Changes:
When Okta read-only is enabled (bidirectional sync is disabled):
- don't display Okta-originated resources in "All Resources" view
- don't display Okta-originated resources in "New Request" view
- error if Okta-originated resource access is requested
Note: this is still possible to request a role which allow access to an Okta-originated resource,
but the team made a decision to allow this case.
Provides a type safe resource 153 unwrapping variant to replace
types.Resource153Unwrapper. Most uses have been switched over to
the new type, though a few still exist and may be harder, if not
possible to convert without a considerable amount of change.
* SPIFFE X.509 issuer override: CRUD
* tctl support for workload_identity_x509_issuer_override
* Define audit log events
* Emit audit log events
* Add comments to point at the e implementation
* audit events fixtures
* Use DisallowUnknown in tctl
* Update protobuf
* Implement and test ValidateTokenWithJWKS
* Update join logic to use new method for static jwks
* Update Terraform Provider
* Update operator docs/files
* Update goldenfile
The changes here were a result of examining CPU and memory profiles
of BenchmarkListUnifiedResources. The biggest inefficiencies stemmed
from the authorizer and `(types.Server) MatchSearch`.
When the authorizer computes lock targets it will call `(types.LockTarget) Equals`,
which was relying on proto.Equals to determine if nine strings were
equivalent. The fields are now individually checked and a test
was added to ensure that if any new fields are added they must
be added to the check for the test to pass.
ListUnifiedResources attempts to be smart and evaluate whether the
user has read/list access to a particular resource kind once. However,
it was always checking if users had access to _all_ supported resources
instead of just the resources that the user was requesting. While most
of the checks are not very expensive, checking all resources is still
worse than only checking the required resources.
Lastly, the `(types.Server) MatchSearch` implementation is no longer
allocating a slice of search fields and using `types.MatchSearch`.
Instead a variant of the loop from `types.MatchSearch` is inlined.
While this was only applied to `types.Server` it should likely
be extended to other resource types in the future - or `types.MatchSearch`
should be refactored in a way that does not require callers to allocate.
```bash
$ benchstat old.txt new.txt
goos: darwin
goarch: arm64
pkg: github.com/gravitational/teleport/lib/auth
cpu: Apple M2 Pro
│ old.txt │ new.txt │
│ sec/op │ sec/op vs base │
ListUnifiedResourcesFilter/labels-12 195.0m ± 6% 173.3m ± 2% -11.12% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 230.6m ± 3% 210.8m ± 4% -8.57% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 229.8m ± 5% 209.0m ± 7% -9.08% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 600.6m ± 3% 364.3m ± 1% -39.35% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 687.0m ± 2% 423.4m ± 1% -38.37% (p=0.000 n=10)
geomean 335.7m 259.5m -22.69%
│ old.txt │ new.txt │
│ B/op │ B/op vs base │
ListUnifiedResourcesFilter/labels-12 868.8Ki ± 0% 414.1Ki ± 0% -52.34% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 7.731Mi ± 0% 7.287Mi ± 0% -5.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 7.731Mi ± 0% 7.288Mi ± 0% -5.74% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 22106.9Ki ± 0% 486.8Ki ± 0% -97.80% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 22107.0Ki ± 0% 486.3Ki ± 0% -97.80% (p=0.000 n=10)
geomean 7.494Mi 1.371Mi -81.70%
│ old.txt │ new.txt │
│ allocs/op │ allocs/op vs base │
ListUnifiedResourcesFilter/labels-12 11.401k ± 0% 4.865k ± 0% -57.32% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_path-12 161.5k ± 0% 155.0k ± 0% -4.04% (p=0.000 n=10)
ListUnifiedResourcesFilter/predicate_index-12 161.5k ± 0% 155.0k ± 0% -4.04% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_lower-12 162.212k ± 0% 5.277k ± 0% -96.75% (p=0.000 n=10)
ListUnifiedResourcesFilter/search_upper-12 162.224k ± 0% 5.275k ± 0% -96.75% (p=0.000 n=10)
geomean 95.22k 20.07k -78.93%
```
This adds a new field, UseAnyProxyPublicAddr, that will be used to
tell the web api/ui to rebuild the request app's FQDN based on the proxy
public addr that the request came from (upcoming PR to consume this)
* Hack on including attrs in svid issuance
* Add attrs to JWT SVID issuance
* Fix comparison in tests
* Improve comment on attributes field of event proto
* fix: make sure Fields map is not nil
* move new test to existing file, allocate map for struct up front
* make linter happy
---------
Co-authored-by: Erik Jankovic <erik.jankovic@gmail.com>
* Adds AWS Role ARN to IC Integration settings
The Identity Center integration needs to be able to assume an AWS role
when using the ambient system credentials. This patch updates the IC
integration protobuf definition to include the role ARN, by refactoring
the settings block to replace the CredentialSource enumeration with a
`Credentials` type containing a `oneof` union of System and OIDC credential blocks.
The CredentalSource value is preserved for backwards compatibility with previous
Teleport releases.
This patch includes
- the updated protobuf message and generated types
- update tests, etc
- updated `tctl` to handle new plugin settings structure
Chagnges required to actually use this information are coming in a later PR.
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Rename role ARN
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Adds IC plugin status value to trigger IC group import
The IC plugin automatically imports IC groups into Teleport on its
first run, and uses the plugin status block to mark the import as complete,
and is not required the next time the plugin starts up.
New functionality in `tctl` allows Teleport admins to edit the IC plugin
resource in order to modify group, account and permission set filters.
At the moment, the group filters are only applied during tis initial import,
so changing them has no effect.
In order to allow changes to group import filters to have an effect, this this
patch adds a new value to the `AWSICGroupImportStatusCode` enueration that
indicates that the import process should be re-run the next time the plugin
restarts.
* Break out import status code validation
* Remove import status enum validation
* Adds edit support for IC plugin to `tctl edit`
This patch expands the plugin resource unmarshaler in `tctl` to handle the
heterogenous filters used by the Identity Center plugin settings. It also adds
support for the IC status block.
These changes allow a user to edit the plugin resource via `tctl edit` after
installation.
* Why not use protojson? Well...
* Update collection.go
* Add json.(un)MarshalJSON implementations father than structure unpacking
* Dead code removal
* Apply suggestions from code review
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Apply review feedback
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* emit user_origin for local login event
* ignore unspecified origin while allowing overriding with a defined origin value
* abstract origin getter
* test: emit unspecified origin value to test the initial value is preserved
* feat: identity center resource sync event
* Web UI event formatter
* let the emitter send user message to be used in the ui
* review: plural total count names
* review: make distinctive failure event
* review suggestion:
- spell out completed and failed event description
- write resource import counts
- use code for error
* spell fix
* GitHub proxy: web apis for enrolment
* github integration update
* updates
* add ut
* add overwrite test
* fix lint
* add generic field size check
* fix lint
* update log for using existing oauth id
* wiring the API client through
* tctl stable-unix-users ls
* stable UID fallback for Teleport SSHD
* stable_unix_user.create event
* fix-license
* Require and test audit log message
* Add stable_unix_user_config to fileconf
* Avoid saying "fallback UID" in logs
* Avoid saying "fallback UID" in error messages
* Avoid racing writes in the mock emitter
* pnpm lint-fix
* fix lib/auth tests that broken during rebase
* add config field in cluster auth preference
* extend ClusterConfiguration to support checking auth preference in AtomicWrite
* stable UNIX users storage
* auth API and auth-side business logic
* move server implementation to a subpackage
* Use proto3 and the default (open) API
* remove type alias for ClusterConfiguration
* Move new AuthPreference validation into a Validate method
* Check the StableUnixUserConfig before use
* use Config instead of Params
* Don't rely on error types for the retry logic
* Fix TestStableUNIXUsersBasic
* Use free functions for Validate
* make grpc
* black-box testing that includes authz
Sakshyam Shah