* Support automatic_approval in AMR spec
* Support filter by automatic_approval_name
* Update AMR validation
* Update terraform schema
* Fix import
* Add additional test case
* Improve amr spec godocs
* make -C integrations/terraform docs
* wiring the API client through
* tctl stable-unix-users ls
* stable UID fallback for Teleport SSHD
* stable_unix_user.create event
* fix-license
* Require and test audit log message
* Add stable_unix_user_config to fileconf
* Avoid saying "fallback UID" in logs
* Avoid saying "fallback UID" in error messages
* Avoid racing writes in the mock emitter
* pnpm lint-fix
* fix lib/auth tests that broken during rebase
* Protobuf and configuration for Access Graph Azure Discovery
* Fixing rebase after protobuf gen
* Updating to use existing msgraph client
* PR feedback
* Using variadic options
* Removing memberOf expansion
* Expanding memberships by calling memberOf on each user
* PR feedback
* Rebase go.sum stuff
* Go mod tidy
* Fixing go.mod
* Update lib/msgraph/paginated.go
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* PR feedback
* Protobuf and configuration for Access Graph Azure Discovery
* Adding Azure sync functionality which can be called by the Azure fetcher
* Protobuf update
* Linting
* PR feedback
* PR feedback
* Updating to use existing msgraph client
* PR feedback
* Using variadic options
* Removing memberOf expansion
* Expanding memberships by calling memberOf on each user
* PR feedback
* Rebase go.sum stuff
* PR feedback
* Protobuf and configuration for Access Graph Azure Discovery
* Protobuf gen fix
* Rebase fixes
* More cleanup
* e ref update
* Invoking token generation and returning the response
* Quick test with a message to make sure RPC is invoked
* Skeleton of new Azure OIDC RPC call
* Fetching the Azure OIDC token during fetcher creation and establishing a credential assertion approach
* PR feedback; restricting token requests to auth, discovery, and proxy roles.
* Lint
* Fixing mocks
* Fix imports
* Fix test
* Rebase fxes
* Adding back OIDC fetching, accidentally removed it during rebase
* e ref
* Lint
* Fix imports
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Eliminates the namespace CRUD API as part of
https://github.com/gravitational/teleport/issues/49509.
The most notable change introduce here is with flushCache in the
auth helpers. It was ironically using namespaces because they
were deprecated, however, it has since been updated to use a role
instead. The helpers.go file was also updated not to rely on testify
in attempt to prevent it from being included in production builds.
Updates https://github.com/gravitational/teleport/issues/6394.
* GitHub proxy part 6: proxing Git using SSH transport
* better command parsing and update suite
* refactor
* revert unnecearrty files
* address review comments
* ut fix
* revert localsite_test.go
* change special suffix to teleport-github-org for routing
* fix routing ut
* minor typo edit
* fix ut after sshca change
* add UT to sshutils
* minor review comments
* fix api ut because of special suffix change
* GitServerReadOnlyClient
* downgrade error to warning
* run go mod tidy. not sure why it's needed
* rename mock.go to mock_test.go
* Add initial expiry service
* Fix incorrect listAccessRequest options
* Fix linting
* Fix import order
* Check if context is done if sem aquisition fails in main loop
* Use gracefull exit context when starting expiry service
Host resolution performed because labels, fuzzy search, or predicate
expressions were supplied to commands that establish connections to
a single host has historically been performed client side in tsh.
While that works in most cases, it can prevent correctly
resolving hosts in some situations, i.e. when there are ambiguous
hosts and tsh is unaware that the cluster routing strategy is set
to ROUTE_TO_MOST_RECENT.
To improve the experience, a new ResolveSSHTarget was added to
Auth to allow host resolution to be performed server side. The
resolution works in a similar manner to, and was inspired by
GetSSHTargets. In the event that the new RPC is not implemented,
because the client is newer than Auth, tsh has also been updated
to pull the cluster networking config and address any host
ambiguity if allowed.
As a result tsh scp and tsh proxy ssh should be much more
tolerant to, and still permit access in situations where
ambiguous hosts are present for some amount of time. Prior to
this the only way to connect in these situations was to find
the UUID of the correct target instance and try again after
seeing an ambiguous host error.
* git_server resource and role.allow.github_permissions
* implicit RO on KindGitServer
* review comments
* fix ut
* make -C integrations/operator crd
* fix ut again
* make crds-up-to-date and make -C integrations/terraform docs
- Recursively check for accesslist membership
- Allow adding/removing/listing included access lists in acl commands
- Add a recursive test
- Use dynamic access lists structure from RFD
- Resolve proto changes
- Exclude 'list' members from Access List memberCount
- Calc Access List member count with members of type 'list' excluded,
return seperately to front end
- Update examples/integrations
- Update crd docs
- Update tf docs
- Perform calculation of inherited roles/traits to AccessList service in
order to utilize cache and minimize number of requests.
- Grant Okta integration RO for Access Lists
- Update AccessListMember-* events
- Include count for inherited grants
- Include MembershipKind of affected member(s)
- Emit inherited grants / members' MembershipKind for AccessListMember-*
events
- Update notified owners for Access Requests
- Ensure dynamic owners are notified for Access Requests
- Ensure dynamic owners are notified via Slack integration
- Optionally pass an AbortSignal to `fetchAccessLists` in Web UI
- Replace usages of `services.IsAccessListOwner/IsAccessListMember` with
equivelant funcs from `Hierarchy`
- Remove final references to AccessListMembershipChecker
- Don't allow ACL deletion when member/owner in other lists
- Guard Access List deletion behind membership/ownership checks for List
- Expose Hierarchy func to recursively get all members
- Tidy UserLoginStateGenerator logic involving ACL Membership/Ownership
Co-authored-by: Maxim Dietz <maxim.dietz@goteleport.com>
* Add proto changews for shifting RegisterUsingToken to gRPC
* Implement RegisterUsingToken RPC and client fallback
* Add methods to `api/client`
* Adjust join/register code to try new API first and fallback to old
* Rejig JoinServerGRPCServer to invoke auth.Server
* Tidy up some code duplication
* Fix broken build
* Fix TestRegisterBot_RemoteAddr
* Fix TestServer_RegisterUsingTPMMethod
* Add test for new RegisterUsingToken gRPC RPC
* Remove unused helper function
* Fix test
* Walk back switch to gRPC endpoint for registration via proxy
* Remove unused code
* Create DiscoverEC2 User Tasks for failed EC2 enrollments
This PR changes the DiscoveryService to start creating and updating
Discover EC2 User Tasks.
So, what are Discover EC2 User Tasks?
When users set up Auto Discover for EC2 Instances, they don't have a
good way of checking for issues on their configured matchers.
We created User Tasks as a way to warn Users that something's wrong.
Each User Task should describe an issue that happened and a way to fix
it.
This has potential to be used to report unexpected events trough the
whole system, which are not errors per se, but something the user should
take action in order to improve the situation.
In this case, we are creating a sub type of those tasks: DiscoverEC2.
From now on, when the DiscoveryService fails to auto-enroll an instance,
it will create a DiscoverEC2 User Task grouping all the failed instances
by the following props:
- integration
- issue type
- account id
- region
A follow up PR will also create notifications so that the user can
actually be notified on those User Tasks and take action.
* improve naming and split function into multiple methods
* rename task issues variable name
* fix context early cancelation
This PR adds a new method that allows users to list UserTasks by
Integration.
Given this is our main use case when showing the UserTasks in the UI
(we'll be always showing UserTasks for a given integration), we created
a dedicated method in the gRPC.
We'll probably add more filters but they will always include the
integration (at least for the uses cases we have currently).
Converts the backend.Key from a slice of bytes to a concrete struct.
The main motivation behind this change is to be able to better
distinguish individual components of a key. The textual representation
of a backend key is constructed by joining all components of the key
with a /. By representing the entire key as a single textual object
it prevented resources containing a / in their name from being
properly identified. There was a lot of code that interpolated keys
in various manners and expected only a specific number of
subcomponents for a particular resource. This lead to most,
if not all, of the RPCs used to create a resource to permit a name
containing /, (i.e. a user named test/llama/1), but any RPCs used
to retrieve the resources would fail to retrieve them from the
backend.
Every backend.Key now carries a slice of all the individual
components in addition to the textual representation. This permits
more fine grained inspection per component, while also not having
to construct the textual representation for a group of components
more than once.
The backend.Sanitizer was updated to only validate keys for backend
writes. Retrieving and deleting invalid of malformed keys is now
permitted. This will allow any existing resources that were created
with / in one of the components to become retrievable and deletable.
However, any new resources with / in their name are explicitly
prevented.
Closes#6088Closes#9107Closes#10576Closes#42823
* [kube] Drop usage of `ProcessKubeCSR`
This PR drops the usage of `ProcessKubeCSR` to ask Auth to sign a certificate on behalf of a user when running `tsh request search --kind=pod,...`.
Previously, we used `ProcessKubeCSR` to sign a new certificate but given that Kubernetes Access supports impersonation, this PR levarages it.
This also allows reusing the same kubernetes client for multiple calls.
* add deprecation notices to ProcessKubeCSR
* don't enforce kube api to be enabled
* Remove logrus from lib/auth/machineid
* Switch authclient.Config.Log and TunnelAuthDialerConfig.Log to Slog
* Add *slog.Logger to auth.Server
* Remove logrus usage in `lib/auth/access.go`
* Replace logrus with slog in lib/auth/accountrecovery.go
* Replace logrus with slog in `lib/auth/apiserver.go`
* Add missing logger to auth.Server
* Fix test
This PR adds the implementation for the User Tasks:
- services (backend+cache)
- clients (API + tctl)
- light validation to set up the path for later PRs
* Add AutoUpdate Client/Cache implementation
* CR changes
* Add permission for proxy to access resources
* Rename all occurrences auto update to camelcase
* Remove auto update client wrapper
* Drop AutoUpdateServiceClient helper
Rename comments for consistency
* disable tls client resumption
* avoid redundant verification in TLSDial
* fix wrong use of InsecureSkipVerify in HTTP auth client
* avoid overwriting GetClientCertificate in api client
* Use a getter function for CAs in TunnelAuthDialer
* Use dynamic connector data for the agent's auth client
* Make getPROXYSigner dynamic
* WIP: the thing (reloadless)
* Fix TestInstanceCertReissue
* Fix TestIntegrations/RotateFoo
* get rid of the whole reload mechanism
* Update most tests to not check for reloads
* Get rid of TestDatabaseAccess/RotateTrustedCluster
The test has been unconditionally skipped for two years now.
* avoid clobbering the auth connector
* overwrite clientState in update_servers anyway
* fix integration/hsm tests
* Document ListenForNewEvent
* fix RunWithSignalChannel godoc
* simplify ListenForNewEvents
* Remove forgotten commented code
* Explain the t.Setenv trick for non-parallelism
* explain waitingForNewEvent in integration/hsm
Gavin Frazar