ListAppSessions was never added to the `auth.Cache` interface or
implemented by `cache.Cache` which means all session listing was
using the backend as the data source. This could cause backend
throttling if the number of sessions was large enough.
* split database CA into server/client CAs
* update migration logging
* include auth component in migrations
* debug log when skipping db client ca migration
* update tctl auth sign for cockroachdb
* update tctl auth sign for oracle
* set ExtKeyUsage for DB certs
* clientAuth for DB Client CA
* serverAuth for DB Server CA
* inject filter for pre-v14.3.1 clients
* inject a filter instead of dropping events in grpcserver
* add DatabaseClientCA type
* debug log when skipping filter injection
* update CA filter injection version check func name and doc
* fix WatchKind.Contains for ca filter
* add CA filter to caCollector
* require CA types in CA watcher config
* apply ca filter in EventsService parser
* Add access lists, members, and reviews to cache.
Access lists, members, and reviews have been added to the cache. To do this,
I have created a simple backend that doesn't perform the validation that is
performed by the main access list backend and only implements a subset of
actions that are needed by the cache.
To support this, I've added in new gRPC methods:
ListAllAccessListMembers and ListAllAccessListReviews. These do not lock
any access lists and additionally do not perform any implicit or dynamic
members, but just simply return the full list of all members and reviews
so that these endpoints can be used to populate the cache.
The general thought here that, since the order of cache events cannot be
guaranteed, we'll rely on the auth server to perform the proper backend
validation and use a simplified backend that simply sees if the items
are present in the cache. If so, we'll return them.
I've had to update a few protos to support this. While I was here, I
fixed a bug in the access list gRPC client where the call tolist of reviews
was not supplying the access list name. Additionally, the user login
state generator will now use the cached access list values.
* Move simple backend to lib/services/simple
* Update to reflect new generic function signatures.
Prefer the stdlib version of the experimental package.
Includes a depguard update to prevent future regressions,
as well as an e-ref update to appease depguard.
Generated with:
$ gofmt -w -r '"golang.org/x/exp/slices" -> "slices"' . && \
make fix-imports
* Discovery: Use Integration credentials for fetchers
* fix typos, improve docs, add clients.closer
* be explicit about using ambient or integration credentials
* remove integration assignment when using ambient credentials
* be explicit about using ambient credentials in db service
* fix cache key for region only sessions
* re-trigger license/cla check
* Add user login state original traits and indicator that original values set.
Original traits has been added to the user login state for use by a watcher in
the enterprise repo that will react to user access changes. This field will be
used to rebuild the last known good state when user access changes.
Additionally, an internal annotation that indicates the original role/trait
fields have been set in the user login state has been introduced so that the
watcher knows whether the user login state can be used by this watcher.
* GCI.
* Tweak tests.
* Further tweak tests.
* Formatting.
* Fix missing argument.
* Standardize delete comment.
Listing users is different from most existing list operations
because multiple resource types are stored under the users prefix.
Care was taken to ensure that these extra resources(passwords,
mfa devices, etc) do not cause lising to omit any users.
In addition to adding server and backend handling for create and
update roles, the services.Access interface was updated to return
a role from the existing Create/UpsertRole methods. Bumps the e
ref to incorporate the associated changes needed there to prevent
breaking the build.
The access lists and members have been removed from the cache. There's not
a lot of value having them in there and they create some uncomfortable
questions since members are dependent on access lists and the cache isn't
designed for dependent operations like this. By removing them we avoid a
lot of pain here.
* DiscoveryConfig: init service and add it to `tctl`
This PR starts the DiscoveryConfig service in gRPC server and allows
`tctl` to interact with those records.
It also adds access to the `editor` role.
Users should be able to RW any DiscoveryConfig.
DiscoveryService should be able to watch those resources, so that it can
act upon any changes.
* add revision
* add upsert method
* improve tctl -f command
* Update e ref
* Complete services.Users interface refactoring
Removes temporary functions required to migrate the interface
without breaking e.
Closes#32949.
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
* Start migrating services.Identity to use context and return users
Adds new variants of existing methods that are going to be updated
to support propagating context and return users from create, update
and upsert. This is an unfortunate step required because e utilizes
the interface for various functionality. In order to prevent breaking
builds, the temporary methods were added so that e can be converted
to them first, then oss can be updated to the new version of the
interface. Once that is done e will be converted and then the temp
methods will be removed.
* fix typos in comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix: don't set metadata on existing item in CAS
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix: gci
* fix: set resource id on update
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
Access Lists now have audit review recurrence presets. These allow users to
specify review frequencies of 1, 3, 6, or 12 months, and specify the 1st,
15th, or last days of the target month. Presets have been used for their
simplicity over other various recurrence definition mechanisms, as these
presets are much clearer than many of the other options.
* Fix Access List Members cache and eventing.
Two things were happening that were shadowing the Access List members cache
and eventing.
1. In the cache collections, the wrong reader was being assigned to the
lookup map. The correct reader was being used elsewhere, however, so the
caching tests appear to have still been working.
2. The watcher in lib/services/local/events.go apparently collapses prefixes
if they overlap. Prefix `access_list_members` is encompassed by
`access_list`, so the access list members prefix was eliminated from the
watcher. As a result, access list member events were being processed by
the access list parser, which resulted in non-critical warnings.
Local testing and dogfooding has yielded that this has had no apparent impact,
at least in situations without cache propagation. However, I've got a feeling
that this could affect situations with multiple auth servers.
While I'm here, I've eliminated the pointer-to-pointer logic in the access
list unmarshaling, which was excised elsewhere and should be excised here as
well.
* Use ExactKey, fix accessListMemberParser as well.
* Set revision on resources retrieved from the backend
Adds a new `MarshalOption` that ensures the resource revision is
set when unmarshalling a backend item. The new `WithRevision` option
was also applied everywhere that the legacy `WithResourceID` was
being used.
* Prevent storing resource revision in the backend item value
The revision follows the same semantics as the resource id for
marshalling. This prevents both items from showing up in the value
of the backend item, which can prevent compare and swap operations
from completing succesfully. Each backend is responsible for
persisting the revision in some manner.
The existing PreserveResourceID was reused to prevent having to
make multiple copies of a resource when clearing the id and revision.
The marshal option will be updated in a follow up when the resource
id is removed.
* Ignore revision in resource comparisons
* Remove use of require assertions inside Eventually calls
require.Eventually runs the predicate function in a background
goroutine. It is invalid to use require to make assertions
inside the eventually, because require will fail the test if the
assertion fails, and tests can only be failed from the test's
main goroutine.
* Use EventuallyWithT
* Add access list members to the cache.
Access list members have been added to the cache. To support this, the access
list member gRPC client methods have been implemented. A few extra gRPC
methods were added to the access list service. Additionally, a few changes
were made to the cache tests since the backend for the access list now
performs multiple backend calls.
* Further tuning of backend.
* Revert removal of access list members assignment.
* Update lib/cache/cache_test.go
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Remove debugging statements, tune legacy header conversion.
* Remove AccessListMembers reference, as it's no longer needed.
---------
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
* Adds a UnifiedResource watcher to the auth server. This watcher
will watch all the types that are displayed in the web UI and store
them in-memory to allow us to search/filter/query and get multiple
kinds returned at the same time.
[RFD](https://github.com/gravitational/teleport/pull/28162)
* Add ListUnifiedResources gRPC and web endpoints (#29661)
Adds the `ListUnifiedResources` grpc endpoint that returns paginated unified resources and exposes it in the web apiserver
* Fix test
* Add user login state to the cache.
The user login state has been added to the cache. This will allow user login
state lookups to be quickly looked up on login.
* Add in user login state service to attach to cache.
* Use fallback for user login state.
* Defer after checking branch, address new logger.
This PR removes `GetAppSessions` functions in favor of
`ListAppSessions`.
It also removed all the deprecated fields in the `DatabaseServerSpecV3`
message.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Resolved a memory aliasing issue flagged by gosec in the getAll function. The issue being reuse of the loop variable's memory address.
This commit fixes the issue by creating a unique variable per loop iteration, avoiding the aliasing.
* Add the AccessList to the cache.
The AccessList has been added into the cache. The AccessList resource
and its supporting resources had to be moved back into api for this so that
it can be properly referenced in api/client/events.go, which is necessary
for cache propagation.
* Address remaining lib/types references.
* Add in additional test to events_test.go.
* GCI.
* Add back in client wrapper so that the cache will work properly.
* Traits ToProto order is deterministic.
* Add in compile time access list client check.
* Support non-gogo objects for auth service events.
Auth service events will now support non-gogo objects. This was done by
generating the events and associated objects with regular go protobuf
instead of gogo and then correcting the code for the differences in
code generation.
* Correct lock copying in event protobuf.
* Temporarily ignore event.proto in buf breaking.
* Attempt to keep buf breaking from breaking.
* Remove comment.
* Rename gproto to googleproto.
* Rename api/client/proto import to authpb and googleproto to proto.
* Correct comment, add in test exercising proto.Equal.
* GCI.
* Events test actually does work.
* Add mapping between user groups and applications.
Within Okta, user groups can assign permission to many applications and
applications can belong to many user groups. This commit establishes that
mapping so that the Okta service can perform more user friendly access
requests by adding all applications from a user group to the access request
and additionally allowing application access requests to request associated
user groups as well.
* Adjust NewUserGroup to take a spec.
* Simplify Okta assignment statuses.
The Okta assignment statuses have been simplfieid so that there's only a
status on the Okta assignment object itself and the number of states is
reduced.
* Fix tests, remove unused code.
* Add in Duration for update statuses to prevent changing status too soon.
* Make sure LastTransition is UTC.
* Remove actions in favor of targets, make cleanup time non-nullable.
* Add CA, Role, Lock AuthPreference RO persmissions to RoleOkta.
RoleOkta now has read only access for CertAuthority, Role, Lock, and
ClusterAuthPreference objects so that it can utilize an authorizer when
redirecting apps.
* Remove lock from Okta cache, remove tasks*.go.
* Prevent tunneling if the os login doesn't exist
A user.Lookup was added to srv.RunForward to prevent dialing
and forwarding any data if the os login is not found. The check
alone only terminates the direct-tcpip ssh channel and not the
underlying ssh connection.
In order for the parent process to determine if the ssh connection
should be terminated it needs to know why the child exited. That was
not possible by looking at the exit code and any data written to
standard error of the child process was forwarded to standard error
on the parent; which was used to simply log the error and move on.
To pass more detailed errors to the parent, the child process spawned
by srv.RunForward now json marshals the trace.Error to standard
error which is then decoded by the parent process. If the parent
detects the error was due to a missing user it terminates the ssh
connection.
tsh ssh -N was also modified to terminate if the command context
of tsh OR the ssh connection to the node is closes. Prior, it
only terminated if the user cancelled the process by blocking on
ctx.Done(). While this was necessary to end session if the os
login does not exit, it also forces tsh to exit if the node
goes offline.
Note: This does not include any propagation of error messages to the user,
so there won't be any indication from tsh about why the connection was closed.
The session also will not be terminated until the first attempt to forward data and
NOT when the session is created due to the way -N is implemented.
Fixes#217
* Prevent unauthorized access to kube clusters by upserting kube_servers
This PR changes the behavior of the kubernetes_service when validating access
to kubernetes clusters. Previously, the kubernetes_service would use the first
kubernetes cluster it found in the Auth server backend to validate access. This was
problematic because if the first kubernetes cluster was upserted with a
the same name as a kubernetes cluster the user was trying to access but
with different labels, the user would be able to access the cluster even
though they shouldn't be able to.
This PR changes the behavior of the kubernetes_service to use the
in memory kubernetes cluster representation used for heartbeats
instead of relying on the information received from the auth server. This would
block the user from accessing the cluster if the cluster was upserted
with a different set of labels since the kubernetes_service would not
have the updated labels in memory and would deny access.
Fixes#469
---------
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Allow Okta service reverse tunnel access.
In order to allow the Okta service to be connectable via the reverse
tunnel, the following things were added.
* The cache has permissions to retrieve cluster configuration objects.
While here, I removed access to the App objects, which was not necessary.
* The permissions have been updated to allow for AppServer access and
ClusterNetworkingConfig access.
* The cache has been updated to cache app servers and cluster networking
configuration resources. While here, access to App objects has been
removed.
* The reverse tunnel now recognizes the Okta role.
* Add in ListResources to the Okta access point.
* Remove access to apps and to access requests.
* Add in Semaphore read/write permission.
* Include cache entry for app server. Remove read access for access request.
* Refactor UserGroups local service to use generic service.
The UserGroups local service now uses the generic service. This came about
due to a bug in the pagination logic for the user group listing. This fixes
that issue and simplifies the user group service logic.
* Turn *Svc vars into *Cache vars to make things uniform.
rosstimothy