Some parts of Teleport required this env var to be set to "true"
while other parts required a value of "yes" - this made it
impossible to pass all of the checks.
Use ParseBool instead to be more generous in what values are allowed.
When migrating the S3 events handler to use aws-sdk-go-v2 applying
the FIPS settings and custom endpoint were inadvertently dropped.
This restores the functionality, while also adding tests to ensure
that they are always respected going forward.
A similar test was added to the dynamodb events handler as well to
prevent any regressions with FIPS settings there.
- Recursively check for accesslist membership
- Allow adding/removing/listing included access lists in acl commands
- Add a recursive test
- Use dynamic access lists structure from RFD
- Resolve proto changes
- Exclude 'list' members from Access List memberCount
- Calc Access List member count with members of type 'list' excluded,
return seperately to front end
- Update examples/integrations
- Update crd docs
- Update tf docs
- Perform calculation of inherited roles/traits to AccessList service in
order to utilize cache and minimize number of requests.
- Grant Okta integration RO for Access Lists
- Update AccessListMember-* events
- Include count for inherited grants
- Include MembershipKind of affected member(s)
- Emit inherited grants / members' MembershipKind for AccessListMember-*
events
- Update notified owners for Access Requests
- Ensure dynamic owners are notified for Access Requests
- Ensure dynamic owners are notified via Slack integration
- Optionally pass an AbortSignal to `fetchAccessLists` in Web UI
- Replace usages of `services.IsAccessListOwner/IsAccessListMember` with
equivelant funcs from `Hierarchy`
- Remove final references to AccessListMembershipChecker
- Don't allow ACL deletion when member/owner in other lists
- Guard Access List deletion behind membership/ownership checks for List
- Expose Hierarchy func to recursively get all members
- Tidy UserLoginStateGenerator logic involving ACL Membership/Ownership
Co-authored-by: Maxim Dietz <maxim.dietz@goteleport.com>
* Add proto.
* Add decoding logic for SecondFactorType.
* Update auth preference methods to use and prefer SecondFactors.
* Add fileconf and warning logs.
* Fix tests.
* Address comments.
* Address comments.
* Validate SecondFactor; Disallow SecondFactor and SecondFactors to both be set.
* Address comments.
* Treat second factor SSO as SecondFactor=on; Prevent local user lockout when SSO is the only enabled MFA method; Ensure SecondFactors=[] is disallowed.
* Upate terraform schema, docs, crds.
* Address comments.
* Address comments.
* Fix lint, fix test.
v16 removed the ability to disable second factor authentication,
however, a bypass was left around to allow users to transition.
Starting in v17, the bypass will no longer work and all clusters
_must_ be configured with 2FA.
* Update AccessList Entitlement Enforcement to handle infinite limit
The AccessList service was not correctly handling a zero-value limit
(i.e. an infinite limit) when checking to see if creating an
AccessList would breach the cluster Access List entitlement.
This patch:
* Adds a centralized implementation of a limit check, so that we
only have to get the calculation right once.
* Tests for same
* Updates the AccessList limit check to use the new limit check
* Adds table-driven tests to exercise the limit check in various
scenarios, replacing several almost identical tests.
* Review feedback
* Include BuildCommunity in built type checks
This commit will add two new methods to the modules interface,
IsEnterprise and IsOSS. This is to help alieviate any pain around the
code base that used to look specifically for BuildOSS. Now that we have
two "oss types" (oss and community), we can use these methods to do
enterprise/oss checks, rather than specifically looking at the build
type. This also will allow any future build types to not affect these
checks again in the future.
* Update e
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Replace isTeam for new flags in web app
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
* undo removing method by accident
* Add MobileDeviceManagement field to web config struct
* Improve comments
* Fix tests
* Simplify lockedFeatures object
* Include JoinActiveSessions in the web config object
* Remove more instances of isTeam
* Apply suggestions from code review - improve comments
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Use consistent comments to remove isTeam
* Update godocs comments
* Revert removign `isTeam` from stories it still should
* Fix godoc typo
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add fake yubikey private key implementation for tests.
* Add TestHardwareKeyLogin.
* Simplify Hardware Key support test plan.
* Enable piv test package in tests.
* Add TestMarshalAndParsePrivateKey.
* Address simple comments.
* Remove *testing.T from mockSSOLogin in; Add and use better helper methods for mocking sso login.
* Refactor test to dynamically set mock attestation data; revert related changes.
* Add support for hardware key serial number attestation through user
trait.
* Modify AttestHardwareKey interface to return full attestation data
* Add serial number to attestation data and verify it
* Add unit test.
* Address comments.
* Don't accept partial matches.
* Fix build and test errors.
* Revert "Restrict IGS flag check to usage based plans only (#35431)"
This reverts commit 31e1715532.
* Update test
* Pass access request monthly limit to webconfig
* Fix typo
* Add product type to features and define feature limit helpers
* Add IGS check with access request monhtly verify
* Move limit getters to enterprise
* Simplify product type conversion
* Add clarifying comment
* Revert "Deprecate field AdvancedAccessWorkflows to AccessRequest.Enabled (#34792)"
This reverts commit 79d1a5d16e.
* Add IGS related fields to features and modules
* Boiler plate for enabling access monitoring through modules
* Add IGS related license fields
* Use access monitoring feature flag instead
* Fix test
* Add backwards comp without deprecating field
* Address CR
* Address CR
* Deprecate AdvancedAccessWorkflows proto field
* Remove AdvancedAccessWorkflows feature module field
* Rename fields
* Rename fields for all plugins
* Test ping proto response
* Address CR
* Proxy TAG requests through Auth
* Integrate Access Graph feature and optimize services
This commit entails the integration of the Access Graph feature into the existing service configuration. This feature is manifested through an 'IsEnabled' method that checks the state of the access graph. Additionally, the auth service logic now includes a flag for enabling access graph. The services have been further optimized with adjustments geared towards improving performance and readability of the code.
* Move TAG enabled flag from proxy to user setting/auth context
* Swap a pointer to AccessGraph config with a value.
* Add 'TestNewAccessGraph' function to 'useracl_test.go' file.
The function 'TestNewAccessGraph' has been added to run tests checking the configuration of Access Graph. Furthermore, a small change is made for the 'KindAccessGraph' comment in 'constants.go' to provide more accurate information.
* Implement Access Graph feature across various files
The Access Graph feature has been incorporated in 'module.go', 'authservice.proto', 'auth.go', and 'plugin.go' files. A method 'EnableAccessGraph' is also introduced in 'module.go' to allow the usage of this feature. Descriptions of Access Graph have been adjusted across files to explicitly state the feature's enablement.
* Fix tests
* Remove unused access graph feature code
This commit removes all references and uses of the access graph feature from the codebase. It also updates corresponding tests to reflect this removal. It also adds EnableAccessGraph() method to testing module to fix test compilation.
* Allow locks to deny access to access lists.
Access list membership will now be impacted by active user locks. If a user
is locked, they will not be considered a part of an access list. This, in turn
will be used for things like Okta assignments to ensure that Okta access can be
rescinded while a lock is active.
* Access list membership checker is its own struct now.
* Rebase and fix tests.
* Update e ref
* Complete services.Users interface refactoring
Removes temporary functions required to migrate the interface
without breaking e.
Closes#32949.
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
* Start migrating services.Identity to use context and return users
Adds new variants of existing methods that are going to be updated
to support propagating context and return users from create, update
and upsert. This is an unfortunate step required because e utilizes
the interface for various functionality. In order to prevent breaking
builds, the temporary methods were added so that e can be converted
to them first, then oss can be updated to the new version of the
interface. Once that is done e will be converted and then the temp
methods will be removed.
* fix typos in comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix: don't set metadata on existing item in CAS
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix: gci
* fix: set resource id on update
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Generate access list suggestions on access request creation
* Add test
Cleanup code
* Add comment
* Fix typo and refactor access suggestion in services library
Fixed a typo in a comment in `access_list.go`. Refactored `accessrequest/suggestion.go` for enhanced code structure. The old model had all methods related to access request in a single interface, `accessRequestAPIGetter`, which had been divided among multiple interfaces for better division of responsibilities. A new function `GetSuggestedAccessLists` was created to narrow down the single duty for each function. These changes ensure more convenient unit testing and better accountability.
* Improve access request suggestions logic
This commit improves the logic for generating access request suggestions. It includes the requester's roles and traits as well as those from the access list and provides suggestions only for resource-based requests. A new method was also introduced for initializing AccessRequestSuggestions to avoid nil error.
* Refactor access list suggestions to promotions
The concept of 'suggestions' was updated to 'promotions' in different files (auth.go, client.go, auth_service_test.go, auth_service.proto among others) to make it more intuitive and align with the business context. This implies changing the wording, the functions called and the variable names. The feature itself hasn't changed, just the way it is referred.
* This commit changes the method name "GenerateAccessListSuggestions" to "GenerateAccessRequestPromotions" in multiple files. The naming is changed to reflect the actual function of the method, which is generating promotions for given access requests, rather than generating list suggestions. All relevant mentions and usages of this method are updated to reflect the name change. Modification also includes adjustments to the comments and interfaces related to the updated function for better code clarity.
* Refactor "GenerateAccessListSuggestions" to "GenerateAccessRequestPromotions"
Renamed method "GenerateAccessListSuggestions" to "GenerateAccessRequestPromotions" across the codebase. This change reflects the actual functionality of the method, which is to generate promotions for access requests, not suggestions. This aligns the method name with its purpose, and offers better code readability. Comments related to this function were also updated to maintain consistency.
* Update method handling access requests promotions
Revised the method of handling failures when generating access requests promotions. Now, even if promotions fail to generate, the request will not fail entirely. Instead, the request can still be approved but without promotions. Also, changed the UpsertAccessRequestAllowedPromotions method to CreateAccessRequestAllowedPromotions to clearly indicate its purpose, while revising related test cases and comments.
* Use Amazon EICE to connect into EC2 instances
This PR adds a new method to SSH into EC2 instances.
It uses the Amazon EC2 Instance Connect Endpoint to do so.
You can read more about the capabilities/limitations of this feature
here
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-using-eice.html
From the Teleport point of view, this uses the AWS OIDC Integration to
call the AWS APIs.
This connection mode is similar to the Agentless mode, where Teleport
connects to the OpenSSH daemon on the target server.
Except, that with this mode there's no required set up on the target
machine (no CAs are being used).
An overview of the flow when the user tries to SSH into a node:
- an SSH Public Key is sent to the target EC2 Instance
- a connection is made to the EC2 Instance Connect Endpoint using
websockets, which in turn pipes the connection to the Private IP of
the EC2 Instance
* review pt1
* pass CA for tests
* add godocs to OpenTunnelEC2
* fetch proxy public address jit
* add docs and move key generation to native package
* remove tcp socket
* Add access request monthly limit to Features
* Add a method to retrieve usage of Access Requests
* Verify access request limit when creating
* Remove AccessRequestsFeature.Enabled
Feature is always enabled now, the flag serves no purpose
* Expose usage of access requests in auth server
* Reimplement access request usage using audit log
* Disallow unauthenticated access to resource usage
* Tidy proto structures
* Start enforcing access request limit in auth
* Run GCI
* Add a license header to usage_test.go
* Add missing godoc
* Restructure usage proto per PR comments
* Construct proto.AccessRequestUsage in getARMU
* Reduce log level when encountering an unexpected event
* Simplify return
* Add godoc to GetResourcesUsage in client
* Fix merge mess-ups
* Count all requests, no matter their review state
* Factor out GetAccessRequestMonthlyUsage
* Move out resource usage to its own service
* Validate the limit after dry run is done
Unbreak UI when the limit is up
* Fix imports
* Remove Limit
SearchEvents will default to defaults.EventsIterationLimit
* Rename the service proto
* Add godocs to the gRPC service
* Move resource usage to a dedicated package
* Define single GetUsage rpc for all resource types
* Additions for limited access requests UI rework
* Add a test for GetAccessRequestMonthlyUsage
* Address lint
* Run GCI
* Add licenses where missing
* Expect CTA_UNSPEICIFED rather than `undefined`
* Expect CTA_UNSPECIFIED instead of undefined
Brian Joerger