* Refactor connection sharing logic to allow reconnection logic.
* Refactor signature method into organized parts; Move signPromptMu further down the callstack to allow better concurrent access; Add attestMu to prevent certificate corruption.
* Handle PIV reconnection within doWithSharedConn.
* Add test; Fix issues.
* Add debug log.
* Clean up locks.
* Only prompt PIN on retry; Clean up prompt logic.
* Add todo for upstream PR.
* Prevent PIV operations that don't support concurrency from being run concurrently; add test.
* - Revert connection sharing refactors.
- Add exclusiveOperationMu mutex and test.
* Address comments; Move touch prompt into abandonableSign for clearer synchronous logic.
* Restore cancel cause behavior.
* Address signature concurrency comments.
* Fix signature channel.
* * Have hardware key agent validate known keys instead of always validating by the PIV slot cert.
* Refactor cert check logic with a custom error.
* Add test.
* Update rfd.
* Fix lint.
* Address comments.
* Require knownKeyFn to be provided.
* Require fallbackService to be provided to agent service.
* Address comments.
* * Initialize shared hardware key service and client store for tshd
* Replace CustomHardwareKeyPrompt with SetPrompt
* Add lazy loaded tshd event service client and use it to initialize hardware key prompt early.
* Address comments; Set TshdEventsClient in daemon service.
* Fix test.
* Fix potential race condition on global yubikey service prompt.
* Add test.
* Implement basic "tsh db exec"
* adding ut
* minor refactor, fix race, rename iter func
* add help
* always use service name
* overwrite max connections with env var
* single get databases call
* remove prefix output
* fix some flags
* iterutils
* ensure each database
* add summery
* refactor, tests
* revert auto rename change by editor
* revert migrate
* remove unused var
* review comments
* renaming --max-connections to --parallel
* make exec return result instead of error
* hint TELEPORT_PARALLEL_JOBS
* fix golint
* address PR comments
* Add hardware key PINCache.
* Remove PINCachingPrompt.
* Set PINCacheTTL in key ref.
* Add PINCache to cli and teleterm hardware key prompts.
* Resore signMu.
* Pass pin cache TTL in hardware key agent sign requests.
* Move pinCache to YubiKey struct to maintain support for multiple YubiKeys.
* Enforce max PIV PIN cache TTL of 1 hour.
* Remove unused fields.
* Ensure a new goroutine is not started when pin expiration is already set.
* Update error message.
* Remove goroutine.
* Move pin cache to piv package.
* Hold lock for PromptOrGetPIN.
* Add prompt timeout.
* Supply command for context on hardware key prompt.
* * Include command in Teleport Connect hardware key prompts, excluding tshd commands
* Fix proxy host context passed to Teleport connect hardware key prompts
* Only use direct service for `tsh login` to avoid jumping between clients
* Add new line before command.
* Fix story.
* Address comments.
* Trim forward slash for windows.
* Change proxy_host to proxy_hostname; Update comment.
* feat: generate aws regions from SDK v2
* refactor(aws): only sort regions once
* chore(aws): add license header to generated file
* refactor: move global regions to another variable
* refactor: code review suggestions
* refactor(make): update go-generate target
* chore(ci): add target to lint go-generate up-to-date
* refactor(aws): drop global regions
* refactor(workflows): update target and remove git command
* refactor(aws): wrap regions value in sync.OnceValue
* refactor: move aws regions into a sub package of utils aws
* chore(api): remove global regions matching
* fix(makefile): target name
* chore(gomod): go mod tidy
* fix(tctl): add missing awsutils package
* chore(gomod): move indirect aws-sdk-go into indirect deps block
* add a temporary alias to avoid break e
---------
Co-authored-by: STeve (Xin) Huang <huangin52@gmail.com>
* * Hardware key agent checks whether a key is configured for Teleport clients before performing a signature.
* Add detailed error message and docs for configuring PIV slot certificate.
* Add additional checks for mismatched public key on PIV slot, which can occur when generating a new key on a PIV slot with an active login session.
* Update api/utils/keys/piv/yubikey.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add PinCachingPrompt.
* Add PINCacheTimeout to auth preference proto message.
* Report PIVPINCacheTimeout through ping; Store PIVPINCacheTimeout in profile.
* Set PIV pin cache timeout for tsh and teleterm.
* Add SetPrompt and GetPrompt to hardware key service interface.
* Cleanup; Add test.
* Address comments.
* Rename to PINCacheTTL.
* Apply suggestions.
* Fix lint.
* Simplify randPIN for test.
* Use math/rand/v2.
* Update terraform docs.
* Consolidate process-wide shared prompt mutex and yubikey connections into a shared YubiKeyService, which will also share the prompt.
* Fix interactive piv service tests.
* Fix wording on comment.
* Replace prompt in keystore with hardware key service in client store.
* Add client StoreConfig and StoreConfigOpt.
* Add client store and key store tests.
* Provide nil service for ProfileStatus's AppsForCluster and DatabasesForCluster methods.
* Address comments.
* Fix test.
* Fix test with cmp.Diff.
* Remove YubiKeyPrivateKey
* Remove keys package dependencies from PIV implementation.
* Move PIV implementation into new piv package.
* Move newPrivateKey into YubiKeyService.NewPrivateKey.
* * Clean up separation of concerns between YubiKey and YubiKeyService
* Replace hardwarekey.PrivateKey cache with YubiKey cache for proper support for multiple clusters or yubikeys
* Add YubiKey version field for use in version specific signature edge cases
* Change sharedPIVConnection connection from an embedded field.
* Address comments.
* Add getKeyRef helper method.
* Add hardware key service interface; Add mock service for tests.
* Add piv implementation of hardware key service.
* Remove old yubikey parsing logic in favor of hardwarekey.PrivateKeyRef.
* Remove HardwareSigner in favor of hardwarekey.PrivateKey.
* Add test; Cleanup comment; Don't require pin/touch prompts in tests with MockHarwdareKeyService by default.
* Fix tests.
* Add TODOs.
* Use unhashed digest for WarmupHardwareKey.
* Address comments.
* Fix race condition in test service.
* Address comments.
We added this function to mitigate slow user.Current() calls in
Windows Active Directory environments. Go 1.24 ships with an optimized
verison of user.Current, rendering this utility unnecessary.
Closes#41922
* Vendor gravitational/trace/trail in api
Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.
There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.
* fix: appease linters
We suggest that a UUID is used for agentless nodes metadata.name
field, but we do not enforce it. This causes several edge cases
and slightly weird UX in places that expect the name to be a UUID.
Most notably, this presents dialing problems for the web ui as
described in https://github.com/gravitational/teleport/issues/50914.
To allowing dialing to function in all cases for these servers,
routing has been updated to permit matches on metadata.name, however,
the match is given a lower score then a match on a UUID. This should
permit dialing, though, it may still result in ambiguity.
Closes#50914.
* Add TargetPort to RouteToApp and AppMetadata proto messages
* Pass TargetPort during cert generation
* Refactor Pack.makeTLSConfig to accept struct
This will make it easier to add targetPort to it.
* Add labels to UUIDs used by appaccess test pack app servers
This makes them easier to distinguish when routing doesn't work as expected.
* Refactor Pack.CreateAppSession to accept a struct
* TestTCP: Create app session within test
If we kept the old code, we'd need to manually create a session for each
target port, which would create a lot of duplication.
* Prepare integration test fixtures for multi-port tests
* Add api/utils/net.IsPortInRange
* Use TargetPort when routing TCP connections
* Inline dialMultiPortTCPApp, centralize logic
* Check target port when connecting to single-port app
* Reorder check in IsPortInRange
* Use int instead of uint16
* Extract picking dialTarget to separate function
* addr → uriAddr
* Improve err msg for single-port apps when targetPort != uriPort
* Fix unnecessary conversion to int
* Add Ports to AppSpecV3
* Validate ports of api/types.AppV3
* Add Ports to lib/config and lib/service/servicecfg
* lib/config TestApps: Improve error messages
* lib/service: Convert servicecfg.PortRange to types.PortRange
* Add multi-port TCP apps to config and tctl tests
* Rename Ports to TCPPorts
* Change port fields to uint16 where possible
* Update comments for Port and EndPort
* Extract port range validation to api/utils/net
* Replace custom check type with require.ErrorAssertionFunc
* Simplify validation of end port
* Fix expected message in api/types test
I forgot to update that one.
* Use math/rand/v2's thread-local RNG for jitters
* Replace NewJitter() with DefaultJitter
* Replace NewFullJitter() with FullJitter
* Replace NewHalfJitter() with HalfJitter
* Replace NewSeventhJitter() with SeventhJitter
* Inline jitters in lib/utils/diagnostics/latency
* Replace var jitters in lib/utils with proxy functions
* Replace utils.HalfJitter with retryutils.HalfJitter
* Replace utils.FullJitter with retryutils.FullJitter
* Replace utils.SeventhJitter with retryutils.SeventhJitter
* Replace sharded jitters with thread-local ones
* Remove NewSeventhJitter reference in integrations
* [entraid] add setup script for offline clusters.
This PR adds a cli configuration for Entra ID where it's possible to default to system credentials instead of relying on OIDC for authentication in EntraID. OIDC is not always a possibility specially when the cluster is private and not internet acessible.
The UX is the following:
```text
Step 1: Run the Setup Script
1. Open **Azure Cloud Shell** (Bash) using **Google Chrome** or **Safari** for the best compatibility.
2. Upload the setup script using the **Upload** button in the Cloud Shell toolbar.
3. Once uploaded, execute the script by running the following command:
$ bash entraid.sh
**Important Considerations**:
- You must have **Azure privileged administrator permissions** to complete the integration.
- Ensure you're using the **Bash** environment in Cloud Shell.
- During the script execution, you'll be prompted to run 'az login' to authenticate with Azure. **Teleport** does not store or persist your credentials.
- **Mozilla Firefox** users may experience connectivity issues in Azure Cloud Shell; using Chrome or Safari is recommended.
Once the script completes, type 'continue' to proceed, 'exit' to quit: continue
Step 2: Input Tenant ID and Client ID
With the output of Step 1, please copy and paste the following information:
Enter the Tenant ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Enter the Client ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Successfully created EntraID plugin "name".
```
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* move function to api
* handle code review comments
* Apply suggestions from code review
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* fix url
* enable group claims
* add godoc
* handle code review comments
* fix gomod
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
Rafał Cieślak