The used method to create a token in the UI is UpsertToken.
This method requires Create and Update verbs.
It shouldn't be necessary to have the Update verb - we are only creating
and not changing anything.
This PR adds
- a new method - CreateToken - which only requires the Create verb.
- apiserver uses this method to issue a new token
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
* Properly handle empty list of role requests
Currently, an empty list of role requests results in an ambiguous
situation: we usually use the presence of role requests to determine
whether or not we'd return impersonated certs or not. An empty list
of role requests returns a fresh set of non-impersonated certs
(possibly renewed if allowed), while a non-empty list of role requests
returns certs with just those roles. However, if a client _intends_
to request impersonated certs but provides an empty list of role
requests it will instead receive non-impersonated (possibly renewable)
certs with the full permissions of the original user.
This could theoretically result in privilege escalation if a Machine
ID bot: (a) had any worthwhile permissions of its own, which is not
the case unless the bot role was manually modified and (b)
accidentally handed certs off to an attacker.
In practice this bug is fairly difficult to hit: `tbot` always
auto-fills all requestable roles if they are otherwise unset, and
`tctl bots add` requires `--roles=` to be passed. An empty string
here can trigger the bug however it is unlikely a user would pass this
by accident. Moreover, a bot without requestable roles cannot
accomplish much of anything, so this is exceedingly unlikely to
be intended behavior.
Additionally, certificate generation checks help to mitigate the
issue: bots currently lock themselves by accident after the first
renewal when this bug is triggered as they don't explicitly handle
receiving renewable certs when impersonated certs are expected. If an
attacker were to attempt a renewal, the generation counter would
similarly limit access, and as noted previously, the bot role grants
only minimal read-only access anyway.
---
To resolve the issue, this adds a new `RoleRequestsOnly` flag to
`UserCertsRequest` that allows clients to unambiguously specify if
they wish to receive a non-impersonated, possibly renewable, cert with
all the original user's roles and permissions, or if they wish to
receive only role-impersonated certs (or an error if roles are empty).
Machine ID passes this flag in all situations where an impersonated
cert is desired.
Additionally, we also now ensure users add at least one role in
`CreateBot()` (called by `tctl bots add`) as this is almost certainly
an unintended situation.
Fixes#13411
* Address review feedback, rename flag to UseRoleRequests
* Return a local error if no roles are specified
Fixes total count errors for the web UI:
- Adds de-duplicating matches for `FakePaginate` func.
- This change does makes `FakePaginate` less efficient b/c
it will always run filter for every resource per fetch versus just
running it on the initial fetch to get the total count.
- Removes inaccurate de-dupping in the web api layer since we
do it from the back now
- Adds another criteria when de-duplicating `applications` by checking
for its `public_addr` as well as its name.
Create spans for all public facing TeleportClient,
ProxyClient, and NodeClient methods. This makes
correlating spans easier to reason about when
looking at `tsh` traces. As a result of creating
spans, some additional context propagation is
required as well to ensure that spans are linked
properly.
This also removes the unused `quiet` argument from
`ConnectToCluster`. It's usage was not consistent
by existing callers, and it was ignored, so in order
to avoid confusion in future calls, it was removed.
#12241
* Add CSRF mitigations
This commit includes two fixes:
1. Enforce an application/json Content-Type server-side.
2. When checking the bearer token, verify that the user
associated with the token matches the user associated
with the cookie.
* Fix TEL-Q122-13: Access Requests Denial Of Service Via Request Reason (#125) (#127)
* Ignore input when data flow is off in TermManager
When data flow is disabled in TermManager (at the beginning or when TermManager.Off was called) we should ignore all input we receive (currently we buffer it)
* Agent forwarding socket security fix.
Co-authored-by: Lisa Kim <lisa@goteleport.com>
Co-authored-by: Joel <jwejdenstal@icloud.com>
Co-authored-by: Przemko Robakowski <przemko@przemko-robakowski.pl>
* Add client side circuit breaker to auth clients
In order to apply back pressure we can utilize a circuit breaker that
monitors error responses from auth server. When tripped it will prevent
all outbound requests to auth for a period of time. This can also help
prevent a potential thundering heard when auth is in an unhealthy state.
By default the circuit breaker will only be tripped if 90% of the
requests made in the monitoring interval fail.
This adds proxy peering support. A configurable setting that allows for agents
to connect to a subset of proxies and be reachable through any proxy in the
cluster. This is achieved by creating grpc connections between each proxy
server. Client connections can then be passed between proxies to the desired
agent.
* Span forwarding
Modifies the auth grpc server to implement the OTLP Collector
RegisterTraceServiceServer API (https://github.com/open-telemetry/opentelemetry-proto/blob/main/opentelemetry/proto/collector/trace/v1/trace_service.proto).
This allows the auth server to receive spans from other services
like `tsh`, `tctl`, and `tbot`. Any spans received by the auth
server will be forwarded to the exporter configured via the
`tracing_service` if it is enabled. All received spans will be
dropped in the event that the`tracing_service` disabled. By
forwarding spans to the auth server, `tsh` doesn't need to
be provided with any of the telemetry backend information
to have its spans exported.
Adds a new `--trace` flag to `tsh` to enable collecting and
forwarding spans to the auth server. When set, the tracing
provider is initialized with a sampling rate of 1.0 to force
all spans to be recorded. Teleport respects the sampling rate
from remote spans, which means that when `--trace` is set, all
spans from `tsh` and any downstream Teleport services will be
recorded and exported regardless of the sampling rate that each
Teleport service is configured with.
* convert GetDomainNAme endpoint to gRPC
* migrate GetClusterCACert from http to grpc
* fix tests failing due to switch to gRPC transport
* Correct mispelt json tag
* remove `GetLocalClusterName` and `UpsertLocalClusterName` which are unused
* remove unused prefix constant from presence
When the client connects to teleport with invalid credentials (eg
expired ones) it will retry multiple times until the context deadline is
reached.
When it happens, we receive the generic error: context deadline
exceeded.
However, we can ask for the latest connection error, one which will give
us more information on why it happened.
To ask for this extra error we need to add the following
grpc.DialOption: grpc.WithReturnConnectionError()
After doing this, we will get the errors that happenned when trying to
connect to the grpc Server.
This should help us debug possible connection problems.
We had to refactor a little bit the way we handle the parallel
connection attempts to receive all the connection errors from the
multiple flows.
* Add tracing instrumentation for ssh clients/servers
Add tracing context to the existing ProxyHelloSignature to provide
span information across ssh connections. To add span context per
ssh session on top of new connections, the same tracing context is
passed in the first global request of the session.
In order to ensure that tracing context is pulled from and inserted
into the proper context.Context, some interfaces and methods were
changed to take one as the first argument.
* New method: GetCurrentUser().
GetCurrentUser returns current user as seen by the server.
Useful especially in the context of remote clusters which perform role and trait mapping.
* Fix "tsh db ls" for remote clusters.
Attempt to resolve remote roles and traits. Fail gracefully if this isn't possible.
* Respect timeout in `(directDial).DialTimeout`
* Add a Timeout to the api/client/webclient calls
* Respect timeout in (proxyDial).DialTimeout
* Applied suggestion
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Allow register passwordless on invite/reset
* Specify the type of device usage when registering new device
* Minor refactoring to reduce number of parameters to funcs
* Check if device register requested pwdless, response is pwdless capable
Why
---
Current CA rotation require you to rotate the key 3 times
* `init` - to add new CA to the DB
* `update_clients` - to generate new client certificate and add it to DB
* `standby` to remove the old CA from DB.
If any of the steps is skipped the integration will stop working as either Teleport or DB are not able to authenticate the connection.
Solution
---
Signing the client certificate with the new CA will allow to reduce the number of certificate updates and potencial DB restarts/reloads that should make the procedure simpler and less error prone. From now on the certificate will only need to be updated on `init` phase and after `standby` to remove the old CA.
Co-authored-by: Jim Bishopp <jamesbishopp@gmail.com>
Leverage otelhttp to generate spans for http clients and http handlers.
Additionally add spans for grpc clients and servers by using the
otelgrpc interceptors. This is step one in implementation of RFD 65.
Until further work is done, the spans generated will be a no-op
until the tracing provider is initialized.
Implement passwordless cluster settings, as described by RFD 52: Passwordless
[1]. See https://github.com/gravitational/teleport/pull/11716 for recent RFD
changes.
Add the "passwordless" connector and allows cluster admins to configure it as
the cluster default.
teleport.yaml:
```yaml
auth_service:
authentication:
type: local
second_factor: on
webauthn:
rp_id: example.com
passwordless: true # enables/disables passwordless
connector_name: passwordless # sets passwordless as the default
```
`tsh` obeys the connector name if present. User overrides are possible via `tsh
--auth=local` or `tsh --auth=passwordless`. The `tsh --pwdless` flag is now
removed, as discussed in recent RFD changes.
Web API `/ping` and `/ping/{connector}` endpoints are changed to support
"passwordless" and to provide other necessary information.
#9160
[1] https://github.com/gravitational/teleport/blob/master/rfd/0052-passwordless.md#cluster-settings
* Add passwordless toggle to AuthPreferenceSpecV2 proto
* Update generate protos
* Add AuthPreference fields and validation
* Reserve system connector names
* Distinguish between type=local and local connector
* Add passwordless option to teleport.yaml
* Do /ping and /ping/{connector} changes
* Make tsh respect the passwordless connector, remove --pwdless
* feat: delete app web sessions during logout
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* refactor(auth): add VerbList action to delete user app sessions
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
This adds a test, `TestCacheWatchKindExistsInEvents`, that ensures
all `types.WatchKind` registered for all Cache components have a
corresponding `proto.Event` defined. By doing this we can ensure
that for a release there will be no `resource type X is not
suppported` errors causing the Cache to be unhealthy. Unfortunately
this does not prevent issues across releases which may have different
resources being emitted.
* Replace Upload completer grace period logic with session tracker checking to accurately determine whether an upload has been abandoned
* Update session tracker expiration to be 1 hour, and dynamically extend it while the session is active.
* Include the possible connector values if supplied value is invalid.
* Update messaging for auth flag.
* Return error message from failed ping response.
* Collect the connector names in the existing loops.
Bernard Kim