* Partial revert of CSRF auth related removals
Required to support backwards compatibility of the enterprise
plugin endpoint.
* Remove CSRF checking in header
* Address CR
* Inline helper funcs
Adds an additional type constraint go FnCacheGet and FnCacheGetWithTTL
to enforce that all keys are comparable. This should allow the
removal of various compile time hashability checks that are in
place for existing keys of custom types.
* prototype
* add server name and fix ut
* reduce scope
* fix ut and check client ip
* minor refactor
* remove extra check
* fix GetClusterName after merge
* fix lint
* feat: MenuLoginWithActionMenu component
* update MenuLogin to accomodate changes for MenuLoginWithActionMenu
* handle samlAppLaunchUrls in makeapp.ts
* update saml app login button
* update app.go to return SAMLAppLaunchURLs
* resource action button:
- added test and story
- handles both action and non-action buttons
* launchExternalUrl props for MenuLogin to open url with <a> tag
* handle memu login onClick to apply onClose callback
* use same comment over be and fe, app_test.go
* add isExternalUrl to LoginItem type instead of MenuLoginProps
* use text-align:left, update story
* proper js comment tag
* extend MenuInputType with NONE value
* update resourceActionButton story
* address review comments
* remove unused waitfor
* Convert autoupdate version handling to coreos/go-semver
* get the right version in installer endpoint + get rid of x/mod/semver
* depguard x/mod/semver
* Add nolint rules for existing x/mod/semver usages
* Add depguard explanation
* Do not try to send an empty MFA challenge in a desktop session
* Prevent a runtime error when neither a challenge nor a request is present
* Do not overwrite MFA errors with a custom message, show an error when the MFA dialog is closed
* Fix a test so that either a request or a challenge is passed
* Desktop Access -> Desktop access
* Reduce nesting
* Modulate install script when managed updates v2 are off
* fixup! Modulate install script when managed updates v2 are off
* Address Stephen's feedback
* Fix web terminal ssh session creation race
* Encapsulate references to terminal ssh session
This makes it easier to verify that the sshSession is only accessed
after it is ready.
* Closing a stream multiple times is now a no-op
* Create v2 endpoint that deletes integration with cleanup support
* Use v2 endpoint with unsupported check
* Option to pass around cleanup resource flag
* Add proxy version custom error if exist
* Address CRs
* Add support for HTTP 'Accept' header to '/webapi/auth/export' endpoint
Signed-off-by: Fred Heinecke <fred.heinecke@goteleport.com>
* Switch PR to use new `format` parameter
---------
Signed-off-by: Fred Heinecke <fred.heinecke@goteleport.com>
* Prevent creation of invalid App for AWS OIDC Integration
When enabling AWS Access using an integration, the final address will be
a concatenation of the integration name and the proxy's public address.
The proxy must present a certificate valid for that address.
However, when the integration name has a dot, it will usually not work
with the proxy's certificate.
We know it won't work for Teleport Cloud, where the certificates only
allow for `<app>.<tenant>.teleport.sh`.
So, for Teleport Cloud enabling AWS Access is not possible.
For self-hosted, a warning is emitted.
* prevent new aws oidc integrations with invalid DNS labels
* add integration name to error message
* improve readability of validation.IsDNS1035Label call
* Remove name parameter from proxy version getter
* Use autoupdate_agent_rollout as a source of version in scripts and integrations
* Fix tests
* Handle gracefully absence of a proxy in kube discovery sevrice
* Update lib/srv/discovery/kube_integration_watcher.go
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Address marco's feedback
* Address marco's feedback pt.2
* Gracefully handle if we can't get autoupdate version
* fixup! Update lib/srv/discovery/kube_integration_watcher.go
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
If an app is accessed via a bookmark or other means _without_ clicking
the "Launch" button in the web UI, we only have access to the fqdn and
try to resolve the app that way.
After resolution we then try to resolve the app names stored in the
required apps spec. This however relied on the clusterName in the
params.
If that isn't supplied, we can fallback to the cluster name in resolved
app spec instead.
Fixes https://github.com/gravitational/teleport/issues/51140
* Add discover resource preferences to user preferences
* Define hard coded guide id consts
* Set guide ids for resources
* Add test
* Address CRs
* Define a new type just for SelectResource.tsx which requires id field
* Check whether mfa is required for an app session through the correct cluster.
* Add clusterId param for isMfaRequired check in the web api.
* Fix connecting to leaf app directly with MFA.
* Add integration test.
* Add integration test.
* Remove redundant lib.SetInsecureDevMode calls when using testserver.SetupTrustedCluster.
* Reuse new test helpers.
* Focus fix down for apps.
This PR changes the Integration Status endpoint to include the pending
UserTasks for the integration.
This will be used by the frontend to show the number of pending tasks.
* fix superfluous response call for WS request
when there is a wrong configured proxy before Teleport
it fails to return a proper error during WebSocket connect operation
because of response.WriteHeader duplicate call
first call is happened in the websocket.Upgrader's `returnError` function after WS headers mismatch
and it only sets status to 400 Bad Request without any text
https://github.com/gorilla/websocket/blob/v1.5.3/server.go#L77
Teleport tries to set the response status but fails to do that:
http: superfluous response.WriteHeader call
and the main reason of the error (missing WS headers) is lost
* add explanation for disabling default WS error handler
Co-authored-by: Tiago Silva <tfsantossilva93@gmail.com>
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* fix gci
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Artem Nistratov <nistratov.artem@gmail.com>
Lisa Kim