* Add type for GitLab ProvisionToken
* Add default behaviour for domain
* Add IDTokenClaims for GitLab
* Add gitlab token source and token validator
* Thread GitLab support through auth and tbot packages
* Adjust cluster name fetching in token validator
* Initialize GitLab token validator in auth
* Improve comment on `sub`
* Working GitLab CI delegated joining
* Add additional token rule fields
* Add checking for new configuration fields
* add additional test cases for validation of gitlab config struct
* Add TestAuth_RegisterUsingToken_GitLab
* Add tests for IDTokenSource
* Fix imports
* Add tests for GitLab Token Validator
* Fix some comments that were incomplete
* Add license headers
To prevent users from being able to directly connect to registered
OpenSSH (Agentless) nodes, the OpenSSH CA was introduced. When
connecting to Agentless nodes, the Proxy will forward the connection
so the session can be recorded. The forwarding SSH server is configured
to authenticate to the target node with a certificate signed by OpenSSH
CA, which users do not have access to.
* Add GetType() to Plugin
* Add Plugins feature flag to web
* Run prettier
* Update e_imports.go with slack plugin subpackage
Respective enterprise changes imports a new subpackage,
which pulls new dependencies.
* Add CreatedBy and CreatedOn fields to locks.
* Move the setting of the CreatedBy and CreatedOn for locks to the server instead of the client.
* Add tests for the tctl resource lock import and for the tctl lock create command.
* Use clockwork for time in lock creation tests.
* Make fake clock optional and use the golang 0 date.
* Change CreatedOn to CreatedAt.
* Allow a custom time to be passed through as a fake clock.
* Actually accept a fake clock with useFakeClock.
* Pass Clock through as a configuration value when initializing Teleport for the tests.
* Test cleanup
* Set CreatedBy and CreatedAt values in test mocks.
* Fix failing test from enabling clock passthrough to auth.
This PR removes the `types.KindKubeService` objects that were
deprecated in Teleport 11.
Teleport 12 removed the double heartbeat and for Teleport 13 we can
safely drop the support of the old hearbeat based on `types.Server`
objects.
Clients older than Teleport 12 connecting to a Teleport 13 server will
fail since they cannot heartbeat using the old mechanism.
* make it easier to create registered openssh nodes with 'tctl'
Metadata.Name is set to a random UUID if it's unset, the requirement
to use '--force' when creating node resources is dropped, and more
checks for openssh node resources are added.
* added test coverage, renamed KindOpenSSHNode -> SubKindOpenSSHNode, added github.com/google/uuid to api/go.mod
* attempt to fix tests
* don't set node subkind if it's empty
* re-add test fix
The RBAC logic assumes that SSH connections to registered OpenSSH nodes
will always be proxied and terminated, which will come in a future PR.
Part of implementing #19261.
* Add in SAML IdP service provider session metadata to auth attempts.
The SAML IdP auth attempt event now contains SAML IdP service provider,
which will allow the audit logs to display which service provider the user
is attempting to log into.
Additionally, a shortcut name has been added to the SAML IdP service provider
metadata to handle auth attempts where the service provider could not be found
given a shortcut name.
* Linting fix.
* Modify the auth attempt audit log entries.
* SAML IdP audit events.
SAML IdP audit events have been added. These events have been added to the UI
for proper rendering. Additionally, service provider events will be emitted
when managing service providers.
* Align the naming more with the existing events.
* Zac's feedback.
* Add in delete all event.
* Fix typo.
* Update story snapshot.
* Linting and test fixes.
* Audit auth failures.
* Removing the nopermissions test, as it's covered in the regular create test.
* Add UiConfig option to proxy service config
* Add uiConfig to GRV_CONFIG window object and use in terminal constructor
* Update configuration reference docs
* Remove extra structs and change property to scrollbackLines
* Update web/packages/teleport/src/config.ts
Co-authored-by: Jeff Pihach <hatched@users.noreply.github.com>
* Use a common struct and apply in applyProxyConfig
* Remove webclient dependency for fileconf
* Add missing doc comments
* Set individual properties of cfg.Proxy.UI
* Remove unneeded comment
* Add nolint rule
* Fix nolint
* Add test for UIConfig
* Cleanup tests
* Fix TestUIConfig context
* Allow dynamic config for web ui (#22097)
* Update protofiles
---------
Co-authored-by: Jeff Pihach <hatched@users.noreply.github.com>
* Automatically parse entity ID from SAML SP during CLI creation.
When a SAML IdP service provider is created in the CLI, the entity ID will
be automatically parsed out of the entity descriptor and pushed into the
object before pushing the object to the backend.
Additionally, a small bug was found with the SAML IdP service provider get
logic and fixed.
* Update tool/tctl/common/collection.go
Co-authored-by: Andrew Burke <31974658+atburke@users.noreply.github.com>
* Update tool/tctl/common/resource_command_test.go
Co-authored-by: Andrew Burke <31974658+atburke@users.noreply.github.com>
* Bring back copy loop.
* Remove the SkipCheckAndSetDefault.
* Removing the check for the entity ID in the SP object.
* Restore missing comment.
* Parse entity ID as part of check and set defaults.
* Cleanup api go.mod/go.sum.
---------
Co-authored-by: Andrew Burke <31974658+atburke@users.noreply.github.com>
* Add plugin exchange service
* Add Plugin methods to auth
* Add gRPC-layer methods for Plugin
* Add RBAC presets for Plugin
* Test GetPlugin()/NoSecrets access
* Make error assertions more correct in role test
* Deny setting credentials if user can not read them
* gofmt
* Apply minor suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Move dependency into an existing block in go.mod
* Improve error messages for failed type assertions
* DRY WithSecrets access checks for Plugins
* Run new tests in parallel
* Improve error assertions in auth_with_roles_test
* TestGetPluginWithSecrets: split cases to subtests
* Clean up test servers and clients
* Add proto for plugin service
* Remove Plugin methods from auth service
Moved to a dedicated service
* Remove plugin-related auth methods
Moved to a dedicated service in Enterprise
* Remove CreatePlugin test from auth_with_roles_test
Moved to a dedicated service in Enterprise
* Pass "backend getter" to local plugins service
This pattern is used in Enterprise to set up secondary services
before auth (and backend) are created.
* Rename InitialCredentials to BootstrapCredentials
* Add plugins service to genproto.sh
* Reformat generated proto
* Remove obsolete PluginExchangeService
The equivalent of this is now in Enterprise
* Add kube service to genproto.sh; regenerate
* Add ListPlugins to plugin backend service
* Reimplement GetPlugins on top of ListPlugins
This is a "convenience" implementation for the backend service layer.
* Replace GetPlugins with ListPlugins in gRPC schema
* Fix ListKubernetesResources unit test
* Simplify plugin pagination key to just the name
* Use existing constant for page size
* Make dummy clients return errors instead of panic
* Remove obsolete field
* Ensure go.mod is valid for corresponding e changes
* Fix passing mutex ref
* Move teleport-plugins import to e_imports
* Revert oauth change in go.mod
* Use limit+1 to look-ahead when paginating plugins
* Test plugin pagination with pageSize > numPlugins
* Add descriptive messages to gRPC dummy clients
* Plugin: add RW for editor; remove secrets from gRPC
* Make message more descriptive for dummy gRPC conn
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Partially revert 09633dd47f
* Hide old features from String, add comments
* Add new reporting license flag
* Add testing
* add comment to LicenseV3/LicenseSpecV3
* Less ambiguous name for the new field
* Elaborate more on the unused flags
The DatabaseService was using the KeepAlive_Database type instead
of a new dedicated type. This caused the keepalive to fail because
the backend key that was created didn't actually exist which results
in #21454.
This adds the appropriate KeepAlive type and uses it in the appropriate
places.
Fixes#21454
* Fix Moderated session on leave pause action.
* Unpause when moderator rejoins session with onLeave=pause
This commite fixes a case when the moderator rejoins a paused session
but Teleport didn't resume the operations and the session was still
locked to everyone.
* Fix panic when re-joining SSH session.
* Update lib/kube/proxy/sess.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Update lib/kube/proxy/sess.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Fix typo
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
Current implementation of NewlyAdded() requires to keep different implementation on production branches. New implementation will allow to keep the same source code to be identical on all branches.
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add SAML query functions to auth preferences and role.
Getter functions have been made for the new IdP configuration fields in the
AuthPreferences and RoleOptions.
* Remove role query, as we can access this in the object.
* Make sure the IdP options section won't hit any nil pointer errors.
* SAML IdP session objects.
The upcoming SAML IdP feature requires session storage in the backend. To
support that, the `WebSession` that has been adapted for app sessions and
Snowflake sessions has been adapted for SAML IdP sessions.
The SAML IdP will be encoding the session structure as JSON and packing it
into the new `data` field within the web session.
* Update api/types/session.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Use specific structure instead of a JSON blob.
* Update the create SAML session request.
* Make SAML session a pointer.
* Add in link to crewjam/saml object.
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Add Device to LocketTarget proto
* Refactor LockTarget.Match
* Test lib/srv.ComputeLockTargets
* Test lib/services.LockTargetsFromTLSIdentity
* Test device lock during cert issuance
* Add device lock targets where applicable
* Add --device to `tctl lock`
* Fix godocs (unrelated)
* Review: Drop redundant comments
* Make UsageSessionStart more selective and granular for app access
* Allow generic "app" kind for app.session.start
app.session.start is consistently emitted, just not consistently stored
* Avoid singling out aws app access
* Use the same check as app access
* Extract entity ID when creating SAML service provider.
The entity ID will be parsed from the entity descriptor metadata when the
service provider's entity descriptor is set. The motivation of this PR is to
do the following:
* Extract the entity ID from the entity descriptor during the creation of the
SAML IdP service provider.
* Prevent the creation of service providers in the backend that have an
entity ID that does not match the entity ID represented in the entity
descriptor.
* When reading or listing service providers, prevent the parsing of every
entity descriptor during the listing.
The goal here is to make it performant to look up entity descriptors by their
entity ID without incurring the cost of parsing every single entity descriptor
to determine the entity ID.
* Feedback, eliminating the parsing from the object, pushing parsing verification into the local service.
* Fix up tests, e_imports.
* Fix comment in types.proto.
* Remove dead comment.
* Deduplicate entity ID in update as well.
* Small refactor to move parse out of lock.
* Remove XML parsing from type, fix grpcserver test, fix locking boundaries.
* Tim's and Edoardo's feedback.
* Fix cache test.
* Update lib/services/local/saml_idp_service_provider.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Expanding the comments on the EntityID field.
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Test device authorization during cert issuance
* Skip device validation when issuing App or Windows certs
* Add an early check for GenerateUserSingleUseCerts
Rename `protoEqual` to `protoKnownFieldsEqual` and add a warning about
its usage.
Manually ignoring `XXX_` fields in full comparisons runs the risk of
ignoring unknown fields, which in itself is a strong hint that we are
running outdated code. The recommended practice for scenarios where full
equality is not desirable is to code it as such, comparing the fields
that matter.
`proto.Equal` should be preferred in most scenarios.
* Add Plugins service
* Add tests for local plugins service
* Remove validation calls from service
These are already invoked by MarshalPlugin
* Separate concerns of local Plugins service
Credentials will be exchanged by the auth server,
so there is no need to have proto.CreatePluginsRequest
in the service layer.
Proto types will be reintroduced in a later PR
covering the auth server changes.
* Rename method to better reflect purpose
* Run GCI
This PR introduces a gRPC service to retrieve the pods available using the `search_as_roles` configured in the user's roles.
This gRPC service receives a TLS identity and manipulates it to access the Teleport Kubernetes Proxy and retrieve the pods available for a hypothetical user that has the `search_as_roles` defined for its roles.
The response does not leak the certificate nor the pod details other than `name`, `namespace` and `labels`.
```mermaid
sequenceDiagram
participant User as User
participant gRPC as grpc Server
participant Auth as Auth Server
participant KubeProxy as Kube Proxy
participant KubeSVC as Kube Service
User->>+gRPC: ListKubeResources(cluster,namespace)
Note left of gRPC: Includes search_as_roles <br/> and preview_as_roles <br/>into identity!
gRPC-->>+Auth: Sign cert with ProcessKubeCSR
Auth-->>-gRPC: Signed certificate
gRPC->>+KubeProxy: list pods "v1.../namespaces/{namespace}/pods"
KubeProxy-->>+KubeSVC: list pods "v1.../namespaces/{namespace}/pods"
KubeSVC-->>-KubeProxy: filtered response
Note left of KubeSVC: Applies Pod RBAC filtering!
KubeProxy-->>-gRPC: response
gRPC->>-User:Return name, namespace and labels
```
Part of #21107 and #19573
* Loop over the CA type list in collections
Also adds a NewlyAdded method to CertAuthType to indicate the CA types
that have been added in the current major version, so that we can
ignore any related BadParameter error when handling those kinds of CAs
with potentially older versions of Teleport.
* Mention NewlyAdded in the CertAuthType description
* Add RBAC labels for Databas Services access
This PR adds a new set of Labels that controls access to the
DatabaseService resource.
We changed the `RoleSet.checkAccess` to allow for checks in Resources
without Labels.
However adding complexity to this function is something that can bit us
in the future.
So, this PR reverts that change and adds a new set of labels.
Those labels will control whether the RoleSet has access to
DatabaseServices.
Given that this is a new condition that we add to the default `editor`
role, we had to create a migration/backfill for the roles that don't
have them.
This allow us to migrate the roles created previously and add this new
allow condition.
* remove preset for remote proxy and database labels
* Remove db_service_labels wildcard from editor preset role
* Fix early exit logic
* Adding in a new SAML IdP certificate authority.
A new SAML IdP certificate authority has been added. It has been added to
initialization, the cache, and the certificate can be rotated.
* Update lib/services/authority.go
Co-authored-by: Sam Freiberg <sfreiberg@goteleport.com>
* Update api/types/trust.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Only validate private key if it's present.
---------
Co-authored-by: Sam Freiberg <sfreiberg@goteleport.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add Plugin resource schema, methods
* Improve shebang of genproto.sh
Execute using bash, no matter where it actually lives
* Use Metadata.Expiry()
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Remove field reservations from PluginStatusCode
* Add plugin (un)marshaling
* Snake case fields of Plugin (and children)
* Ensure timestamp fields on Plugin are always UTC
https://github.com/gogo/protobuf/issues/519
* Rename credentials according to proto conventions
* Fold check for nil settings into the type switch
* Remove extraneous field checks
These are set in setStaticFields()
* Add missing godocs
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add IdP options to role and auth preferences.
Both role and auth preferences have IdP options added to them. At the auth
preferences level, if the SAML IdP option is set to false, the IdP will be
disabled globally. At the role level, it will control which roles allow
access to the IdP.
* Make SAML access by default.
* Fix tests.
* Fix config test.
* Initial SAML IdP service provider object.
The SAML IdP service provider object has been added to support the use of
Teleport as a SAML identity provider. Please see
https://github.com/gravitational/teleport.e/pull/668 for more information.
The local service for handling backend management of the SAML IdP
service provider objects has been added as well. This will be expanded upon
in a later PR.
* Fix imports.
* Copy paste error.
* Update api/types/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update api/types/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update lib/services/local/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Use errAssertionFunc, paginate service provider resources.
* Marco's and Tim's feedback.
* Update proto comments.
* Update NewSAMLIdPServiceProvider comment.
* Fix linting, test issues.
* Remove unnecessary functions already given by ResourceHeader.
* Apply suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fixes, removal of explict getter for service provider.
* Remove unnecessary functions.
* Update api/types/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Linting fix.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Noah Stride