* Fix proto resource 153 marshalling
* Update tool/tctl/common/collection_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update tool/tctl/common/collection_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Address feedback
- Change from Resource153AdapterV2 to ProtoResource153Adapter
- fix test failures and unmarshal proto resources properly
- add a failing round-trip proto 153 test case
- bonus: fix the table tesst reosurce create that did not support
running a single row
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* lint
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add initial expiry service
* Fix incorrect listAccessRequest options
* Fix linting
* Fix import order
* Check if context is done if sem aquisition fails in main loop
* Use gracefull exit context when starting expiry service
* refactor: determine session type on stream based on watcher
* refactor(auth): early return when is teleport server
* refactor: move to function and add tests
* chore(lib): fix lint
* refactor(events): make private function
* Add UpsertTrustedClusterV2 rpc
This supersedes UpsertTrustedCluster rpc. V2 performs resource name
validation.
* Replace confusing UpsertValidationTrustedCluster name
* Use UpsertTrustedClusterV2 in tests
* Address feedback
- Remove unnecessary ping
- Update error messages
- Use skipNameValidation consts
- Validate cluster name before establishing trust
- Do not reveal cluster name in error message
- Use BadParameter instead of CompareFailed
* Use webclient.Find
* Fix test/lint
* Allow label updates
* Fix test
* Fix error handling
* Implement CreateTrustedClusterV2 and UpdateTrustedClusterV2
* Address feedback
* Minor fixes
* Move V2 RPCs to the trust service
* Update comment
* Drop V2 suffix
* Require matching revision
* Fix upsert/update revision
* Drop V2 from Create and Update APIs
* Lint: Fix typo
This commit removes the restrictions of the autoupdate_agent_rollout and autoupdate_config schedules but adds groups validation.
It also adds some optional server-side validation that should not be enforced at the resource level.
* Add protos for issuance service and attrs
* "expiry" -> "expires_at" rename
* Pull jwt/x509 svid out into own messages
* Add WorkloadIdentity/WorkloadIdentityRevision fields to SPIFFESVIDIssued
* Update package name
* Add debugging steps for DiscoverEC2 User Task issues
This PR adds a new field when getting an User Task.
Description contains a markdown document that should be displayed to the
user which helps them fix the issue with the task.
* move descriptions from api to lib
* Adds IC Account Assignments to preset `access` role
Adds the global-allow wildcards to the preset access role, allowing the `access`
role to participate in Resource Access Requests involving Identty Center
resources.
* Adds IC Account Assignments to preset `access` role
Adds the global-allow wildcards to the preset access role, allowing the `access`
role to participate in Resource Access Requests involving Identty Center
resources.
* Add default roles if not present
* Add reviewer role
* Update lib/services/presets.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* apply feedback
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* UserTasks for Discover EKS: create tasks when auto enrolling fails
This PRs changes the DiscoveryService to ensure it creates UserTasks
when EKS Clusters fail to auto-enroll.
* simplify types
* Automatially add IC Account to Account Assignments Access Requests
The UI needs access to the account associated with an Account Assignment
in order to display the enclosing Account, otherwise the user will not
be able to see their assogned permission sets.
This patch automatically adds the enclosing account for any account
assignments in a resource access request and allows the user to see
ther human-friendly names in the access request listing.
* Apply suggestions from code review
Co-authored-by: Sakshyam Shah <sshah@goteleport.com>
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Code review sugestions
---------
Co-authored-by: Sakshyam Shah <sshah@goteleport.com>
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Filter IC Permission Sets based on access
If a user is granted access to an IC Permission Set via an access request,
the UI treats the referenced account as if all Permission Sets are granted.
This hides the requestable Permission Sets from the user, making it
impossible for a user to requests more Permission Sets on that account.
This patch filters the Permission Sets delivered to the UI based on whether
the user already has access the Permission Sets and marks any requestable
Permission Sets on the account.
This provides the UI with enough information to decide how to display the
Permission Set list in order to get around the issue.
* Update lib/auth/auth_with_roles.go
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Update auth_with_roles.go
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Add WorkloadIdentityLabels field to role
* Wire up access checker
* Add validation for new field
* Update CRDs
* Add to terraform provider
* Mispel some words to keep the republic happy
* Add WorkloadIdentityLabelsExpression
* Update Terraform provider
* Add to operator CRD
* PLS RUN CLA CHECK
* Add custom type for list of port ranges
* Verify local port before initializing local proxy
* Call AppResolver.OnInvalidLocalPort before refusing conn
* Fix how lib/vnet.TCPAppResolver sets leafClusterName
* Refactor CannotProxyVnetConnection
This allows more reasons to be specified.
* Improve how TshdNotificationsService gets cluster names
* Let notifications override auto-removability
* Send RPC to Electron app on invalid port
* Remove impl of sort.Interface from PortRanges
* Make GetTCPPorts return PortRanges
* Test clusterName only against RootClusterName
* Don't say "local port" in UI
* Show valid ports in Connect
* Show valid ports in tsh
* Fix fake app provider in tests
* Add admin rule tab to the role editor
Also tightens some constraints about standard role editor conformance.
* Add a way to delete an admin rule
* Review
Adds Identity Center Account Assignments to the Unified resource cache
so they can be requested in access requests.
Unfortunately we can't just include an `identitycenterv1.AccountAssignment`
directly in the resource cache ListResources output because the legacy
protobuf codegen used for the authservice and the new codegen used for
identitycenter/v1 produce incompatible serialization code, so resulting
generated code does not compile.
To get around this issue, this change introduces a parallel (and slightly
simplified) definition of an IdentityCenterAccountAssignment in the authservice
protobuf spec to act as the wire format for this type. The cached
`identitycenterv1.AccountAssignment` resources are copied into a
`proto.IdentityCenterAccountAssignment` on a cache read.
Includes:
- adding resources to cache
- adding account assignment paginated resource
- account assignment role condition matching for RBAC
* AWS OIDC: add aws account id as label to AWS App
We were not setting any labels in the AWS App when using the Discover
Flow for a given AWS OIDC integration.
This is a bad practice because this means that users must have
`app_labels: *:*` in order to access this particular app.
This is not recommended because it grants access to every app.
This PR changes this so that the account id can be used to gate access.
* fix test
* Exposes Identity Center accounts as Apps in Unified Resource Cache
For the purposes of the UI, Identity Center accounts and account
assignments are treated like special Apps. This patch exposes
Account Assignments to the UI via the Unified Resource Cache.
Includes:
- Generating an App resource from an Identity Center Account resource
- General plumbing from backend through to cache and UI
* lint
* Add Account Assignment IDs to IC App Permission Set List
Account Assignment resources represent potential Identity Center
account assignments that will be created when a Teleport user is
granted access to them via an Access Request.
The UI needs to know which resources represent a given (Account,
Permission Set) pair when building an access request, so this change
allows Teleport to express this relationship in the enclosing
Idenitity Center and App resources, rather than have the UI try
and deduce it.
* doc
* Add Contact resource; include it in default editor permissions and web ACL
* Add contacts to ACL test
* Improve godocs
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Add `contact` to the web user context
* Add contact audit events
* Lint fix
* Use string interpolation
Co-authored-by: Grzegorz Zdunek <gzdunek@users.noreply.github.com>
* Comment ContactType enum
* make grpc
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Grzegorz Zdunek <gzdunek@users.noreply.github.com>
* Add Contact resource; include it in default editor permissions and web ACL
* Add contacts to ACL test
* Improve godocs
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Add `contact` to the web user context
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Add TargetPort to RouteToApp and AppMetadata proto messages
* Pass TargetPort during cert generation
* Refactor Pack.makeTLSConfig to accept struct
This will make it easier to add targetPort to it.
* Add labels to UUIDs used by appaccess test pack app servers
This makes them easier to distinguish when routing doesn't work as expected.
* Refactor Pack.CreateAppSession to accept a struct
* TestTCP: Create app session within test
If we kept the old code, we'd need to manually create a session for each
target port, which would create a lot of duplication.
* Prepare integration test fixtures for multi-port tests
* Add api/utils/net.IsPortInRange
* Use TargetPort when routing TCP connections
* Inline dialMultiPortTCPApp, centralize logic
* Check target port when connecting to single-port app
* Reorder check in IsPortInRange
* Use int instead of uint16
* Extract picking dialTarget to separate function
* addr → uriAddr
* Improve err msg for single-port apps when targetPort != uriPort
* Fix unnecessary conversion to int
* Add Ports to AppSpecV3
* Validate ports of api/types.AppV3
* Add Ports to lib/config and lib/service/servicecfg
* lib/config TestApps: Improve error messages
* lib/service: Convert servicecfg.PortRange to types.PortRange
* Add multi-port TCP apps to config and tctl tests
* Rename Ports to TCPPorts
* Change port fields to uint16 where possible
* Update comments for Port and EndPort
* Extract port range validation to api/utils/net
* Replace custom check type with require.ErrorAssertionFunc
* Simplify validation of end port
* Fix expected message in api/types test
I forgot to update that one.
* Check if device is trusted
* Move `TrustedDeviceRequirement` enum to a separate file and generate TS definitions for it
Generating TS definitions for the entire legacy/types/types.proto would result in 50K lines of generated code, and the bundle size would increase by ~20% (around 1 MB).
* Extract function to calculate device trust requirement that can be used both by the server and the client
Important: it now uses `GetEnforcementMode` instead of `GetEffectiveMode`. The check for OSS module is performed on the server-side anyway.
* Check what is device trust requirement based on cluster config and user roles
* Show device trust status in UI
* Remove `types.` prefix
* Improve godocs
* Bring back `getRoles func() ([]types.Role, error)`
* Simplify `TestHasDeviceTrustExtensions`
* Clean up and improve `TestCalculateTrustedDeviceRequirement`
* Move `CalculateTrustedDeviceRequirement` and tests to a separate file
* Add colors to shield icons
* Declare variables where they are used
* Extract a component to display device trust status for better readability
* Correctly reference `lib/client.ProfileStatus.Extensions`
* Set group limit to 8
* Make `switch` exhaustive
* Regenerate protos
* `make fix-license`
* Add monitoring of the servers time drifting
* Refactor monitor to use inventory stream
* Add command for inventory control stream for time reconciliation
* Reuse ping/pong logic for time reconciliation
* Add integration test to check if global notification is created
* Limits notification length, renaming
* Return system clock instead of time difference
Add parallel requests to ping the nodes
Fix issue with locking inventory store while making ping request
* Refactor to make time reconciliation part of the inventory control stream
* Fix tests
* Rewrite tests
Return inventory store iterator
* Naming adjustments
* Fix test
* Drop timeReconciliation in order to use direct handler functions
* Make time reconciliation with variable duration
* Replace with duration type in proto
Add test cleanup for possible goroutine leak
Add comment about half request duration
* Format notification message
* Add UpstreamInventoryPong.SystemClock check
* git_server resource and role.allow.github_permissions
* implicit RO on KindGitServer
* review comments
* fix ut
* make -C integrations/operator crd
* fix ut again
* make crds-up-to-date and make -C integrations/terraform docs
This changes the proto type (+validation) only to declutter the original PR https://github.com/gravitational/teleport/pull/49124
The real changes are in
- api/proto/teleport/legacy/types/types.proto
- api/types/access_request.go
- lib/auth/auth_with_roles.go
- lib/auth/auth_with_roles_test.go
The rest is all generated.
* Add `bitbucket` join method for Bitbucket Pipelines joining
This adds a new `bitbucket` join method that Machine ID bots can use
to authenticate to Teleport from Bitbucket Pipelines CI runs.
* Add unit tests for bitbucket joining
This also fully adds `deployment_environment_uuid` which was found to
be missing.
* Fix imports
* Update tf docs
* Docs update
* Update generated TF resources
* Attempt to work around docs linter
* Add provision token tests
* Remove pipeline_uuid and step_uuid from protos
Also, fix deploment_environment_uuid field name.
* Remove references to removed fields in tests
* Switch to go-oidc/v3 and remove now-redundant nbf check
* Fix go.mod imports for the TF provider
* Fix event-handler go.mod
* Address review feedback; add 15s timeout to fetch provider metadata
* Update lib/bitbucket/token_validator.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix build after constant rename
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
IdentityCenter accounts are exposed to the Teleport UI as applications,
with each app containing the list of AWS permission sets available on
the corresponding account.
This change adds the necessary additions to the App protobuf types
to carry the Identity Center information.
* Add Integration and DiscoveryConfig as labels to auto discovered RDS/EKS
This PR adds two new labels to RDS and EKS resources:
- Integration
- DiscoveryConfig
Those labels help identify which Integration and DiscoveryConfig were
used to auto enroll the resources.
* remove unused code
* add missing discovery config labels for GCP and Azure
