adds one. Where an outcome
statement exists, it ensures that the statement matches the standard
structure so we can add a linter later on. (A majority of guides were
already compliant.)
We are standardizing docs guides to add a page_type frontmatter field,
with values for how-to guides, references, etc. We can then use this
field to apply linting rules that ensure each guide type follows
type-specific docs site conventions. The first convention is that each
docs page must have an outcome statement, the structure of which depends
on the guide's type. Human and AI agent readers can determine from the
outcome statement whether to continue reading the guide or not.
This change applies a `page_type` frontmatter field to 46 guides in the
`enroll-resources` section of the docs. Most of these guides already
include the expected outcome statement. For those that do not, this
change adds one:
- Automatic user provisioning introduction partial
- Host user creation
- Encrypted session recording guide
- ClickHouse guide (rewording the existing outcome statement to match
the standard structure we are rolling out).
- Automatic session recording key rotation
- Manual session recording key rotation
- macOS launchd guide
Rename --from/--to to --from-utc/--to-utc on `recordings search` to
match the `recordings ls` flag naming convention. The old names are
kept as hidden aliases for backward compatibility.
For JSON and YAML output formats, automatically paginate through result
batches until up to 500 sessions are collected rather than stopping
after the first batch. When results are truncated, a --resume-token
hint is printed to stderr so the caller can continue from where the
previous run left off.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Fixes#64890
Before #61492, the SSO index page briefly documented single log out
(SLO) for SAML. #61492 refactored our SSO authentication connector
guides to remove the duplication between the landing page and individual
IdP guides, but inadvertently removed the reference to the partial that
documented SLO. This change restores the partial to the closest location
available to its original one: below the `idp-initiated.mdx` partial in
our SAML guidance.
* app: Reject duplicate effective public_addr in static config
Extend the existing duplicate-name check in applyAppsConfig to also
reject static apps that resolve to the same effective routing FQDN.
Fail fast at startup rather than dispatch non-deterministically via
servers[rand.N(len(servers))] in lib/web/app/match.go.
Compute the effective FQDN per app as:
- public_addr, normalized through idna.ToASCII + trim trailing dot +
lowercase to match services.ValidateApp's proxy-collision compare,
- name + proxy_public_addr (one entry per proxy public addr) when
public_addr is empty, or when use_any_proxy_public_addr is true
(matching utils.AssembleAppFQDN),
- name + cluster_name as a fallback when proxy_service is enabled
but proxy_public_addr is unset (matching proxyDNSName in
lib/web/apps.go).
Limit the check to static app_service.apps. Dynamic apps are out of
scope; defer best-effort detection to a follow-up RFD.
* app: Address review feedback on static FQDN dedupe
Mirror runtime registration when computing default app FQDNs.
`FindPublicAddr` in `lib/srv/app/watcher.go` uses an IP-valued
proxy `public_addr` as-is and falls back to `cluster_name` only
when the proxy `public_addr` is unset; the validator previously
skipped IPs and fell back to `cluster_name` whenever a proxy
`public_addr` looked like an IP, which let a YAML config slip
through that would still collide at registration.
Extract `utils.DefaultAppFQDN(appName, proxyHost, clusterName)` as
the shared source of truth for default FQDN derivation. Both the
static config validator (`lib/config`) and `FindPublicAddr` call
it so the two paths stay in sync.
Ignore the local `proxy_service` config when it is disabled.
`FindPublicAddr` reads registered proxies from the backend, so a
disabled local proxy contributes nothing at runtime; the
validator was previously treating leftover `cfg.Proxy.PublicAddrs`
entries as effective routing suffixes and could fail startup on a
false duplicate FQDN when the apps would route through a
different proxy.
Make a malformed proxy `public_addr` or `cluster_name` non-fatal
during validation. Enabling `app_service` should not block startup
on an address that no app depends on. Skip the malformed entry, log
a warning, and let the dedupe pass continue; a real collision still
errors.
Sort per-app FQDN iteration before checking the seen-set so the
error message is stable when one app has several effective FQDNs
that each collide with a previously seen app. Go map iteration is
random and the prior code picked whichever order Go produced.
Clarify the comment about `CheckAndSetDefaults`: it validates
`app.Name` and `app.PublicAddr` as DNS-1123 forms, it does not
transform them. The dedupe step relies on the input already
being lowercase ASCII without a trailing dot.
* app: Trim duplicate-FQDN docs and simplify sort
Cut the FQDN-derivation and multi-proxy implementation detail from the
duplicate-routing docs so users only see that colliding FQDNs are
ambiguous and Teleport rejects them when `proxy_service` is colocated.
Replace the collect-then-sort pair with `slices.Sorted`.
* Add Networking Reference Troubleshooting section
See #62997
Edit the Networking Reference to add a Troubleshooting section covering
three common networking errors when setting up a Teleport cluster:
- Connection reset by peer
- First record does not look like a TLS handshake
- Authentication handshake failed (teleport.cluster.local)
* Edit Networking Reference connection reset section
Make the guidance more general and explain the origin for users who may
not be familiar with TCP fundamentals.
* Clarify the Networking reference
Responds to **zmb3** feedback:
- Don't use code style to refer to a Teleport process.
- Use a broader level of detail for the "connection reset" discussion.
- Remove incorrect indication that that the Proxy Service has a SAN.
* docs: adding agentic identity in feature matrix
* post-meeting: Chris W. edits
* organizing Beams in per-feature structure to match rest of the tables
* Firecracker and beam lifecycle details
Adds the first user-facing Access Graph tctl command, listing security
detections with filters and a time window.
Talks to Access Graph through the web proxy and relies on the backend's typed
501/credential errors (see access-graph#1998) instead of a pre-emptive
features.json probe, so the CLI stays stateless.
* tctl: add YAML parity for structured output commands
* Add WriteProto Go Doc comment
* Make output format flag visible in evaluate-db-access command
* Make output format flag visible in evaluate SSH command
* remove x509 override dry-run format flag
* refactor: simplify error messages for unknown output formats
* refactor: replace printJSON with utils.WriteJSON and WriteJSONArray
* Add vulnerability management page to docs
* Fix some typos and improve language
* clarify cadence for updates, fix stylistic issues
* add govulncheck to cspell
* Add Troubleshooting notes to Azure join guide
Fixes#61191
- Add table of required endpoints to the Prerequisites section
- Add a Troubleshooting section that illustrates error messages that
occur if Teleport services cannot reach the required endpoints
* Clarify the Azure join guide
- Split a long Prerequisites item (per mmcallister feedback).
- Add a URL to the table of required URLs.
In #65190, we inadvertently introduced two small issues, which this
change fixes:
- Remove a reference to a nonexistent role. This was a mistake due to a
find/replace operation.
- Add full permissions to the access-plugin-update role. The Jira Access
Request plugin needs to list and read `access_plugin_data`, not just
create it.
