* Adds a UnifiedResource watcher to the auth server. This watcher
will watch all the types that are displayed in the web UI and store
them in-memory to allow us to search/filter/query and get multiple
kinds returned at the same time.
[RFD](https://github.com/gravitational/teleport/pull/28162)
* Add ListUnifiedResources gRPC and web endpoints (#29661)
Adds the `ListUnifiedResources` grpc endpoint that returns paginated unified resources and exposes it in the web apiserver
* Fix test
* Add user login state to the cache.
The user login state has been added to the cache. This will allow user login
state lookups to be quickly looked up on login.
* Add in user login state service to attach to cache.
* Use fallback for user login state.
* Defer after checking branch, address new logger.
This PR removes `GetAppSessions` functions in favor of
`ListAppSessions`.
It also removed all the deprecated fields in the `DatabaseServerSpecV3`
message.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Resolved a memory aliasing issue flagged by gosec in the getAll function. The issue being reuse of the loop variable's memory address.
This commit fixes the issue by creating a unique variable per loop iteration, avoiding the aliasing.
* Add the AccessList to the cache.
The AccessList has been added into the cache. The AccessList resource
and its supporting resources had to be moved back into api for this so that
it can be properly referenced in api/client/events.go, which is necessary
for cache propagation.
* Address remaining lib/types references.
* Add in additional test to events_test.go.
* GCI.
* Add back in client wrapper so that the cache will work properly.
* Traits ToProto order is deterministic.
* Add in compile time access list client check.
* Support non-gogo objects for auth service events.
Auth service events will now support non-gogo objects. This was done by
generating the events and associated objects with regular go protobuf
instead of gogo and then correcting the code for the differences in
code generation.
* Correct lock copying in event protobuf.
* Temporarily ignore event.proto in buf breaking.
* Attempt to keep buf breaking from breaking.
* Remove comment.
* Rename gproto to googleproto.
* Rename api/client/proto import to authpb and googleproto to proto.
* Correct comment, add in test exercising proto.Equal.
* GCI.
* Events test actually does work.
* Add mapping between user groups and applications.
Within Okta, user groups can assign permission to many applications and
applications can belong to many user groups. This commit establishes that
mapping so that the Okta service can perform more user friendly access
requests by adding all applications from a user group to the access request
and additionally allowing application access requests to request associated
user groups as well.
* Adjust NewUserGroup to take a spec.
* Simplify Okta assignment statuses.
The Okta assignment statuses have been simplfieid so that there's only a
status on the Okta assignment object itself and the number of states is
reduced.
* Fix tests, remove unused code.
* Add in Duration for update statuses to prevent changing status too soon.
* Make sure LastTransition is UTC.
* Remove actions in favor of targets, make cleanup time non-nullable.
* Add CA, Role, Lock AuthPreference RO persmissions to RoleOkta.
RoleOkta now has read only access for CertAuthority, Role, Lock, and
ClusterAuthPreference objects so that it can utilize an authorizer when
redirecting apps.
* Remove lock from Okta cache, remove tasks*.go.
* Prevent tunneling if the os login doesn't exist
A user.Lookup was added to srv.RunForward to prevent dialing
and forwarding any data if the os login is not found. The check
alone only terminates the direct-tcpip ssh channel and not the
underlying ssh connection.
In order for the parent process to determine if the ssh connection
should be terminated it needs to know why the child exited. That was
not possible by looking at the exit code and any data written to
standard error of the child process was forwarded to standard error
on the parent; which was used to simply log the error and move on.
To pass more detailed errors to the parent, the child process spawned
by srv.RunForward now json marshals the trace.Error to standard
error which is then decoded by the parent process. If the parent
detects the error was due to a missing user it terminates the ssh
connection.
tsh ssh -N was also modified to terminate if the command context
of tsh OR the ssh connection to the node is closes. Prior, it
only terminated if the user cancelled the process by blocking on
ctx.Done(). While this was necessary to end session if the os
login does not exit, it also forces tsh to exit if the node
goes offline.
Note: This does not include any propagation of error messages to the user,
so there won't be any indication from tsh about why the connection was closed.
The session also will not be terminated until the first attempt to forward data and
NOT when the session is created due to the way -N is implemented.
Fixes#217
* Prevent unauthorized access to kube clusters by upserting kube_servers
This PR changes the behavior of the kubernetes_service when validating access
to kubernetes clusters. Previously, the kubernetes_service would use the first
kubernetes cluster it found in the Auth server backend to validate access. This was
problematic because if the first kubernetes cluster was upserted with a
the same name as a kubernetes cluster the user was trying to access but
with different labels, the user would be able to access the cluster even
though they shouldn't be able to.
This PR changes the behavior of the kubernetes_service to use the
in memory kubernetes cluster representation used for heartbeats
instead of relying on the information received from the auth server. This would
block the user from accessing the cluster if the cluster was upserted
with a different set of labels since the kubernetes_service would not
have the updated labels in memory and would deny access.
Fixes#469
---------
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Allow Okta service reverse tunnel access.
In order to allow the Okta service to be connectable via the reverse
tunnel, the following things were added.
* The cache has permissions to retrieve cluster configuration objects.
While here, I removed access to the App objects, which was not necessary.
* The permissions have been updated to allow for AppServer access and
ClusterNetworkingConfig access.
* The cache has been updated to cache app servers and cluster networking
configuration resources. While here, access to App objects has been
removed.
* The reverse tunnel now recognizes the Okta role.
* Add in ListResources to the Okta access point.
* Remove access to apps and to access requests.
* Add in Semaphore read/write permission.
* Include cache entry for app server. Remove read access for access request.
* Refactor UserGroups local service to use generic service.
The UserGroups local service now uses the generic service. This came about
due to a bug in the pagination logic for the user group listing. This fixes
that issue and simplifies the user group service logic.
* Turn *Svc vars into *Cache vars to make things uniform.
* Add application RW permissions to the Okta role.
Application read/write permissions have been added to the Okta role along with
modifications to the cache and to the OktaAccessPoint to support application
object management.
* Add in app label wildcards.
* Introduce Okta objects into the cache.
The OktaImportRule and the OktaAssignment objects have been added into the
cache. This takes a slightly different take than has been done previously
because the Okta service lives outside of the `auth.ClientI` interface.
However, the additions are pretty straightforward.
* Export NewLocalCache for enterprise.
* Add the Okta services into , fix missing events for the Okta resources.
* Re-add err check for Okta client.
* Add in comment clarifying the usage of access requests in the Okta service cache.
* Add in user groups to Okta cache.
Adds `UpsertCertAuthority` to the `teleport.v1.trust.TrustService`
and deprecates the HTTP api. The `services.Trust` interface was
also updated to include a `context.Context` in both
`CreateCertAuthority` and `UpsertCertAuthority.
To ensure backwards compatibility the `auth.Client` will first
attempt to use the gRPC client and if that fails with a not
implemented error it will fallback to using HTTP.
Part of #6394
Adds `DeleteCertAuthority` to the trust grpc service and deprecates
the legacy HTTP api. Additionally the `DeleteCertAuthority` method
in the `services.Trust` interface now takes a `context.Context` as
the first parameter. In order to plumb the context through from all
the call sites `DeleteRemoteCluster` from `services.Presence` was
also modified to take a `context.Context` as the first parameter.
Adds a new `GetCertAuthorities` unary RPC to
`teleport.v1.trust.TrustService` and deprecates the equivalent
HTTP endpoint. All associated interfaces have been updated to remove
the marshal options as well.
The locks were not being properly upserted to the cache after the collections
refactor. This was due to a typo when writing the `upsert` logic for the locks
collection.
This PR removes the `types.KindKubeService` objects that were
deprecated in Teleport 11.
Teleport 12 removed the double heartbeat and for Teleport 13 we can
safely drop the support of the old hearbeat based on `types.Server`
objects.
Clients older than Teleport 12 connecting to a Teleport 13 server will
fail since they cannot heartbeat using the old mechanism.
The HTTP client created by `auth.NewClient` has an idle timeout of
30s and each instance periodically gets cert authorities in
`TeleportProcess.syncRotationStateCycle`. If there has been no
activity when the ticker expires then the request will result in a
brand new connection to Auth to be established. This can cause a
spikes in open file descriptors on the Proxy when there are a large
number of instances connected via a tunnel.
To prevent periodic dialing when retrieving cert authorities the
endpoint has been migrated to the new Trust gRPC service. For now
only the get endpoint has been migrated but the rest of the CRUD
operations for cert authorities should be migrated from the HTTP
api to the gRPC service as well.
Most of the cache collections had an extremely similar structure. Where
possible, the cache collections have been adjusted to make use of common
functions to minimize the amount of duplication within the cache collections.
All network I/O should be done in the cache collection fetch and
not the appy function returned from fetch. This moves the
`ListResources` request for database services out of the apply
function to be compliant with the collection requirements.
* Add UiConfig option to proxy service config
* Add uiConfig to GRV_CONFIG window object and use in terminal constructor
* Update configuration reference docs
* Remove extra structs and change property to scrollbackLines
* Update web/packages/teleport/src/config.ts
Co-authored-by: Jeff Pihach <hatched@users.noreply.github.com>
* Use a common struct and apply in applyProxyConfig
* Remove webclient dependency for fileconf
* Add missing doc comments
* Set individual properties of cfg.Proxy.UI
* Remove unneeded comment
* Add nolint rule
* Fix nolint
* Add test for UIConfig
* Cleanup tests
* Fix TestUIConfig context
* Allow dynamic config for web ui (#22097)
* Update protofiles
---------
Co-authored-by: Jeff Pihach <hatched@users.noreply.github.com>
* Simplify the cache tests.
Several of the cache tests had a very similar structure. Where possible, these
have been adjusted such that all tests with similar structures use a generic
testing function that executes the same logic on each resource type.
* Re-add t.Parallel() for namespaces.
* Create a generic local backend service.
Many of the local backend services have a very similar pattern in terms of how
objects are retrieved and stored. This PR introduces a generic backend which
implements backend retrieval and storage of objects and migrates the SAML
IdP service provider service to it. More services could easily be migrated
to this generic service implementation.
* Feedback, add in generic tests.
* Tim's feedback, added in a test for updating a resource that doesn't exist.
* Tim's feedback.
* Apply suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Edoardo's feedback.
* Added in UpdateAndSwap.
* Edoardo's feedback, Tim's feedback.
* Use a default page size if the page limit is not specified.
* More of Edoardo's feedback.
* Propagate error instead of panic.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* SAML IdP sessions added to the API and cache.
SAML IdP sessions have now been added to the API and to the cache.
* Update lib/auth/sessions.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Revert changes to types.proto.
* Fix missing session ID, misnamed variable, gRPC update.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Extract entity ID when creating SAML service provider.
The entity ID will be parsed from the entity descriptor metadata when the
service provider's entity descriptor is set. The motivation of this PR is to
do the following:
* Extract the entity ID from the entity descriptor during the creation of the
SAML IdP service provider.
* Prevent the creation of service providers in the backend that have an
entity ID that does not match the entity ID represented in the entity
descriptor.
* When reading or listing service providers, prevent the parsing of every
entity descriptor during the listing.
The goal here is to make it performant to look up entity descriptors by their
entity ID without incurring the cost of parsing every single entity descriptor
to determine the entity ID.
* Feedback, eliminating the parsing from the object, pushing parsing verification into the local service.
* Fix up tests, e_imports.
* Fix comment in types.proto.
* Remove dead comment.
* Deduplicate entity ID in update as well.
* Small refactor to move parse out of lock.
* Remove XML parsing from type, fix grpcserver test, fix locking boundaries.
* Tim's and Edoardo's feedback.
* Fix cache test.
* Update lib/services/local/saml_idp_service_provider.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Expanding the comments on the EntityID field.
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add SAML IdP service providers to the cache and CLI.
SAML IdP service providers have been added to the cache and are now manageable
via the CLI. Some alterations to role permissions have occurred to ensure that
the system and users can manage these.
* Tiago's feedback.
* Update tool/tctl/common/collection.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Tim's feedback.
* Update lib/cache/collections.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Loop over the CA type list in collections
Also adds a NewlyAdded method to CertAuthType to indicate the CA types
that have been added in the current major version, so that we can
ignore any related BadParameter error when handling those kinds of CAs
with potentially older versions of Teleport.
* Mention NewlyAdded in the CertAuthType description
* Adding in a new SAML IdP certificate authority.
A new SAML IdP certificate authority has been added. It has been added to
initialization, the cache, and the certificate can be rotated.
* Update lib/services/authority.go
Co-authored-by: Sam Freiberg <sfreiberg@goteleport.com>
* Update api/types/trust.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Only validate private key if it's present.
---------
Co-authored-by: Sam Freiberg <sfreiberg@goteleport.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* WIP adding OpenSSH CA
* fix creating OpenSSH CA for tests
* fix a test name and tctl usage flag
* fix 'tctl status' not displaying openssh CA sometimes
* add OpenSSH CA to TestInit_bootstrap, remove TLS key pair
* add OpenSSH CA to a few more places
* make help text of 'tctl auth rotate' more helpful and accurate
* fix web cert export test
* tbot doesn't need to know about OpenSSH CA
* address feedback
* fix comment formatting
Update the version we should check against: v12 (the current in master)
Update the list of resources to watch for RemoteOldProxy.
The list should be equal to the RemoteProxy as seen in `branch/v11`
As soon as we cut v12, we should update this again in master because
we'll be preparing v13.
When modifying the `types.WatchKind` of `ForRemoteProxy` a series of
steps need to be performed to prevent bricking remote cluster caches.
First, the `cfg.Watches` of `ForOldRemoteProxy` must be replaced
with the current `cfg.Watches` of `ForRemoteProxy`. Next, the
version used by `lib/reversetunnel/srv.go` to determine whether
to use `ForRemoteProxy` or `ForOldRemoteProxy` must be updated
to be the release in which the new resource(s) will exist in.
Once both of these are done, `ForRemoteProxy` may be updated.
Comments are added to `ForRemoteProxy`, `ForOldRemoteProxy`, and
`createRemoteAccessPoint` to help prevent backward incompatible
changes like https://github.com/gravitational/teleport/issues/17211
and https://github.com/gravitational/teleport/issues/19907 from
occurring again in future releases.
Michael