* TLS routing connection upgrade using native websocket
* update ut in api
* lib/web/UT update
* fix typo, lint and race
* deal with subprotocol negotiation
* review comments round 1
* fix lint?
* add UT and address some other comments
* add env var to toggle mode
* fix lint
* Add support for hardware key serial number attestation through user
trait.
* Modify AttestHardwareKey interface to return full attestation data
* Add serial number to attestation data and verify it
* Add unit test.
* Address comments.
* Don't accept partial matches.
* Fix build and test errors.
* feat: add preset field to SAMLIdPServiceProviderSpecV1
* add samlsp package to define preset types, validate preset names"
* check empty string in validatePreset func
* run make fix-imports
* Add hardware key settings to cluster auth preference.
* Parse HardwareKey auth settings from configuration file.
* Add GetRequireKnownSerialNumber method to AuthPrefence type.
* Add deprecation logic for authpref.PIVSlot, following the logic set out
in #16034.
* Address comments.
It controls whether to enable Kubernetes App discovery in the discovered Kuberentes clusters.
Currently only EKS in integration mode will be supported.
* Add DatabasePermissions field to role.
* Change error wording in a minor way
* Update api/types/role.go
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Update autogenerated files
* Guard against wildcards in `spec.allow.db_permissions`
---------
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* chore: Bump golangci-lint to v1.56.0
* Use only enable linters for testifylint
* Fix various testifylint offenders
* Fix testifylint offenders in api/
This PR adds a new gRPC Service to handle the AWS OIDC Integration
actions.
All the HTTP exposed actions will use this new service.
Eg, list databases, list ec2 instances, and so on
This PR adds the new service and a placeholder for the first action to
me refactored: ListDatabases.
This action is not used/implemented yet.
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Verify that intercepted stream Sends wrap io.EOF
* fix: Do not wrap io.EOF intercepted by stream Sends
* Use a helper func, fix duplicate Send/Recv calls
* Fix typo
This PR fixes the name of the gRPC method
`StreamUnstructuredSessionEvents` from
`StreamUnstructuredSessionEventsServer` to the correct version. This
typo was introduced during the original review and was never detected
because clients implemented a fallback mechanism to old
`StreamSessionEvents` api.
This PR also partially reverts commit
386e63c584 so v15 clients can still
connect to v14 clusters.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Refactor MFA ceremony logic to avoid creating challenges when the client has no way to solve it.
* Add client-side ErrMFANotSupported for better MFA ceremony error handling.
* AWSOIDC: Compute Proxy's Endpoint for issuing a token
Instead of receiving the issuer URL as param, use the internal state of
the proxies to fetch the public endpoint.
This deprecates the field so that old clients can still talk to the
AuthServer, but their Issuer param is ignored.
* Add single param for cached resources
* use cache for everything except keystore
* Add group and app filters for the Okta access list sync.
Group and app filters for the Okta access list sync feature have been added
to the plugin settings and to the service settings.
* Correct group filters comment.
* Return offending filter on failure.
* Add in examples for filters.
* Reuse MFA for tctl bots add.
* Fix MFA required check for admin role.
* Remove broken auth preference check; Fix IsMFARequiredCheck for built in Admin role.
* Check for nil MFA response in MFA retry logic.
* Refactor MFA ceremony to return a custom error when MFA is not required.
* Fix TestAdminActionMFA unit tests.
* Fix unit test.
* Only enforce admin MFA when webauthn is required.
* Add TELEPORT_UNSTABLE_DISABLE_MFA_ADMIN_ACTIONS env flag for an emergency escape hatch.
* Fix TestAdminActionMFA unit tests.
* Remove account lockout from failed recovery attempts
This account lockout looks to be unecessary and potentially problematic. Recovery codes and recovery through MFA are not possible to brute force.
In addition the potential to lockout an account from being able to use a recovery method could result in them being unable to unlock their account from other potential abuse cases (for example an attacker locking the account from failed password attempts).
As discussed in the RFD (https://github.com/gravitational/teleport/pull/35533) this includes the removal of all the API used for this locking mechanism.
* accountrecovery: Update `WithLock` function names
* accountrecovery: Combine verifyRecoveryCode and verifyRecoveryCodeWithRecord into one function
* Further GRPC cleanup after PR feedback
* Apply PR Feedback
This PR icludes supporting changes for the implementation of SCIM provisioning
Teleport Enterprise.
This change includes:
* A protobuf description of the SCIM service, allowing generic resource CRUD
operations
* Generated files for same
* Internal abstractons for the SCIM GRPC service
* Hooks to allow Teleport Enterprise to override the default
"Not Implemented" GRPC service.
* Refactor MFA prompt logic for the API client to enable various MFA
ceremony use cases.
* Address comments.
* Prompt for MFA before creating a user with tctl.
* Check if AdminActionMFA is enforced before attempting to create an MFA auth challenge.
STeve (Xin) Huang