* Adds AWS Role ARN to IC Integration settings
The Identity Center integration needs to be able to assume an AWS role
when using the ambient system credentials. This patch updates the IC
integration protobuf definition to include the role ARN, by refactoring
the settings block to replace the CredentialSource enumeration with a
`Credentials` type containing a `oneof` union of System and OIDC credential blocks.
The CredentalSource value is preserved for backwards compatibility with previous
Teleport releases.
This patch includes
- the updated protobuf message and generated types
- update tests, etc
- updated `tctl` to handle new plugin settings structure
Chagnges required to actually use this information are coming in a later PR.
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Rename role ARN
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Reorganize tctl commands to have commands not required auth client
* Replace auth client with lazy loading approach
* Fix linter warning
* Replace camel case in import alias
Replace logrus to use slog
* Rename close function
* Refactor plugin commands to use interface of auth client and plugin client
Code review changes
* Refactor workload identity commands
* Add access to global config for the commands
* Add test checking all tctl commands match process
* Fix golangci-lint warnings
* [entraid] store entra `appId` in plugin settings
This PR stores the Entra ID appID of the application used for SSO in Entra ID plugin settings.
This field filled in a best effort scenario and might be empty for old Entra Plugins.
Newly created plugins will make the field mandatory.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle code review comments
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
This PR adds a flag that disables Entra ID application setup. This aims customers that prefer to manually configure the applications and permissions instead of relying on `tctl` to automatically perform that.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
This PR fixes a bug where MFA for admin actions prevents creating
multiple objects during the entra id setup guide.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* [entraid] add setup script for offline clusters.
This PR adds a cli configuration for Entra ID where it's possible to default to system credentials instead of relying on OIDC for authentication in EntraID. OIDC is not always a possibility specially when the cluster is private and not internet acessible.
The UX is the following:
```text
Step 1: Run the Setup Script
1. Open **Azure Cloud Shell** (Bash) using **Google Chrome** or **Safari** for the best compatibility.
2. Upload the setup script using the **Upload** button in the Cloud Shell toolbar.
3. Once uploaded, execute the script by running the following command:
$ bash entraid.sh
**Important Considerations**:
- You must have **Azure privileged administrator permissions** to complete the integration.
- Ensure you're using the **Bash** environment in Cloud Shell.
- During the script execution, you'll be prompted to run 'az login' to authenticate with Azure. **Teleport** does not store or persist your credentials.
- **Mozilla Firefox** users may experience connectivity issues in Azure Cloud Shell; using Chrome or Safari is recommended.
Once the script completes, type 'continue' to proceed, 'exit' to quit: continue
Step 2: Input Tenant ID and Client ID
With the output of Step 1, please copy and paste the following information:
Enter the Tenant ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Enter the Client ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Successfully created EntraID plugin "name".
```
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* move function to api
* handle code review comments
* Apply suggestions from code review
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* fix url
* enable group claims
* add godoc
* handle code review comments
* fix gomod
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
Sakshyam Shah