* TLS routing connection upgrade using native websocket
* update ut in api
* lib/web/UT update
* fix typo, lint and race
* deal with subprotocol negotiation
* review comments round 1
* fix lint?
* add UT and address some other comments
* add env var to toggle mode
* fix lint
* Add hardware key settings to cluster auth preference.
* Parse HardwareKey auth settings from configuration file.
* Add GetRequireKnownSerialNumber method to AuthPrefence type.
* Add deprecation logic for authpref.PIVSlot, following the logic set out
in #16034.
* Address comments.
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
This PR fixes the name of the gRPC method
`StreamUnstructuredSessionEvents` from
`StreamUnstructuredSessionEventsServer` to the correct version. This
typo was introduced during the original review and was never detected
because clients implemented a fallback mechanism to old
`StreamSessionEvents` api.
This PR also partially reverts commit
386e63c584 so v15 clients can still
connect to v14 clusters.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Refactor MFA ceremony logic to avoid creating challenges when the client has no way to solve it.
* Add client-side ErrMFANotSupported for better MFA ceremony error handling.
* AWSOIDC: Compute Proxy's Endpoint for issuing a token
Instead of receiving the issuer URL as param, use the internal state of
the proxies to fetch the public endpoint.
This deprecates the field so that old clients can still talk to the
AuthServer, but their Issuer param is ignored.
* Add single param for cached resources
* use cache for everything except keystore
This PR icludes supporting changes for the implementation of SCIM provisioning
Teleport Enterprise.
This change includes:
* A protobuf description of the SCIM service, allowing generic resource CRUD
operations
* Generated files for same
* Internal abstractons for the SCIM GRPC service
* Hooks to allow Teleport Enterprise to override the default
"Not Implemented" GRPC service.
* fix: Do not attempt relogin on trace.BadParameterError
* Special case remote errors in IsErrorResolvableWithRelogin
* Do not wrap Recv EOF errors
* Fix various tests
* Use errors.Is to check for io.EOF
* Add mfa challenge extensions to proto file.
* Resolve comments; move new proto messages to separate proto file; nomenclature adjustments.
* Use gogoproto for mfa.proto to interface with authservice.proto.
* Ellaborate on ChallengeExtensions required field comment.
* split database CA into server/client CAs
* update migration logging
* include auth component in migrations
* debug log when skipping db client ca migration
* update tctl auth sign for cockroachdb
* update tctl auth sign for oracle
* set ExtKeyUsage for DB certs
* clientAuth for DB Client CA
* serverAuth for DB Server CA
* inject filter for pre-v14.3.1 clients
* inject a filter instead of dropping events in grpcserver
* add DatabaseClientCA type
* debug log when skipping filter injection
* update CA filter injection version check func name and doc
* Add RotateCertAuthority to gRPC TrustService.
* Add gRPC server implementation.
* Move RotateRequest type to api/types.
* Mark deprecated HTTP rotate endpoint for deletion.
* Add client implemenation and HTTP fallback.
* Support selecting db roles.
* add active roles in tsh db ls
* add select db role ut
* add a warning when connecting to older version
* review comments
* chnage slices import
* --db-roles to --db-role
* fix ut
* DynamicIdentityFileCreds should correctly provide TLS root CAs to ALPN handshake
* Fix bug involving multiple credentials
* Add test case covering CA Cert Pool
* Update api/client/credentials_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
This PR removes the fallback introduced in Teleport 13 to deal with
servers that do not support the new `UnstructureEvents` grpc service
introduced in Teleport 13.
Once Teleport 15 is released, we no longer need to maintain Teleport 12
so this code can be removed.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Add access lists, members, and reviews to cache.
Access lists, members, and reviews have been added to the cache. To do this,
I have created a simple backend that doesn't perform the validation that is
performed by the main access list backend and only implements a subset of
actions that are needed by the cache.
To support this, I've added in new gRPC methods:
ListAllAccessListMembers and ListAllAccessListReviews. These do not lock
any access lists and additionally do not perform any implicit or dynamic
members, but just simply return the full list of all members and reviews
so that these endpoints can be used to populate the cache.
The general thought here that, since the order of cache events cannot be
guaranteed, we'll rely on the auth server to perform the proper backend
validation and use a simplified backend that simply sees if the items
are present in the cache. If so, we'll return them.
I've had to update a few protos to support this. While I was here, I
fixed a bug in the access list gRPC client where the call tolist of reviews
was not supplying the access list name. Additionally, the user login
state generator will now use the cached access list values.
* Move simple backend to lib/services/simple
* Update to reflect new generic function signatures.
* Start sketching out BotService handler impl
* Allow bots to be created without roles
* Fix up tests
* Add warning about adding a role to the bot
* Improve resource type handling
* Update tool/tctl/common/bots_command.go
Co-authored-by: Tim Buckley <tim@goteleport.com>
* Fix godoc for client
* Explain ordering for bot resource application
* Record CreatedBy for bot users
* Don't display traits with zero length values
* Preserve json style output for `tctl bots add`
* Unbreak tests broken by CreatedBy changes
* Clarify deprecation/deletion
* Improve error message when no proxies
* An -> a
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Further clarify GoDoc
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Remove redundant case statements
* Remove unused import
* Use `slices`
---------
Co-authored-by: Tim Buckley <tim@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Revert "Restrict IGS flag check to usage based plans only (#35431)"
This reverts commit 31e1715532.
* Update test
* Pass access request monthly limit to webconfig
* Fix typo
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
The new `tsh latency` command allows visualizing latency to
resources in real time. Currently, supported is limited to SSH
instances, but may be extended to anything that implements a
`latency.Pinger` to support other protocols in the future.
* Add initial future assume role to access requests
* Add assume time on to tsh request show
* Update tool/tsh/common/tsh.go
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Rename assume-time to assume start time
* Fix tctl request assume-start-time to work when not set
* Add check to check request assumeStartTime is not far in the future
* Add example formats examples to assume-start-time flag
* Omit empty assum_start_time field when serializing access requests
* Update lib/auth/auth.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Rename MaxAssumeStartTime to MaxAssumeStartDuration
---------
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Add external upgrader version to proto message
* Inlcude upgrader version in metrics and inventory
* Include TELEPORT_EXT_UPGRADER_VERSION in deployment
* whitespace
* Include upgrader version in inventory ls
* Small docs change
* Use teleport-upgrade version if available
* Normalize version
* Address feedback
* Revert e
* Update lib/automaticupgrades/config.go
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legacy UpsertOIDCConnector RPC. This implements the RPC handler
and updates the signature of UpsertOIDCConnector to return the
upserted connector in the same manner that Create and Update do.
* Add team and igs flag to web config
* Use isTeam and igs flag in TeleportContext
* Update ButtonLockedFeature
* Update IntegrationTiles
* Update Sessions
* Update Support
* Fix grammar
* Add clarifying comment on isUsageBasedBilling flag
* Add product type to features and define feature limit helpers
* Add IGS check with access request monhtly verify
* Move limit getters to enterprise
* Simplify product type conversion
* Add clarifying comment
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legacy UpsertSAMLConnector RPC. This implements the RPC handler
and updates the signature of UpsertSAMLConnector to return the
upserted connector in the same manner that Create and Update do.
* fix: `tctl create` should not upsert EAS without -f
This commit adds a CreateDraftExternalAuditStorage RPC that will be used by
tctl when called without the -f flag, to avoid overwriting the current
draft without -f.
* update messaged
* remove draft prefix from message
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legeacy UpsertGithubConnector RPC. This implements the RPC handler
and updates the signature of UpsertGithubConnector to return the
upserted connector in the same manner that Create and Update do.
* Remove `Dialer(client.Config)` from Credential interface
* Re-add support for address-less configuration
* Only use profile address if none are explicitly provided
* Try all methods with credential provided address
* Fall back to address from credential
* Remove log message
* Adjust log message
* Spell explicitly correctly
* Formalize CredentialsWithDefaultAddrs interface
* GetDefaultAddrs -> DefaultAddrs
* Revert "Deprecate field AdvancedAccessWorkflows to AccessRequest.Enabled (#34792)"
This reverts commit 79d1a5d16e.
* Add IGS related fields to features and modules
* Boiler plate for enabling access monitoring through modules
* Add IGS related license fields
* Use access monitoring feature flag instead
* Fix test
* Add backwards comp without deprecating field
* Address CR
* Address CR
STeve (Xin) Huang