* Add UpsertTrustedClusterV2 rpc
This supersedes UpsertTrustedCluster rpc. V2 performs resource name
validation.
* Replace confusing UpsertValidationTrustedCluster name
* Use UpsertTrustedClusterV2 in tests
* Address feedback
- Remove unnecessary ping
- Update error messages
- Use skipNameValidation consts
- Validate cluster name before establishing trust
- Do not reveal cluster name in error message
- Use BadParameter instead of CompareFailed
* Use webclient.Find
* Fix test/lint
* Allow label updates
* Fix test
* Fix error handling
* Implement CreateTrustedClusterV2 and UpdateTrustedClusterV2
* Address feedback
* Minor fixes
* Move V2 RPCs to the trust service
* Update comment
* Drop V2 suffix
* Require matching revision
* Fix upsert/update revision
* Drop V2 from Create and Update APIs
* Lint: Fix typo
* First pass at trying to generate terraform provider
* Wire up types
* Fix generation of docs
* Add godoc comments
* Add tests
* Tflint and add example
Host resolution performed because labels, fuzzy search, or predicate
expressions were supplied to commands that establish connections to
a single host has historically been performed client side in tsh.
While that works in most cases, it can prevent correctly
resolving hosts in some situations, i.e. when there are ambiguous
hosts and tsh is unaware that the cluster routing strategy is set
to ROUTE_TO_MOST_RECENT.
To improve the experience, a new ResolveSSHTarget was added to
Auth to allow host resolution to be performed server side. The
resolution works in a similar manner to, and was inspired by
GetSSHTargets. In the event that the new RPC is not implemented,
because the client is newer than Auth, tsh has also been updated
to pull the cluster networking config and address any host
ambiguity if allowed.
As a result tsh scp and tsh proxy ssh should be much more
tolerant to, and still permit access in situations where
ambiguous hosts are present for some amount of time. Prior to
this the only way to connect in these situations was to find
the UUID of the correct target instance and try again after
seeing an ambiguous host error.
* Add the decisionv1.Service boilerplate
* Wire decisionv1.Service to auth.GRPCServer
* Wire decisionpb.DecisionServiceClient to client.Client
* Add basic service testing
Adds Identity Center Account Assignments to the Unified resource cache
so they can be requested in access requests.
Unfortunately we can't just include an `identitycenterv1.AccountAssignment`
directly in the resource cache ListResources output because the legacy
protobuf codegen used for the authservice and the new codegen used for
identitycenter/v1 produce incompatible serialization code, so resulting
generated code does not compile.
To get around this issue, this change introduces a parallel (and slightly
simplified) definition of an IdentityCenterAccountAssignment in the authservice
protobuf spec to act as the wire format for this type. The cached
`identitycenterv1.AccountAssignment` resources are copied into a
`proto.IdentityCenterAccountAssignment` on a cache read.
Includes:
- adding resources to cache
- adding account assignment paginated resource
- account assignment role condition matching for RBAC
* Exposes Identity Center accounts as Apps in Unified Resource Cache
For the purposes of the UI, Identity Center accounts and account
assignments are treated like special Apps. This patch exposes
Account Assignments to the UI via the Unified Resource Cache.
Includes:
- Generating an App resource from an Identity Center Account resource
- General plumbing from backend through to cache and UI
* lint
* Add TargetPort to RouteToApp and AppMetadata proto messages
* Pass TargetPort during cert generation
* Refactor Pack.makeTLSConfig to accept struct
This will make it easier to add targetPort to it.
* Add labels to UUIDs used by appaccess test pack app servers
This makes them easier to distinguish when routing doesn't work as expected.
* Refactor Pack.CreateAppSession to accept a struct
* TestTCP: Create app session within test
If we kept the old code, we'd need to manually create a session for each
target port, which would create a lot of duplication.
* Prepare integration test fixtures for multi-port tests
* Add api/utils/net.IsPortInRange
* Use TargetPort when routing TCP connections
* Inline dialMultiPortTCPApp, centralize logic
* Check target port when connecting to single-port app
* Reorder check in IsPortInRange
* Use int instead of uint16
* Extract picking dialTarget to separate function
* addr → uriAddr
* Improve err msg for single-port apps when targetPort != uriPort
* Fix unnecessary conversion to int
* Add monitoring of the servers time drifting
* Refactor monitor to use inventory stream
* Add command for inventory control stream for time reconciliation
* Reuse ping/pong logic for time reconciliation
* Add integration test to check if global notification is created
* Limits notification length, renaming
* Return system clock instead of time difference
Add parallel requests to ping the nodes
Fix issue with locking inventory store while making ping request
* Refactor to make time reconciliation part of the inventory control stream
* Fix tests
* Rewrite tests
Return inventory store iterator
* Naming adjustments
* Fix test
* Drop timeReconciliation in order to use direct handler functions
* Make time reconciliation with variable duration
* Replace with duration type in proto
Add test cleanup for possible goroutine leak
Add comment about half request duration
* Format notification message
* Add UpstreamInventoryPong.SystemClock check
* git_server resource and role.allow.github_permissions
* implicit RO on KindGitServer
* review comments
* fix ut
* make -C integrations/operator crd
* fix ut again
* make crds-up-to-date and make -C integrations/terraform docs
* Revert "Add unstable envvar to disable server keepalives (#43342)"
This reverts commit 1e2d7724e7.
* Allow changing a VariableDuration by more than one
* Get rid of control log pings
* Dedicated lightweight jittered ticker for the inventory
* Split off per-protocol tickers
* Tests for jittered ticker
* Use a start barrier in TestVariableDurationIncDec
* Explain value to be passed to Advance
* Add explanations in jitteredticker tests
* Rename jitteredticker to delay
* Add SSO MFA ceremony support to WebUI per-session MFA.
* Add display name to SSO MFA device; Add SSO MFA device to SSO challenge.
* Camel case json tags for front end.
* Add sso channel ID for front end broadcast channel logic.
* Fix backwards compatiblity issue; fix error message.
* Fix test.
* Fallback to connector id if display name isn't set.
* Fix test.
* Resolve comment.
* Use uuid.NewRandom.
* go mod tidy
- Recursively check for accesslist membership
- Allow adding/removing/listing included access lists in acl commands
- Add a recursive test
- Use dynamic access lists structure from RFD
- Resolve proto changes
- Exclude 'list' members from Access List memberCount
- Calc Access List member count with members of type 'list' excluded,
return seperately to front end
- Update examples/integrations
- Update crd docs
- Update tf docs
- Perform calculation of inherited roles/traits to AccessList service in
order to utilize cache and minimize number of requests.
- Grant Okta integration RO for Access Lists
- Update AccessListMember-* events
- Include count for inherited grants
- Include MembershipKind of affected member(s)
- Emit inherited grants / members' MembershipKind for AccessListMember-*
events
- Update notified owners for Access Requests
- Ensure dynamic owners are notified for Access Requests
- Ensure dynamic owners are notified via Slack integration
- Optionally pass an AbortSignal to `fetchAccessLists` in Web UI
- Replace usages of `services.IsAccessListOwner/IsAccessListMember` with
equivelant funcs from `Hierarchy`
- Remove final references to AccessListMembershipChecker
- Don't allow ACL deletion when member/owner in other lists
- Guard Access List deletion behind membership/ownership checks for List
- Expose Hierarchy func to recursively get all members
- Tidy UserLoginStateGenerator logic involving ACL Membership/Ownership
Co-authored-by: Maxim Dietz <maxim.dietz@goteleport.com>
* Client auto updates integration for tctl/tsh
* Add version validation
Fix recursive version check for darwin platform
Fix cleanup for multi-package support
* Fix identifying tools removal from home directory
* Replace ToolsMode with ToolsAutoUpdate
* Reuse insecure flag for tests
* Fix CheckRemote with login
* Fix windows administrative access requirement
Update must be able to be canceled, re-execute with latest version or last updated
Show progress bar before request is made
* Fix update cancellation for login action
Address review comments
* Add signal handler with stack context cancellation
* Use copy instead of hard link for windows
Fix progress bar if we can't receive size of package
* Replace with list in order to support manual cancel
* Download archive package to temp directory
* Decrease timeout for client tools proxy call
* proto
* Fix update for DynamicWindowsDesktops
* fix test server
* fix test
* fix test
* fix test
* Update api/proto/teleport/dynamicwindows/v1/dynamicwindows_service.proto
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* update proto
* fix tests
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Adds caching support for Identity Center resources
Adds support for caching (and watching) some IdentityCenter resource types.
Specifically:
- identitycenterv1.Account
- identitycenterv1.AccountAsssignment
- identitycenterv1.PrincipalAssignment
Also breaks the cache's `genericcollection` out into its own file as an attempt
to reduce clutter in the main collections source file.
* Update identitycenter_events.go
* Update identitycenter_events.go
* Speed up tests
* Add proto changews for shifting RegisterUsingToken to gRPC
* Implement RegisterUsingToken RPC and client fallback
* Add methods to `api/client`
* Adjust join/register code to try new API first and fallback to old
* Rejig JoinServerGRPCServer to invoke auth.Server
* Tidy up some code duplication
* Fix broken build
* Fix TestRegisterBot_RemoteAddr
* Fix TestServer_RegisterUsingTPMMethod
* Add test for new RegisterUsingToken gRPC RPC
* Remove unused helper function
* Fix test
* Walk back switch to gRPC endpoint for registration via proxy
* Remove unused code
* Update client autoupdate proto structure
* Replace with reserved
* Fix unit tests
* Add more info in proto
* Rename proto to be aligned RFD namings
* Replace enum type for ToolsMode to string
* Cache yubikey objects.
* Cache PIV connections to share across the program execution.
* Do not release the connection until `sign` returns
* Do not ignore errors
* Perform a "warm up" call to YubiKey
* Fix tests
* Use a specific interface to check if the key can be "warmed up"
* Allow abandoning `signer.Sign` call when context is canceled
* Make sure that the cached key is valid for the given private key policy
The reason for adding this check was failing `invalid key policies` test.
* Make `hardwareKeyWarmer` private
* Force callers to release connection
* Improve comments
* Fix lint
* Improve `connect` comment
* Fix race condition
* Simplify `release` logic
* Trigger license/cla
---------
Co-authored-by: joerger <bjoerger@goteleport.com>
Alan Parra