* Add bot field to certificates and various usage events
This adds a new certificate extension field, `teleport-bot`, to
certificates issued to Machine ID bot users that can definitively
identify certificates as having been issued to a bot user.
Additionally, this uses the new `Bot` identity flag to mark certain
usage events as originating from bot users. As such, it includes a
protobuf update from Cloud [1], which pulled in some small additional
(mostly comment) changes.
[1] https://github.com/gravitational/cloud/pull/7060
* Small bot flag plumbing fixes
* Convert bot flag to BotName and UserKind enum
This makes a few changes to the bot tagging approach:
* The bot name is embedded in the cert rather than just true/false
* UserKind is included in events rather than just a bot flag, to
allow for an unspecified value for older client nodes.
* Add a quick unit test for bot cert extensions
* Fix outdated grpc
* Include bot flag on initial certs
* Log a warning and override user kind for usage records if they differ
* Fix several unit tests; add a bot metadata test case
* Fix unit tests with UserKind zero value
* Rename SSH cert extension to use standard format
Renames the `teleport-bot` extension to `bot-name@goteleport.com`,
to better follow SSH cert extension naming conventions.
* Attempt to improve unspecified userkind aggregating logic
* split recording session events and emitting audit events
This is a refactor of how audit events and session events are handled.
Previously, all events were emitted using the same interface,
api/types/events.Emitter. This lead to event-related code getting to be
very confusing, as it was often unclear whether a given event was being
recorded as a session event and emitted as an audit event, or only one
of the two. Naturally, a few bugs arose due to this.
To simplify event handling, a separate interface for recording session
events has been created. A api/types/events.Recorder should now only be
used to record session events, and an Emitter should now only be used to
emit audit events. Instead of using a confusing TeeWriter that would
transparently (and confusingly, given its name) hold a few event types
that only belonged in session recordings, callers can now explicitly
record and/or emit an event when necessary.
* ensure e build won't break
Refactor `services.AccessMFAParams` and the accompanying `MFAParams` methods so
they may be extended to carry additional data (eg, information required to
perform device trust checks).
This PR refactors existing code without adding any new functionality, so it may
be backported to older branches to alleviate eventual conflicts. Follow up
changes will take advantage of it to add support for device trust.
Related to gravitational/teleport.e#514.
Replace role/authPref RequireSessionMFA (bool) with RequireMFAType
(string).
- Add new RequireMFAType constant values with custom boolean marshalling.
- Add RequireMFAType to role and auth preference and deprecate
RequireSessionMFA.
- Add session-mfa override login when hardware_key_touch is enforced.
- Add protobuf enum for RequireMFAType.
- Add support for proto enums in protoc-gen-crd and update Kubernetes
Operator manifests.
