* Add type for GitLab ProvisionToken
* Add default behaviour for domain
* Add IDTokenClaims for GitLab
* Add gitlab token source and token validator
* Thread GitLab support through auth and tbot packages
* Adjust cluster name fetching in token validator
* Initialize GitLab token validator in auth
* Improve comment on `sub`
* Working GitLab CI delegated joining
* Add additional token rule fields
* Add checking for new configuration fields
* add additional test cases for validation of gitlab config struct
* Add TestAuth_RegisterUsingToken_GitLab
* Add tests for IDTokenSource
* Fix imports
* Add tests for GitLab Token Validator
* Fix some comments that were incomplete
* Add license headers
Adds `UpsertCertAuthority` to the `teleport.v1.trust.TrustService`
and deprecates the HTTP api. The `services.Trust` interface was
also updated to include a `context.Context` in both
`CreateCertAuthority` and `UpsertCertAuthority.
To ensure backwards compatibility the `auth.Client` will first
attempt to use the gRPC client and if that fails with a not
implemented error it will fallback to using HTTP.
Part of #6394
Adds `DeleteCertAuthority` to the trust grpc service and deprecates
the legacy HTTP api. Additionally the `DeleteCertAuthority` method
in the `services.Trust` interface now takes a `context.Context` as
the first parameter. In order to plumb the context through from all
the call sites `DeleteRemoteCluster` from `services.Presence` was
also modified to take a `context.Context` as the first parameter.
To prevent users from being able to directly connect to registered
OpenSSH (Agentless) nodes, the OpenSSH CA was introduced. When
connecting to Agentless nodes, the Proxy will forward the connection
so the session can be recorded. The forwarding SSH server is configured
to authenticate to the target node with a certificate signed by OpenSSH
CA, which users do not have access to.
Adds a new `GetCertAuthorities` unary RPC to
`teleport.v1.trust.TrustService` and deprecates the equivalent
HTTP endpoint. All associated interfaces have been updated to remove
the marshal options as well.
* Add CreatedBy and CreatedOn fields to locks.
* Move the setting of the CreatedBy and CreatedOn for locks to the server instead of the client.
* Add tests for the tctl resource lock import and for the tctl lock create command.
* Use clockwork for time in lock creation tests.
* Make fake clock optional and use the golang 0 date.
* Change CreatedOn to CreatedAt.
* Allow a custom time to be passed through as a fake clock.
* Actually accept a fake clock with useFakeClock.
* Pass Clock through as a configuration value when initializing Teleport for the tests.
* Test cleanup
* Set CreatedBy and CreatedAt values in test mocks.
* Fix failing test from enabling clock passthrough to auth.
This PR removes the `types.KindKubeService` objects that were
deprecated in Teleport 11.
Teleport 12 removed the double heartbeat and for Teleport 13 we can
safely drop the support of the old hearbeat based on `types.Server`
objects.
Clients older than Teleport 12 connecting to a Teleport 13 server will
fail since they cannot heartbeat using the old mechanism.
The HTTP client created by `auth.NewClient` has an idle timeout of
30s and each instance periodically gets cert authorities in
`TeleportProcess.syncRotationStateCycle`. If there has been no
activity when the ticker expires then the request will result in a
brand new connection to Auth to be established. This can cause a
spikes in open file descriptors on the Proxy when there are a large
number of instances connected via a tunnel.
To prevent periodic dialing when retrieving cert authorities the
endpoint has been migrated to the new Trust gRPC service. For now
only the get endpoint has been migrated but the rest of the CRUD
operations for cert authorities should be migrated from the HTTP
api to the gRPC service as well.
* Emit new `AgentMetadataEvent`
Part of https://github.com/gravitational/cloud/issues/3550.
This commits adds a new `UpstreamInventoryAgentMetadata` that is sent
from a Teleport agent to an auth server.
Once received, it is transformed into an `AgentMetadataEvent` and sent
to PreHog.
Most `UpstreamInventoryAgentMetadata` fields are intentionally kept as
empty in this PR. Follow up PRs will be opened with the mechanisms
required to fill them (as described in #21337).
* server_id -> host_id
* compute OS and host architecture
* Compute OS version and container runtime
* Close stream if agent receives an agent metadata message
* cmd -> exec ; file -> read
* implement fetchOSVersion for linux
* Remove unused import
* Add note about `agentMetadataCh`
* Allow commands with args
* Remove parseFun abstraction
* fetch glibc version
* fetch container orchestrator
* Fix lint
* Fix TODO
* Add note about glibc version
* cmd -> command
* fetch cloud environment
* fetch install methods
* GLibCVersion -> GlibcVersion
* Use `http.NewRequestWithContext`
* Add missing comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* GLibCVersion -> GlibcVersion
* Fix lint
* Fix helm unit tests
* Add missing comments
* 5 second timeout on http requests
* Spawn gorountine that fetches metadata on each new stream
* Use `defaults.HTTPClient()`
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add missing import
* Handle error
* Revert "Spawn gorountine that fetches metadata on each new stream"
This reverts commit fe4f2790be.
* Send agent metadata to auth server once per stream
* Improve note about agentMetadataDone
* Don't process command output & file content on the agent
Since agents cannot be trusted, regex validation and sanitization should
happen in PreHog anyways. So this commit removes such logic in favor of
moving it to PreHog.
* Fix lint
* Trim space
* Move handling of `AgentMetadataEvent` to `handleControlStream`
* Use cached hello message
* Move metadata files to lib/inventory/metadata
* make sending of agent metadata more self contained
* Minimize diff
* Send all system roles to PreHog
* Remove unused import
* Add parsing of command output / file content back
* Usage reporter refactor
* Usage reporter refactor
* Add missing handling of inventory agent metadata msg
* Fix ICS usage reporter
* Improve comments
* Add cached `metadata.Get*` methods
* Use systemctl status instead of is-active
* Add `Metadata` struct
* return pointer in `FetchMetadata`
* Pass context to `GetMetadata`
* metadataFetchConfig -> fetchConfig
* GetMetadata -> Get
* Add note about `Get` result
* Ensure install methods are non-nil
* Exit `metadata.Get` if context is closed
* Replace sync.Once with atomic.Bool.Swap
* Initialize channel
* Fix lint
* Fix lint
* Make `metadata.Get` return an error instead of bool
* Allow multiple true/false values for env vars
* Use `strings.Cut`
* Use /etc/os-release ID instead of NAME
* Improve `autoEmitMetadata`
* Use `gnu_get_libc_version`
* Ubuntu -> ubuntu
* Use GOARCH
* gofmt
* Move import C up
* Variables may include quotes
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Default values for ID and VERSION_ID
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Blank lines are permitted
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Anonymize host id
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Introduce Okta gRPC and client interfaces.
To support the upcoming Okta integration, Okta gRPC calls and client
interfaces have been added. This utilizes a non-legacy proto to try to
get away from our reliance on gogo.
This commit does NOT add the OktaImportRules and OktaAssignments to the
cache, which will occur in a later commit.
* Intermediary.
* Modifications needed in order to move this to enterprise.
* Remove okta service from grpcserver.
* Add Plugins feature flag
* Add config for plugins runtime
* Allow reading OAuth secrets from files
* Rename Plugins to HostedPlugins
Make it clear that this is separate from the upcoming
self-hosted, standalone plugins that will be part of the Teleport
binary.
* Only allow to read client credentials from files
An interface has been created that will allow the signing of SAML IdP
requests on the auth server. This will eliminate the need for the SAML IdP
to have private key material.
* Add in SAML IdP service provider session metadata to auth attempts.
The SAML IdP auth attempt event now contains SAML IdP service provider,
which will allow the audit logs to display which service provider the user
is attempting to log into.
Additionally, a shortcut name has been added to the SAML IdP service provider
metadata to handle auth attempts where the service provider could not be found
given a shortcut name.
* Linting fix.
* Modify the auth attempt audit log entries.
* SAML IdP audit events.
SAML IdP audit events have been added. These events have been added to the UI
for proper rendering. Additionally, service provider events will be emitted
when managing service providers.
* Align the naming more with the existing events.
* Zac's feedback.
* Add in delete all event.
* Fix typo.
* Update story snapshot.
* Linting and test fixes.
* Audit auth failures.
* Removing the nopermissions test, as it's covered in the regular create test.
Changes the name to better align with the naming used by the rest
of the feature and to prevent ambiguity as the term proxy is quite
overloaded. This has not landed in a release yet so there are no
backward compatability concerns as nothing serves or consumes this
api yet.
* Add UiConfig option to proxy service config
* Add uiConfig to GRV_CONFIG window object and use in terminal constructor
* Update configuration reference docs
* Remove extra structs and change property to scrollbackLines
* Update web/packages/teleport/src/config.ts
Co-authored-by: Jeff Pihach <hatched@users.noreply.github.com>
* Use a common struct and apply in applyProxyConfig
* Remove webclient dependency for fileconf
* Add missing doc comments
* Set individual properties of cfg.Proxy.UI
* Remove unneeded comment
* Add nolint rule
* Fix nolint
* Add test for UIConfig
* Cleanup tests
* Fix TestUIConfig context
* Allow dynamic config for web ui (#22097)
* Update protofiles
---------
Co-authored-by: Jeff Pihach <hatched@users.noreply.github.com>
* Add plugin exchange service
* Add Plugin methods to auth
* Add gRPC-layer methods for Plugin
* Add RBAC presets for Plugin
* Test GetPlugin()/NoSecrets access
* Make error assertions more correct in role test
* Deny setting credentials if user can not read them
* gofmt
* Apply minor suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Move dependency into an existing block in go.mod
* Improve error messages for failed type assertions
* DRY WithSecrets access checks for Plugins
* Run new tests in parallel
* Improve error assertions in auth_with_roles_test
* TestGetPluginWithSecrets: split cases to subtests
* Clean up test servers and clients
* Add proto for plugin service
* Remove Plugin methods from auth service
Moved to a dedicated service
* Remove plugin-related auth methods
Moved to a dedicated service in Enterprise
* Remove CreatePlugin test from auth_with_roles_test
Moved to a dedicated service in Enterprise
* Pass "backend getter" to local plugins service
This pattern is used in Enterprise to set up secondary services
before auth (and backend) are created.
* Rename InitialCredentials to BootstrapCredentials
* Add plugins service to genproto.sh
* Reformat generated proto
* Remove obsolete PluginExchangeService
The equivalent of this is now in Enterprise
* Add kube service to genproto.sh; regenerate
* Add ListPlugins to plugin backend service
* Reimplement GetPlugins on top of ListPlugins
This is a "convenience" implementation for the backend service layer.
* Replace GetPlugins with ListPlugins in gRPC schema
* Fix ListKubernetesResources unit test
* Simplify plugin pagination key to just the name
* Use existing constant for page size
* Make dummy clients return errors instead of panic
* Remove obsolete field
* Ensure go.mod is valid for corresponding e changes
* Fix passing mutex ref
* Move teleport-plugins import to e_imports
* Revert oauth change in go.mod
* Use limit+1 to look-ahead when paginating plugins
* Test plugin pagination with pageSize > numPlugins
* Add descriptive messages to gRPC dummy clients
* Plugin: add RW for editor; remove secrets from gRPC
* Make message more descriptive for dummy gRPC conn
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* SAML IdP sessions added to the API and cache.
SAML IdP sessions have now been added to the API and to the cache.
* Update lib/auth/sessions.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Revert changes to types.proto.
* Fix missing session ID, misnamed variable, gRPC update.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
The DatabaseService was using the KeepAlive_Database type instead
of a new dedicated type. This caused the keepalive to fail because
the backend key that was created didn't actually exist which results
in #21454.
This adds the appropriate KeepAlive type and uses it in the appropriate
places.
Fixes#21454
* Start removing generateToken
* Refactor `tokens add` to use `CreateToken` RPC
* Correct deprecation version
* Remove calls to GenerateToken
* Start tests for token crud
* Allow user role rules to be provided wth CreateUserAndRole helper
* Add TestCreateToken to tls_test
* Add TestUpsertToken
* Add GetTokens test
* Add TestGetToken
* Add test for DeleteToken RPC
* Dedupe error assertions
* Add support for emitting trusted cluster token creation events to Create/UpsertToken
* Fix imports
* Change parameter order to appease linter
* Fix broken token expiry test
* Fix token expiry time for TestAuth_RegisterUsingToken
* Remove unnecessary cleanup
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Change test comment from deprecation notice
* `make gprc` after code review changes
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Rename tests
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* More test cases for GetTokens
* Improve message on duplicate token
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* SAML IdP session objects.
The upcoming SAML IdP feature requires session storage in the backend. To
support that, the `WebSession` that has been adapted for app sessions and
Snowflake sessions has been adapted for SAML IdP sessions.
The SAML IdP will be encoding the session structure as JSON and packing it
into the new `data` field within the web session.
* Update api/types/session.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Use specific structure instead of a JSON blob.
* Update the create SAML session request.
* Make SAML session a pointer.
* Add in link to crewjam/saml object.
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Add Device to LocketTarget proto
* Refactor LockTarget.Match
* Test lib/srv.ComputeLockTargets
* Test lib/services.LockTargetsFromTLSIdentity
* Test device lock during cert issuance
* Add device lock targets where applicable
* Add --device to `tctl lock`
* Fix godocs (unrelated)
* Review: Drop redundant comments
* Allow the creation and usage of expiryless tokens
* Tidy up loose ends
* Fix imports
* Add tests for changes to expiryless behaviour
* Use new RPCs for new expiryless behaviour
* Add tests for new RPCs
* Remove unused import
* Recreate behaviour for tokens expiring in past
* Missing NoError check int ests
* Correctly americanize behavior
* Extract entity ID when creating SAML service provider.
The entity ID will be parsed from the entity descriptor metadata when the
service provider's entity descriptor is set. The motivation of this PR is to
do the following:
* Extract the entity ID from the entity descriptor during the creation of the
SAML IdP service provider.
* Prevent the creation of service providers in the backend that have an
entity ID that does not match the entity ID represented in the entity
descriptor.
* When reading or listing service providers, prevent the parsing of every
entity descriptor during the listing.
The goal here is to make it performant to look up entity descriptors by their
entity ID without incurring the cost of parsing every single entity descriptor
to determine the entity ID.
* Feedback, eliminating the parsing from the object, pushing parsing verification into the local service.
* Fix up tests, e_imports.
* Fix comment in types.proto.
* Remove dead comment.
* Deduplicate entity ID in update as well.
* Small refactor to move parse out of lock.
* Remove XML parsing from type, fix grpcserver test, fix locking boundaries.
* Tim's and Edoardo's feedback.
* Fix cache test.
* Update lib/services/local/saml_idp_service_provider.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Expanding the comments on the EntityID field.
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
This PR introduces a gRPC service to retrieve the pods available using the `search_as_roles` configured in the user's roles.
This gRPC service receives a TLS identity and manipulates it to access the Teleport Kubernetes Proxy and retrieve the pods available for a hypothetical user that has the `search_as_roles` defined for its roles.
The response does not leak the certificate nor the pod details other than `name`, `namespace` and `labels`.
```mermaid
sequenceDiagram
participant User as User
participant gRPC as grpc Server
participant Auth as Auth Server
participant KubeProxy as Kube Proxy
participant KubeSVC as Kube Service
User->>+gRPC: ListKubeResources(cluster,namespace)
Note left of gRPC: Includes search_as_roles <br/> and preview_as_roles <br/>into identity!
gRPC-->>+Auth: Sign cert with ProcessKubeCSR
Auth-->>-gRPC: Signed certificate
gRPC->>+KubeProxy: list pods "v1.../namespaces/{namespace}/pods"
KubeProxy-->>+KubeSVC: list pods "v1.../namespaces/{namespace}/pods"
KubeSVC-->>-KubeProxy: filtered response
Note left of KubeSVC: Applies Pod RBAC filtering!
KubeProxy-->>-gRPC: response
gRPC->>-User:Return name, namespace and labels
```
Part of #21107 and #19573
* Define event types
* Define event names for each flow
* Report events upon start, exiting, and next steps
* Update json property name change
* Emit user skipped event
* Emit error events
* Handle unloading event for 'completed' step
* Move updating event state into hook
* Finish emitting events for desktop
* Address CR: rename DiscoverDesktop to DiscoverResources
* Various changes:
- address CR: remove use of ref
- diagnostic traces can also be a success, only emit event on failed traces
- add mysql to discover events
- consistent naming on exit prompt
* Update and add new event names
* Update tests
* Emit events for unimplemented flows (apps and other dbs)
* Redo emitting events for test connection
Send event for EACH test connection failure or success.
If a user does not do any testing, send a skipped event.
* Add RBAC labels for Databas Services access
This PR adds a new set of Labels that controls access to the
DatabaseService resource.
We changed the `RoleSet.checkAccess` to allow for checks in Resources
without Labels.
However adding complexity to this function is something that can bit us
in the future.
So, this PR reverts that change and adds a new set of labels.
Those labels will control whether the RoleSet has access to
DatabaseServices.
Given that this is a new condition that we add to the default `editor`
role, we had to create a migration/backfill for the roles that don't
have them.
This allow us to migrate the roles created previously and add this new
allow condition.
* remove preset for remote proxy and database labels
* Remove db_service_labels wildcard from editor preset role
* Fix early exit logic
* Adjust go_package of lib/prehog Go protobufs
This makes them follow the pattern set out by api/proto and proto.
* Adjust go_package of lib/teleterm Go protobufs
* Use single buf.gen.yaml to generate JS protos
This also entailed changing the location of lib/teleterm protos and changing
the value of their package specifier to match the conventions in other parts
of the codebase. This is a breaking change but that is fine for Connect
as the protos are used locally only and each build ships with matching
protobufs.
* Make web/packages/teleterm use protobufs from gen-proto-js
We used to copy protobufs over to web/packages/teleterm/src/services/tshd
since webapps used to be in a separate repo.
This is no longer the case, so we can just make teleterm use protobufs
from gen-proto-js.
* Move prehog & teleterm protos into proto/teleport/lib
* Generate JS protos to gen/proto/js
* Move lib/teleterm Go protobufs to gen/proto/go
* Move lib/prehog Go protobufs to gen/proto/go
* Rename lib/teleterm proto package
* Re-enable linter rules for teleterm & prehog
* Update prehogv1 path in usagereporter_test.go
* Use except instead of ignore_only to allow Google API-style responses
* Add UNARY_RPC to api/proto & proto
* Ignore gen/ when running addlicense
* buf-js.gen.yaml: Remove comment about lack of go_package for JS
* Move prehog protos to proto/prehog/v1alpha
* Adjust prehog's go_package to match proto package
* SAML IdP service provider APIs
The SAML IdP service provider's associated APIs have been implemented. This
will support the use of Teleport as a SAML IdP by allowing Teleport users to
add service providers through the API.
* Correct permissions.
* Update lib/auth/grpcserver_test.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add Plugin resource schema, methods
* Improve shebang of genproto.sh
Execute using bash, no matter where it actually lives
* Use Metadata.Expiry()
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Remove field reservations from PluginStatusCode
* Add plugin (un)marshaling
* Snake case fields of Plugin (and children)
* Ensure timestamp fields on Plugin are always UTC
https://github.com/gogo/protobuf/issues/519
* Rename credentials according to proto conventions
* Fold check for nil settings into the type switch
* Remove extraneous field checks
These are set in setStaticFields()
* Add missing godocs
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add IdP options to role and auth preferences.
Both role and auth preferences have IdP options added to them. At the auth
preferences level, if the SAML IdP option is set to false, the IdP will be
disabled globally. At the role level, it will control which roles allow
access to the IdP.
* Make SAML access by default.
* Fix tests.
* Fix config test.
* Initial SAML IdP service provider object.
The SAML IdP service provider object has been added to support the use of
Teleport as a SAML identity provider. Please see
https://github.com/gravitational/teleport.e/pull/668 for more information.
The local service for handling backend management of the SAML IdP
service provider objects has been added as well. This will be expanded upon
in a later PR.
* Fix imports.
* Copy paste error.
* Update api/types/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update api/types/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update lib/services/local/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Use errAssertionFunc, paginate service provider resources.
* Marco's and Tim's feedback.
* Update proto comments.
* Update NewSAMLIdPServiceProvider comment.
* Fix linting, test issues.
* Remove unnecessary functions already given by ResourceHeader.
* Apply suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fixes, removal of explict getter for service provider.
* Remove unnecessary functions.
* Update api/types/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Linting fix.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Discover Events: add started and resourceSelection event
This commit adds two new Prehog events, as part of the Discover
initiative.
Discover Started: when the wizard screen opens.
Resource Selection: when the user selects a Resource (server, kube,
db/pg, db/rds, db/..., desktop), and clicks next.
* improve comments, rename user_name
This commit adds the types necessary in order to add audit events for
login rule resource actions.
The emission of these events will be added in a separate commit to
teleport.e, and the frontend display will be added later (currently
these show up as "Unknown" events).
Noah Stride