* Add hardware key service interface; Add mock service for tests.
* Add piv implementation of hardware key service.
* Remove old yubikey parsing logic in favor of hardwarekey.PrivateKeyRef.
* Remove HardwareSigner in favor of hardwarekey.PrivateKey.
* Add test; Cleanup comment; Don't require pin/touch prompts in tests with MockHarwdareKeyService by default.
* Fix tests.
* Add TODOs.
* Use unhashed digest for WarmupHardwareKey.
* Address comments.
* Fix race condition in test service.
* Address comments.
All of our supported release branches are well past Go 1.18, so
we don't need to support the old build tag syntax.
Changes made by running `go fix ./...`.
* Partial revert of CSRF auth related removals
Required to support backwards compatibility of the enterprise
plugin endpoint.
* Remove CSRF checking in header
* Address CR
* Inline helper funcs
We added this function to mitigate slow user.Current() calls in
Windows Active Directory environments. Go 1.24 ships with an optimized
verison of user.Current, rendering this utility unnecessary.
Closes#41922
* Refactor client version compat for reuse in lib/teleterm
* Remove ClustersService.getAuthSettigns, add test helper
* FormLogin: Nest AuthSettings under distinct prop
* Return client version status with auth settings
* Add UI for compatibility warning
* Do not use wildcards for TOO_OLD to mirror tsh
Also, handle TOO_OLD first to mirror lib/client/api.go.
* Adjust buttons to mirror the look of primaryAction/secondaryAction of Alert
* Do not show pre-release "-aa" suffix
* Fix title case in button
* Add skipVersionCheck to docs
---------
Co-authored-by: Grzegorz Zdunek <grzegorz.zdunek@goteleport.com>
* Add support for HTTP 'Accept' header to '/webapi/auth/export' endpoint
Signed-off-by: Fred Heinecke <fred.heinecke@goteleport.com>
* Switch PR to use new `format` parameter
---------
Signed-off-by: Fred Heinecke <fred.heinecke@goteleport.com>
In https://github.com/gravitational/teleport/pull/24254 expansion
of tilde prefixes(i.e. `tsh scp CHANGELOG.md root@host:~foo/`) was
explicitly denied. However, because the error returned to the user
is a trace.BadParameter error the reauthentication logic kicks in
and attempts to resolve the issue with fresh credentials. This
error is now caught and wrapped in a NonRetryableError to prevent
the authentication logic from providing a weird UX.
Updates https://github.com/gravitational/teleport/issues/22886.
* [vnet] refactor AppProvider for Windows implementation
* allow empty cert pool
* fix unconvert lint
* fix root cluster ca pool
* edit log message
* return errors when failing to get appinfo for matching app
* edit comment on ClientApplication interface
* add missing license header
* Support multiple active CAs in `tctl auth export`
* Remove the ExportAuthoritiesSecrets func
* Mention path in the --out-prefix help
* Rename --out-prefix to --out
* Write script-friendly output
* Introduce ExportAll functions
* Refactor tests
* Test ExportAll in existing test suite
* Test ExportAll with multiple active CAs
* Update godocs
* Update godocs
* Fix auto-update re-exec arguments modified by aliases
* Make arguments to be required to set
* Restore progress bar show before request
* Improve integration tests to execute with `tsh` and `tctl`
Added a full-cycle integration test to verify client tools
auto-updates within a test cluster by modifying AutoUpdateConfig
and AutoUpdateVersion resources. The test executes the login
command using alias configurations to ensure no recursive
re-execution occurs.
The updater binary used in integration tests has been replaced
with the `Run` logic of tctl and tsh.
* Set generated test password by env variable instead of constant value
* Restore priority of env check over remote check
In case of double re-execution case we should stop second one to prevent loop re-execution
Drop localDir set during compilation
Updates https://github.com/gravitational/teleport/issues/49509.
Most of the places namespaces were already configurable were had
been forcing the default namespace. This extends that by removing
the ability to pass in a custom namesapce and hardcodes the
default namespace at the inner most call site to reduce the surface
area of namespaces.
With the removal of the --namespace flag from the base tsh command,
kubernetes subcommands have also been updated to use --namespaces
in addition to --kube-namespace. The former should be preferred,
while the later exists solely for backward compatibility.
This is the _last_ step required to migrate from logrus to slog.
All components in the repository have been migrated to use slog
allowing the logrus formatter to be deleted.
The slog handler tests that validate the output have been updated
to assert the format directly instead of comparing it to the output
from the logrus formatter.
* Remove all direct logrus usage from teleport module
The only remaining use of logrus is from integrations, which is
unfortunately imported by teleport.e, and prevents logrus from
being moved to an indirect dependency. The logrus formatter and
initialization of the logrus logger will remain in place until
integrations is using slog. To prevent any accidental inclusions
of logrus within the teleport module the depguard rules have been
updated to prohibit importing logrus. The rules also include
prohibit a few common log packages that tools like gopls might
automatically import.
* Refactor logger initialization
Consolidates configuring of global loggers to a single function.
This is mainly to facilitate configuring the logger for
teleport scp, but will also allow us to remove the copy of logger
initialization that currently exists in integrations/lib/logger.
* fix: document ValidateFields
* fix: remove copied yaml tags
* fix: update file path comment
* Add support for Oracle connections without wallet. Backwards compatible.
* Bypass maybeAddOracleOptions for non-Oracle protos
* use named const
* fix lint issues
* Update PR to slog
* lint fix
* Pass around PortMapping rather than port as string
* Pass target port to local proxy
* Validate target port
* Accept target-port flag in tsh app login
* Don't reuse certs for multi-port apps
* Add a test for multi-port tsh proxy app
* Use strings.Cut instead of strings.SplitN
* Remove appInfo from localProxyApp
* Remove unused method appInfo.appLocalCAPath
* Restore CSRF Token for SSO flows
This is a partial revert of #50358.
We need to keep the CSRF token in the SSO flows for now, as it is
used to ensure that the flow is completed by the same actor who
initiated the sign-on.
* Make the purpose of the lib/httplib/csrf package clear
This package is only used to protect against login CSRF with SSO flows.
Teleport's web API is protected from CSRF by nature of using a bearer
token, and does not require this package. This particular pacakge is
only necessary for SSO because the user is not yet logged in when the
SSO flow begins, so they don't have a bearer token.
* Remove the remaining bits of unneeded CSRF code
Additionally expand upon the godocs for our various middlewares
so that it's clear which ones provide CSRF protection.
Host resolution performed because labels, fuzzy search, or predicate
expressions were supplied to commands that establish connections to
a single host has historically been performed client side in tsh.
While that works in most cases, it can prevent correctly
resolving hosts in some situations, i.e. when there are ambiguous
hosts and tsh is unaware that the cluster routing strategy is set
to ROUTE_TO_MOST_RECENT.
To improve the experience, a new ResolveSSHTarget was added to
Auth to allow host resolution to be performed server side. The
resolution works in a similar manner to, and was inspired by
GetSSHTargets. In the event that the new RPC is not implemented,
because the client is newer than Auth, tsh has also been updated
to pull the cluster networking config and address any host
ambiguity if allowed.
As a result tsh scp and tsh proxy ssh should be much more
tolerant to, and still permit access in situations where
ambiguous hosts are present for some amount of time. Prior to
this the only way to connect in these situations was to find
the UUID of the correct target instance and try again after
seeing an ambiguous host error.
* Include sso channel ID in web mfa challenges.
* Handle SSO MFA challenges.
* Handle sso response in backend.
* Handle non-webauthn mfa response for file transfer, admin actions, and app session.
* Simplify useMfa with new helpers.
* Fix lint.
* Use AuthnDialog for file transfers; Fix json backend logic for file transfers.
* Make useMfa and AuthnDialog more reusable and error proof.
* Use AuthnDialog for App sessions.
* Resolve comments.
* Fix broken app launcher; improve mfaRequired logic in useMfa.
* Fix AuthnDialog test.
* Fix merge conflict with Db web access.
* fix stories.
* Refactor mfa required logic.
* Address bl-nero's comments.
* Address Ryan's comments.
* Add useMfa unit test.
* Fix story lint.
* Replace Promise.withResolvers for compatiblity with older browers; Fix bug where MFA couldn't be retried after a failed attempt; Add extra tests.
Prior to Teleport 15, the web UI would download the entire session
recording into browser memory before playing it back (crashing the
browser tab for long sessions).
Starting with Teleport 15, session playback is streamed to the
browser and played back as it is received instead of waiting for
the entire session to be available.
A side effect of this change is that the browser needs to know
the length of the session in order to render the progress bar
during playback. Since the browser starts playing the session
before it has received all of it, we started providing the length
of the session via a URL query parameter.
Some users have grown accustomed to being able to access session
recordings at their original URLs (without the duration query
parameter). If you attempt to play recordings from these URLs after
upgrading to v15, you'll get an error that the duration is missing.
To fix this, the web UI needs to request the duration of the session
before it can begin playing it (unless the duration is provided via
the URL). There are two ways we could get this information:
1. By querying Teleport's audit log
2. By reading the recording twice: once to get to the end event
and compute the duration, and a second time to actually play
it back.
Since we only have a session ID, an audit log query would be
inefficient - we have no idea when the session occurred, so we'd
have to search from the beginning of time. (This could be resolved
by using a UUIDv7 for session IDs, but Teleport uses UUIDv4 today).
For this reason, we elect option 2. This commit creates a new web
API endpoint that will fetch a session recording file and scan through
it in the same way that streaming is done, but instaed of streaming
the data through a websocket it simply reads through to the end to
compute the session length. The benefit of this approach is that it
will generally be faster than option 1 (unless the session is very
long), and it effectively pre-downloads the recording file on the
Note: option 2 is not without its drawbacks - since the web UI is making
two requests that both read the session recording, the audit log will
show two separate session_recording.access events. This isn't ideal
but it is good enough to get playback working again for customers
who don't access playbacks by clicking the "Play" button in the UI.
* feat(repl): add postgres
* refactor(repl): change repl to use a single Run function
* test(repl): reduce usage of require.Eventually blocks
* refactor(repl): code review suggestions
* refactor(repl): code review suggestions
* test(repl): increase timeout values
* fix(repl): commands formatting
* refactor(repl): send close pgconn using a different context
* fix(repl): add proper spacing between multi queries
* test(repl): add fuzz test for processing commands
Brian Joerger