- Recursively check for accesslist membership
- Allow adding/removing/listing included access lists in acl commands
- Add a recursive test
- Use dynamic access lists structure from RFD
- Resolve proto changes
- Exclude 'list' members from Access List memberCount
- Calc Access List member count with members of type 'list' excluded,
return seperately to front end
- Update examples/integrations
- Update crd docs
- Update tf docs
- Perform calculation of inherited roles/traits to AccessList service in
order to utilize cache and minimize number of requests.
- Grant Okta integration RO for Access Lists
- Update AccessListMember-* events
- Include count for inherited grants
- Include MembershipKind of affected member(s)
- Emit inherited grants / members' MembershipKind for AccessListMember-*
events
- Update notified owners for Access Requests
- Ensure dynamic owners are notified for Access Requests
- Ensure dynamic owners are notified via Slack integration
- Optionally pass an AbortSignal to `fetchAccessLists` in Web UI
- Replace usages of `services.IsAccessListOwner/IsAccessListMember` with
equivelant funcs from `Hierarchy`
- Remove final references to AccessListMembershipChecker
- Don't allow ACL deletion when member/owner in other lists
- Guard Access List deletion behind membership/ownership checks for List
- Expose Hierarchy func to recursively get all members
- Tidy UserLoginStateGenerator logic involving ACL Membership/Ownership
Co-authored-by: Maxim Dietz <maxim.dietz@goteleport.com>
This PR propagates access list members and owner's ineglibile_status
field with the data from the backend. Prior to this change, the field
was ignored.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Add conditional update methods for `AccessList` and `AccessListMembers`
This PR adds two new methods for conditinally update an AccessList and
AccessListMember resources to avoid overriding changed resources.
This is a preparation for a ineligible status reconciler.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Update lib/services/simple/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* handle review comments and drop copy methods
* simplify code
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
The access list interface now supports counting members without unmarshaling.
This method has been added to the generic backend service as well. This will
allow for quicker counts when necessary. This method has been added to the
cache.
Additionally, a status field as per RFD-153 has been added to access lists
that will house the new optional member count field.
* Add access lists, members, and reviews to cache.
Access lists, members, and reviews have been added to the cache. To do this,
I have created a simple backend that doesn't perform the validation that is
performed by the main access list backend and only implements a subset of
actions that are needed by the cache.
To support this, I've added in new gRPC methods:
ListAllAccessListMembers and ListAllAccessListReviews. These do not lock
any access lists and additionally do not perform any implicit or dynamic
members, but just simply return the full list of all members and reviews
so that these endpoints can be used to populate the cache.
The general thought here that, since the order of cache events cannot be
guaranteed, we'll rely on the auth server to perform the proper backend
validation and use a simplified backend that simply sees if the items
are present in the cache. If so, we'll return them.
I've had to update a few protos to support this. While I was here, I
fixed a bug in the access list gRPC client where the call tolist of reviews
was not supplying the access list name. Additionally, the user login
state generator will now use the cached access list values.
* Move simple backend to lib/services/simple
* Update to reflect new generic function signatures.
* Include 'nextAuditDate' in 'CreateAccessListReview' method
The 'CreateAccessListReview' method in the 'AccessListService' and 'Client' interfaces was altered to include the 'nextAuditDate'. The 'nextAuditDate' is now being collected during the review creation process and returned as a part of the result along with the created review.
* Fix test.
When logging in via `tsh` or doing a `tsh status`, a message expressing which
access lists need to be reviewed will be displayed along with the amount of
time left until the next review.
* Add the Access List review backend.
The Access List review backend has been added to Teleport.
* Update tests to remove frequency_changed.
* Update lib/services/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update lib/services/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Tweak errors, add gRPC client to go along with new interfaces.
* Update comments, fix errant bugs with api client, remove reviews getter.
* Fix comments in proto, tweaks to tests and backend.
* Remove call to SetName.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* This change introduces a new 'promoted' access request state. The state represents that an access request has been promoted to an access list.
Affected code was modified to adjust to the new promoted state and ensure correct system's behavior.
Added a new 'GetAccessRequest' method for internal use to retrieve access request info.
Disallowed direct promotion of access requests. Introduced 'SubmitAccessReviewAllowPromotion' for promotions.
Added 'PromoteAccessRequest' method and updated its usage to restrict direct promotions.
Refactored code for better readability and testing. Renamed some functions, simplified logic, added test helpers.
Introduced 'promoted' state for access requests to handle promotion workflow.
Added 'PromotedAccessListTitle' in 'AccessReview' to track promotion state.
* Refactor function and message names for better clarity
The function and message names related to the promotion of an access request to an access list were restructured for better readability and consistency. Names like 'PromoteAccessReqResponse' have been replaced with more descriptive names such as 'PromoteAccessRequestResponse'. This increases clarity and consistency across the project.
* Remove the hacky GRPC server implementation
* Change method names to be more descriptive
Renamed all instances of 'PromoteAccessRequest' to 'AccessRequestPromote' in multiple files. The new method name provides a more descriptive and clear understanding of the method's function, which improves code readability and maintenance. This change applies to method definitions, comments, and error messages.
* Refine error message and introduce IsPromoted method
Refined the error message in 'access_request.go' to better indicate that only promoted requests can set the promoted access list title, not just have one. This enhances clarity of error message. Additionally, introduced 'IsPromoted' method in 'access_request.go' file. This method will be useful for quickly checking if a request is in the PROMOTED state.
* Rename variable in SubmitAccessReview method
Renamed the variable "params" to "submission" in the 'SubmitAccessReview' function, in 'auth_with_roles.go' file. The name "submission" provides clearer indictation of its role in submitting access review. This enhances code readability and understandability. No logic changes were made during this update.
* Define ineligible status enums and fields
* Add ineligible field to converter
* Update proto
* Define and use eligible status instead of unspecified
* When converting to internal obj, set ineligibleStatus to empty by default
Define option fn's to set the ineligibleStatus upon request
* Set ineligibleStatus fields with request responses
* Add missing proto comment
* Add godoc
* Add AccessList with member upserting functionality
This patch introduces a new method to AccessListService: UpsertAccessListWithMembers. This allows clients to asynchronously create or update an access list and its included members at once, which wasn't previously possible. The same functionality is also included in the gRPC protocol and supporting services as part of this change. To uniquely identify members and make it easier to lookup, members are converted from slices to a map for convenient access and comparison.
This feature enhances the usability of access control, making it easier to manage lists and their members as batch operations, allowing for efficient updates, deletions, and comparisons without making separate calls per each member, avoiding possible network delays and excessive API calls. The go-cmp package is introduced for member comparisons.
* Refactor UpsertAccessListWithMembers and expand tests
Refactored UpsertAccessListWithMembers to allow batch updates and reduce API calls. Now converts member slices to a map for easy lookup and comparison, and checks against the map to delete or update matching members. Also fixed the return statement to include the input members for a more consistent API.
Additionally, expanded unit tests to cover the UpsertAccessListWithMembers in AccessListService. The tests cover various cases, including creating an access list, adding members to the list, and checking that providing an empty set of members removes all current members.
This update provides a more efficient way to manage lists and their members, reducing potential network delays and excessive API calls.
* Update comments
This commit adds locking to the access list service. The concern here is that,
without this locking and the additional logic here, it's possible to add
members to access lists that don't exist. Furthermore, if a user then creates
an access list with the same name as the access list being used for creating
these members, then the access list will have members added to it.
The locks and logic here should ensure that members are only added to lists
that exist and that users are properly cleaned up after removing a list
without the possibility of orphaned members.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Move gRPC error intercetpors to api/utils/grpc/interceptors.
* Use error interceptors in api client and mock server.
* Apply suggestions from CR.
* Unwrap FromGRPC errors in middleware.
* Use gRPC auth service in tests instead of external example service.
* It's gRPC!!!
* Fix unit test.
* Add error interceptor to proxy client.
* Fix merge conflict.
* Add access list members to the cache.
Access list members have been added to the cache. To support this, the access
list member gRPC client methods have been implemented. A few extra gRPC
methods were added to the access list service. Additionally, a few changes
were made to the cache tests since the backend for the access list now
performs multiple backend calls.
* Further tuning of backend.
* Revert removal of access list members assignment.
* Update lib/cache/cache_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Remove debugging statements, tune legacy header conversion.
* Remove AccessListMembers reference, as it's no longer needed.
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Add in the access list tctl command.
The access list (acl) command has been added into tctl, which will allow
for the management of access lists from tctl. Access lists can be created
and deleted by administrators as well.
Additionally, a bug with the access list wrapper client was corrected where
the access list was not being properly added into the upsert access list
request. A final proto nil check was added into access list's FromProto
to ensure that there's no potential panics here.
* GCI.
* Use slices, tweak function names.
* Use paginated list instead of list.
* Correct the user-name flag, correct typo.
* Revert back to expires.
A paginated access list endpoint has been added. As access lists can be
large objects, the risk of crafting responses that are too large is much
higher than other objects. Pagination will help mitigate this.
* Add the AccessList to the cache.
The AccessList has been added into the cache. The AccessList resource
and its supporting resources had to be moved back into api for this so that
it can be properly referenced in api/client/events.go, which is necessary
for cache propagation.
* Address remaining lib/types references.
* Add in additional test to events_test.go.
* GCI.
* Add back in client wrapper so that the cache will work properly.
* Traits ToProto order is deterministic.
* Add in compile time access list client check.
