* Convert auth_with_roles to use slog
* allow benchmark tests to log
* remove last use of logrus in github.go
* remove last use of logrus in rotate.go
* remove auth package logrus logger
* convert auth.go to exclusively use slog
* convert db.go to exclusively use slog
* convert methods.go to exclusively use slog
* convert password.go to exclusively use slog
* convert join_ec2.go to exclusively use slog
* convert join_iam.go to exclusively use slog
* convert kube.go to exclusively use slog
* convert oidc.go to exclusively use slog
* convert saml.go to exclusively use slog
* convert sso_diag_context.go to exclusively use slog
* convert transport_credentials.go to exclusively use slog
* convert trustedcluster.go to exclusively use slog
* convert usertoken.go to exclusively use slog
* convert user.go to exclusively use slog
* remove logrus import
* fix: pass in context
* fix: remove new use of package logrus logger
Replaces the dependency on go-oidc/oauth2 with x/oauth2 in the
github connector auth flows. One result of the switch is that it
permitted a lot of simplification - the github client cache used
by the auth server was removed entirely.
* Add SSO MFA ceremony support to WebUI per-session MFA.
* Add display name to SSO MFA device; Add SSO MFA device to SSO challenge.
* Camel case json tags for front end.
* Add sso channel ID for front end broadcast channel logic.
* Fix backwards compatiblity issue; fix error message.
* Fix test.
* Fallback to connector id if display name isn't set.
* Fix test.
* Resolve comment.
* Use uuid.NewRandom.
* go mod tidy
* Move trusted device mode calculation into CreateWebSessionFromReq
* Add the GithubAuthRequest.ClientUserAgent field
* Update generated protos
* Issue DeviceWebToken during Github authn
* Issue DeviceWebToken as part of CreateWebSessionFromReq
* nit: Move methods to sessions.go
* Remove authclient.Client/ClientI/NewClient aliases in lib/auth
* Remove WebSessionReq aliases in lib/auth
* Remove GithubAuthResponse aliases in lib/auth
* Remove GithubAuthRequest aliases in lib/auth
* Remove KubeCSR alias in lib/auth
* Remove KubeCSRResponse alias in lib/auth
* Remove OIDCAuthResponse alias in lib/auth
* Remove OIDCAuthRequest alias in lib/auth
* Remove ValidateOIDCAuthCallbackReq alias in lib/auth
* Remove OIDCAuthRawResponse alias in lib/auth
* Remove CreateUserTokenRequest alias in lib/auth
* Remove SAMLAuthResponse alias in lib/auth
* Remove SAMLAuthRequest alias in lib/auth
* Remove ValidateSAMLResponseReq alias in lib/auth
* Remove SAMLAuthRawResponse alias in lib/auth
* Remove ValidateTrustedClusterRequest alias in lib/auth
* Remove ValidateTrustedClusterRequestRaw alias in lib/auth
* Remove ValidateTrustedClusterResponse alias in lib/auth
* Remove ValidateTrustedClusterResponseRaw alias in lib/auth
* Remove AuthenticateUserRequest alias in lib/auth
* Remove ForwardedClientMetadata alias in lib/auth
* Remove PassCreds alias in lib/auth
* Remove OTPCreds alias in lib/auth
* Remove SessionCreds alias in lib/auth
* Remove AuthenticateSSHRequest alias in lib/auth
* Remove SSHLoginResponse alias in lib/auth
* Remove TrustedCerts alias in lib/auth
* Remove AuthoritiesToTrustedCerts alias in lib/auth
* Move auth.HostFQDN to authclient
* Move auth.WithClusterCAs, auth.DefaultClientCertPool and auth.ClientCertPool to authclient
* Switch alpn proxy to use authclient.CAGetter instead of auth.ReadProxyAccessPoint
* Use a smaller scoped interfaces in lib/proxy/peer to remove lib/auth dependency
* Move auth.TryCreateAppSessionForClientCertV15 to authclient
* Move auth.ErrNoMFADevices to authclient
* Move access point interfaces to authclient. Aliases left behind to prevent breaking builds
* remove lib/auth dependency from lib/reversetunnelclient
* fix lints
* fix license
* Bump e ref to include gravitational/teleport.e#4174
* Use authclient.Client in new tctl diag commands
* Stop using auth.UserTokenType aliases
This starts separating the lib/auth client and server code into
distinct packages to reduce the dependency tree of client tools.
For the time being aliases were left to all things moved into
lib/auth/authclient to reduce the changeset and ensure code still
compiles. Future changes will be built off this to convert code
to use lib/auth/authclient where applicable, this was intentionally
left to a minimum amount of changes to facilitate backports.
* Update GitHub update event code
* Handles prev github update event code in web ui
* reverts code to original github update version and handles in web ui
* ui test fix
* add comment on event code
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update GitHub Auth connector event descriptions to use camelcase
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
Some consts in the `auth` package are used in a lot of other packages.
This increases the probality of getting a cyclic dependency error.
This PR moves some of those consts to the defaults package and updates
all the required locations of their usage.
Only one is missing in the `/e/` repo, which I'm going to open a PR for
it.
After merging, we can also remove the `lib/auth.TokenLenBytes`
While the api client already had support for the new upsert method
it was unimplemented server side and would always fallback to the
legeacy UpsertGithubConnector RPC. This implements the RPC handler
and updates the signature of UpsertGithubConnector to return the
upserted connector in the same manner that Create and Update do.
Auth connectors, users, and roles have all recently had their APIs
extended to support create and update but were still only emitting
create events. This adds new update events and update metadata
and emits them instead of the create events.
Updates tctl edit and the web ui to start using optimistic locking.
The functionality to support optimistic locking already existed, the
APIs used by both clients were updated to use create/update instead
of upsert so that optimistic locking could be enforced. Most of the
changes introduced are tests to ensure that tctl edit, tctl create
and the web ui behave as expected.
Contributes to #30416.
Updates services.UserService and auth.ClientI to contain the
Create and Update methods for all auth connectors and implements
them at the client, server, and services layer. Upsert was untouched
to prevent breaking e and will be addressed in a follow up PR.
Contributes to #30416.
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
The user login state is being generated properly but not being used for
the various sessions. UserLoginState is now properly integrated into
sessions. Additionally, it was noticed that user login state was not being
used for Github logins, so it's been added there as well.
Additionally, getUserOrLoginState has been exposed for use by the
enterprise repo.
Co-authored-by: Lisa Kim <lisa@goteleport.com>
* Add login hooks.
Login hooks have been added to support performing arbitrary operations on
user login. This is done to support generating of an Okta assignment on
user login for the Okta service feature.
* Don't use error channel for calling hooks, test login hooks.
* Expose ResetLoginHooks for external testing.
* Provide user as part of login hook.
* Update lib/auth/methods.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Improve the documentation for LoginHook, AuthenticateUser returns types.User.
* Use user.GetName() instead of username in AuthenticateSSHUser response.
* Address nits and restore comments.
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Move the authorizer into its own package.
The Authorizer and associated functions and constants have been moved into
their own package `authz`. This will allow us to more easily create separate
services for gRPC functionality so that we're not pushing as much into the
`lib/auth` package.
Though this PR is large, the only actual code change here is making
`ContextForLocalUser` exported and changing the `permissions_test.go` so that
it doesn't rely on the `lib/auth` package.
* Use context functions.
* Test and linting fixes.
* Add in a temporary alias file to ensure e still compiles.
* Use functions instead of var aliases for performance reasons.
* Adding in godocs, cleaning up tests.
* Fix tests.
* Add a few more aliases.
This commit enables login rule evaluation during login for users logging
in with a GitHub connector.
The GitHub connector is a bit different from the SAML and OIDC
connectors in that the user roles are not mapped from the traits
(claims/assertions) but from the user's GitHub organizations and teams
directly.
This makes login rules slightly less useful for GitHub logins because
they cannot affect the user's roles, only their traits.
However, GitHub login is mostly an OSS feature and login rules will be
enterprise-only.
Any enterprise users making use of GitHub login will still be able to
use some of the features (trait mapping).
* added Github auth creator
This will allow for multiple implementations of Github
auth connectors.
* work to allow multiple github auth connector implementations
* auth works, need to fix upserts
* fix upserting, add comments
* fix imports from merge
* removed now unused error
* point e submodule to master branch
* fix unit test
* use correct capitalization of 'GitHub'
* move Github auth connector conversions out of api module
* fix linter warning
Create a new type - `SAMLAuthService` - and move the implementation of
the SAML connector from the auth Service to this new type. This
decoupling will make it easier to move out of tree in a later commit.
This also lays the basic groundwork for running without the SAML
connector at all, returning a NotImplemented error for all the SAML
logic if the SAMLAuthService is not plugged in.
A number of names in the `auth` package have been exported to facilitate
moving the SAML connector out of this repository. The types exported do
not need to be exported for this commit, but for subsequent commits that
move the `SAMLAuthService` out of the `auth` package.
Also apply a small fix to to emit `apievents.SAMLConnector*` events of
`apievents.OIDCConnector*` events in the SAML connector.
Brian Joerger