* Changes to Discord plugin for running in hosted mode.
Includes:
* Moves Default API URL setting into Sidcord config
CheckAndSetDefaults()
* Only creates a Teleport client is one is not supplied during
plugin construction.
* Optional hosted-plugin status updates
* fmt
Improves reliability of the test by eliminating the reliance of
connection states being received in the expected order. Instead all
states are sorted and compared with the expected states.
Fixes#30535
* Begin separating access list members from access list resources.
Access list members are currently part of access list resources, and this can
result in access list resources that are larger than 400KB, making them
unsuitable for use by dynamo. This commit begins the process of extracting
the members from the access list resources.
The existing access list members field on the access list messages and
internal object have been left during this migration so as not to cause any
build breakages, but will be removed once the rest of the boilerplate is
in place.
* Correct spelling.
* GCI.
* Restore members in access list spec in tests/conversion to maintain compatibility during migration.
* Generate user login state from access lists and integrate into certificates.
On login, the user login state will be generated, using access lists to
register additional roles and traits that will be inserted into the user's
certificate.
Tests have been added to exercise this as well.
* Cache user login states, filter roles that aren't in the backend.
* Small refactor.
* Optimize RPC calls, test merge login in auth.go more thoroughly.
* Warn when role is missing.
* Update so access info uses the user login state directly, user login state comprises the whole state as opposed to a mix.
* Logic tweaks to restore tests.
* Integrate user login state cache.
* Swap out get user for get user state where applicable.
* Revert unrelated debug change.
* Add in missing err check.
* Further replacing with user state.
* Revert changes to helpers to try to get integration tests working.
* Revert "Revert changes to helpers to try to get integration tests working."
This reverts commit 682e92064b.
* Add in user type to generator.
* Use supplied user for generating SSH certs.
* Add access request monthly limit to Features
* Add a method to retrieve usage of Access Requests
* Verify access request limit when creating
* Remove AccessRequestsFeature.Enabled
Feature is always enabled now, the flag serves no purpose
* Expose usage of access requests in auth server
* Reimplement access request usage using audit log
* Disallow unauthenticated access to resource usage
* Tidy proto structures
* Start enforcing access request limit in auth
* Run GCI
* Add a license header to usage_test.go
* Add missing godoc
* Restructure usage proto per PR comments
* Construct proto.AccessRequestUsage in getARMU
* Reduce log level when encountering an unexpected event
* Simplify return
* Add godoc to GetResourcesUsage in client
* Fix merge mess-ups
* Count all requests, no matter their review state
* Factor out GetAccessRequestMonthlyUsage
* Move out resource usage to its own service
* Validate the limit after dry run is done
Unbreak UI when the limit is up
* Fix imports
* Remove Limit
SearchEvents will default to defaults.EventsIterationLimit
* Rename the service proto
* Add godocs to the gRPC service
* Move resource usage to a dedicated package
* Define single GetUsage rpc for all resource types
* Additions for limited access requests UI rework
* Add a test for GetAccessRequestMonthlyUsage
* Address lint
* Run GCI
* Add licenses where missing
* Expect CTA_UNSPEICIFED rather than `undefined`
* Expect CTA_UNSPECIFIED instead of undefined
* Update resourceKind method to return slice
* Add UnifiedResourceComponent
* Add unifiedResourceWatcher to auth server
* Init unified resource watcher
* Convert to strings for error output
* Add license
* Add some tests
* Fix a race condition and properly close the watcher
* add defer
* Add kubes to watcher
* Add uninit check
* Notify if stale
* Add SAML to watcher
* Update test and fix lint
* Fix license
* Add godocs
* Add Kind to ui structs
* Add FakePaginateParams
* Update ListUnifiedResources proto messages
* Update uses of FakePaginate
* Include type in seenmap for MatchResourceByFilters
* Update TestAuthServer with unified resource watcher
* CheckAndSetDefaults for ListUnifiedResourcesRequest
* Add ListUnifiedResources rpc
* Update protos
* Add test
* Add docs and update tests
* Add more docs
* Combine app types in switch
* Fix tests
* Add kube access checker
* Add remaining kinds
* Add a Unified Resource card component
* Lint fixes
* WIP: Unified Resource list
* Review feedback
* Add configurable queuesize to NewWatcher
* Move Get to collector
* Review comments
* Rename AgentKind and fix lint issues
* make unified resource cache public
* Move to common interface
* Use copy as value
* Move saml getter
* Review comments
* WIP: infinite scrolling
* Prevent VS Code from showing errors in tsconfig
If tsconfig doesn't have an `outDir` option set, VS Code shows multitude of errors of the following kind:
```
Cannot write file '/Users/bartosz/code/teleport/e/web/teleport/babel.config.js' because it would overwrite input file.
```
* Remove unnecessary files
* todo
* Cleanup
* Add license
* invert watcher and cache
* Fix imports
* Fix lint: check for err
* Add Kind to ui structs
* Add FakePaginateParams
* Update ListUnifiedResources proto messages
* Update uses of FakePaginate
* Include type in seenmap for MatchResourceByFilters
* Update TestAuthServer with unified resource watcher
* CheckAndSetDefaults for ListUnifiedResourcesRequest
* Add ListUnifiedResources rpc
* Update protos
* Add test
* Add docs and update tests
* Add more docs
* Combine app types in switch
* Fix tests
* Add kube access checker
* Add remaining kinds
* use cache instead of watcher
* review round 1
* Update test
* Review, fixing broken tests
* Add copy to get
* Add a search panel to the unified resources list
* Add CloneAny interface to help with unified resource cloning
* Use cloneany
* Add sort for name and kind
* Add app and saml, fix tests
* Review
* Review
* Lint
* Watch kube server instead of cluster
* Watch kube server instead of cluster
* Get kubecluster from server
* update proto file
* Add no access test case
* Review, fix CI problems
* One more lint fix
* Yet another lint fix
* move sorting
* Fix sorting by name
* Review feedback round 2
* Remove unneeded bk return
* Keep grpc naming convention
* Add missing docs
* defer log
* WIP: filter and sort
* Make sorting work
* Make filters (almost) work
* Fix the filters
* Fix filter history handling and kind-based sorting
* Visual tweaks
* lint and test fixes
* Add licenses
* Review
* Fix the useEffect dependency list
* Review feedback
* Adds a UnifiedResource watcher to the auth server. This watcher
will watch all the types that are displayed in the web UI and store
them in-memory to allow us to search/filter/query and get multiple
kinds returned at the same time.
[RFD](https://github.com/gravitational/teleport/pull/28162)
* Add ListUnifiedResources gRPC and web endpoints (#29661)
Adds the `ListUnifiedResources` grpc endpoint that returns paginated unified resources and exposes it in the web apiserver
* Fix tests
---------
Co-authored-by: Michael Myers <michael.myers@goteleport.com>
* Alias `api/types/webauthn` imports to `wanpb`
* Use `webauthnpb` as the default package name
* Move messages.go to webauthntypes/
* Move extensions.go to webauthntypes/
* Move proto.go to webauthntypes/
* nit: Use consistent license style
* Use the `wantypes` alias for webauthntypes
* Use the `wanwin` alias for webauthnwin
* nit: Move winwebauthn.go to webauthnwin.go
* Document package webauthntypes
* Alias types required by e/
* Appease linter
* Add all main types/method to compat.go
* Reinstate spaces on proxy_test.go
* Alias newly-added usages
* Adds a UnifiedResource watcher to the auth server. This watcher
will watch all the types that are displayed in the web UI and store
them in-memory to allow us to search/filter/query and get multiple
kinds returned at the same time.
[RFD](https://github.com/gravitational/teleport/pull/28162)
* Add ListUnifiedResources gRPC and web endpoints (#29661)
Adds the `ListUnifiedResources` grpc endpoint that returns paginated unified resources and exposes it in the web apiserver
* Fix test
This PR adds a new install method (`awsoidc_deployservice`) to agent
metadata events that are sent to posthog in tp.agent.metadata event.
The task definition was changed to include a new env var that indicates
this installation method.
* url checker
* add ut
* add comment in test plan
* warnOnError only when err is not nil
* fix typos etc.
* enable metadata service permission for discovered databases
* add a debug log when azure db url is validated
* EC2 Instance Connect Endpoint: List EC2 Instances
We must list the EC2 instances to the user, so they can pick one and
then add them as a Node.
This PR adds EC2 Instance Listing.
To do this, we convert the EC2 Instance into Teleport Server with a
special subkind: SubKindOpenSSHEC2InstanceConnectEndpointNode
This is similar to the ListDatabases endpoint.
* review pt1
* fix const and add test
* use any instead of interface{}
* add option to force re-authentication for OIDC connectors
* expose max_age directly
* update comment for MaxAge, regen operator manifests to make linter happy
* make max_age nullable
* make max_age a duration
* use google.protobuf.Duration
* Revert "use google.protobuf.Duration"
This reverts commit e6c3b7deaf9ffebb33492e3b6e575289e3ad1c37.
* make it more clear that max age is a full duration
* document how MaxAge duration is represented
* rebuild operator manifests
* Add in the access list tctl command.
The access list (acl) command has been added into tctl, which will allow
for the management of access lists from tctl. Access lists can be created
and deleted by administrators as well.
Additionally, a bug with the access list wrapper client was corrected where
the access list was not being properly added into the upsert access list
request. A final proto nil check was added into access list's FromProto
to ensure that there's no potential panics here.
* GCI.
* Use slices, tweak function names.
* Use paginated list instead of list.
* Correct the user-name flag, correct typo.
* Revert back to expires.
* Add user login state to the cache.
The user login state has been added to the cache. This will allow user login
state lookups to be quickly looked up on login.
* Add in user login state service to attach to cache.
* Use fallback for user login state.
* Defer after checking branch, address new logger.
In preparation for v14 we can remove support for SSH connections
to the Proxy from the `api/proxy.Client` since all supported instances
should all be serving the TransportService.
* EC2 Instance Connect Endpoint: HTTP endpoint to create Nodes
When the user receives a list of EC2 instances, they must be able to
pick one and add it to the cluster.
To do so, we must provide an API that accepts the node information and
adds it to the backend.
Only Nodes of type SubKindOpenSSHEC2InstanceConnectEndpointNode are
allowed.
Other nodes have their own join method which is not part of the HTTP
API.
* review pt1
* rename subkind
* fix import order
This PR removes `GetAppSessions` functions in favor of
`ListAppSessions`.
It also removed all the deprecated fields in the `DatabaseServerSpecV3`
message.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
stringify & remove the jwt values when asked
Plumb up the file configuration
Add a test for jwt token rewriting
resolve comments
Use string instead of enum
This PR removes from the Teleport codebase the following deprecated
code:
- Kubernetes Secret storage compatibility layer: This piece of code was
introduced in Teleport 11 to help users migrating from on-disk
credentials storage to Kubernetes secret storage. Since then, all
users should already migrated to Kube secret storage and it's no
longer needed.
- Expected `no kubernetes_users/kubernetes_groups` error message:
The error message changed in Teleport 13 and was left for compatiblity
reasons since Auth server supported `kubernetes_services` running
`v12.x.x`.
- References to `kube.` SNI prefix for Kube access
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
A paginated access list endpoint has been added. As access lists can be
large objects, the risk of crafting responses that are too large is much
higher than other objects. Pagination will help mitigate this.
* Add initial auto approval flow for opsgenie plugin
* Fix logging fields in opsgneie plugin
* Add context to opsgenie config
* Use systemAccessApprover user in opsgenie plugin
* Rename error used by opsgneie plugin to denote missing annotations
* Fix grammer in comments for opsgenie plugin
* Remove embeded baseapp from opsgenie plugin
* Add error message for missing annotations
* Remove ctx from opsgenie config stuct
* Change warning log in opsgneie plugin to be clearer
* Add config tests to opsgenie plugin
* Add remaining opsgenie tests and minor fixes
* Fix broken tests for opsgneie plugin and add missing one
* Remove unused code from opsgenie tests
* Changes to the Jira plugin required to run as a hosted integration
Includes:
* Jira plugin settings types
* The ability to optionally enable the Jira Webhook server (so
that it can be left disabled when run as a hosted plugin)
* Only creating a GRPC Teleport client if no client is provided
from configuretion
* Optional status reporting via plugin StatusSink
* Fix test failure
* Switch default behaviour to running the webhook receiver
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove Username, rename Project in Jira settings
* Comment update
* Lint & US-ify spelling
* USify spelling
* Update plugin.go
* Tests
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
It was required for compatibilty reasons - v13 proxy could connect to v12 agents,
which didn't support signed PROXY headers. But we don't need it in v14.
* "Add authorization rules to the Assistant and UserPreferences service"
This commit introduces authorization rules into the Assistant service to restrict operations based on the authenticated user's role permissions.
Now each method in the Assistant service checks if the authenticated user has necessary permissions to perform the requested operation. The permissions are checked via defined RBAC rules.
A user requires specific permissions to perform various operations such as creating a conversation, updating a conversation, fetching a user's conversations, deleting a conversation, and adding a message to a conversation.
Also, even if a user has necessary permissions, they cannot perform operations for a different user. Each user can only access their own data.
* Add missing logger
* "Refactor user preferences request handling"
This commit refactors how GetUserPreferences and UpsertUserPreferences handle requests.
The `username` field is removed from request parameters. Instead of having the client send the user's username in a request, the server now automatically uses the username of the authenticated user making the request.
This change improves the security by preventing a user from attempting to fetch or manipulate another user's preferences. Removed tests were specifically testing the old, insecure behavior.
* Refactor to use authz.HasBuiltinRole
Refactored code in the 'auth_with_roles.go' file to use 'authz.HasBuiltinRole' instead of 'HasBuiltinRole'. This change is in line with recommended practices for deprecation and makes the code more standard and easier to manage. The original 'HasBuiltinRole' function is marked as deprecated and will be removed in future once 'teleport.e' is updated to use 'authz.HasBuiltinRole'.
* Reserve removed username again?
* Fix UT
* Add local user permissions checks in authz
This commit introduces two new methods in permissions.go to check if a user is a local user, and if a given action is performed by a local user. These permission checks are then used to replace existing checks in service.go, when performing actions like creating conversation, updating, listing, etc. This simplifies checks and provides a more consolidated and unified method for verifying user actions.
* Fix tests
* Tweak RBAC
* Address review comments
* Separate client and server interfaces for user preference services.
* Apply core review suggestions
* Apply suggestions from code review
Co-authored-by: Brian Joerger <bjoerger@goteleport.com>
---------
Co-authored-by: joerger <bjoerger@goteleport.com>
* use enum to describe the IAMPolicyStatus instead of a bool
Allows distinguishing between two falsey values between
"has policy been checked" vs "policy is not valid" and
backwards compatibility.
* Address CR
* Fix lint
* Represent the entirety of protocol within lib/auth/webauthn
* Bump github.com/go-webauthn/webauthn to v0.6.2
* Fixes for v0.6.x: Challenge, RPOrigins
* Bump github.com/go-webauthn/webauthn to v0.7.2
* Document new v0.7.2 fields
* Bump github.com/go-webauthn/webauthn to v0.8.2
* Fixes for v0.8.x: UserEntity.ID
* Bump github.com/go-webauthn/webauthn to v0.8.6
* Let bots update go-webauthn
* Drop support for RP and User icon
* Update generated protos
* Add a brief godoc to cloned types
* Add a way to construct Teleport app from Kubernetes service
* Address review comments
* Log errors of kube apps discovery instead of returning error
Returning error would prevent other non-errored apps to be discovered.
* Move automatic protocol checking out of services package
* Add annotation for overriding app name
* Return error in case of invalid label key
* Change value for discovery name annotation
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Use local service name even for external services
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Marek Smoliński