* Add plugin exchange service
* Add Plugin methods to auth
* Add gRPC-layer methods for Plugin
* Add RBAC presets for Plugin
* Test GetPlugin()/NoSecrets access
* Make error assertions more correct in role test
* Deny setting credentials if user can not read them
* gofmt
* Apply minor suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Move dependency into an existing block in go.mod
* Improve error messages for failed type assertions
* DRY WithSecrets access checks for Plugins
* Run new tests in parallel
* Improve error assertions in auth_with_roles_test
* TestGetPluginWithSecrets: split cases to subtests
* Clean up test servers and clients
* Add proto for plugin service
* Remove Plugin methods from auth service
Moved to a dedicated service
* Remove plugin-related auth methods
Moved to a dedicated service in Enterprise
* Remove CreatePlugin test from auth_with_roles_test
Moved to a dedicated service in Enterprise
* Pass "backend getter" to local plugins service
This pattern is used in Enterprise to set up secondary services
before auth (and backend) are created.
* Rename InitialCredentials to BootstrapCredentials
* Add plugins service to genproto.sh
* Reformat generated proto
* Remove obsolete PluginExchangeService
The equivalent of this is now in Enterprise
* Add kube service to genproto.sh; regenerate
* Add ListPlugins to plugin backend service
* Reimplement GetPlugins on top of ListPlugins
This is a "convenience" implementation for the backend service layer.
* Replace GetPlugins with ListPlugins in gRPC schema
* Fix ListKubernetesResources unit test
* Simplify plugin pagination key to just the name
* Use existing constant for page size
* Make dummy clients return errors instead of panic
* Remove obsolete field
* Ensure go.mod is valid for corresponding e changes
* Fix passing mutex ref
* Move teleport-plugins import to e_imports
* Revert oauth change in go.mod
* Use limit+1 to look-ahead when paginating plugins
* Test plugin pagination with pageSize > numPlugins
* Add descriptive messages to gRPC dummy clients
* Plugin: add RW for editor; remove secrets from gRPC
* Make message more descriptive for dummy gRPC conn
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Partially revert 09633dd47f
* Hide old features from String, add comments
* Add new reporting license flag
* Add testing
* add comment to LicenseV3/LicenseSpecV3
* Less ambiguous name for the new field
* Elaborate more on the unused flags
* SAML IdP sessions added to the API and cache.
SAML IdP sessions have now been added to the API and to the cache.
* Update lib/auth/sessions.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Revert changes to types.proto.
* Fix missing session ID, misnamed variable, gRPC update.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
The DatabaseService was using the KeepAlive_Database type instead
of a new dedicated type. This caused the keepalive to fail because
the backend key that was created didn't actually exist which results
in #21454.
This adds the appropriate KeepAlive type and uses it in the appropriate
places.
Fixes#21454
Provides a client that can be used to connect to and interact with
the transport service in `lib/srv/transport`. The client abstracts
the fact that a gRPC stream is being used for the `net.Conn` created
by `DialCluster` and `DialHost`.
This also moves `lib/utils/grpc/stream` to `api/utils/grpc/stream`
so that the client and server can make use of the same stream
abstractions.
Part of #19812
* Fix Moderated session on leave pause action.
* Unpause when moderator rejoins session with onLeave=pause
This commite fixes a case when the moderator rejoins a paused session
but Teleport didn't resume the operations and the session was still
locked to everyone.
* Fix panic when re-joining SSH session.
* Update lib/kube/proxy/sess.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Update lib/kube/proxy/sess.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Fix typo
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Start removing generateToken
* Refactor `tokens add` to use `CreateToken` RPC
* Correct deprecation version
* Remove calls to GenerateToken
* Start tests for token crud
* Allow user role rules to be provided wth CreateUserAndRole helper
* Add TestCreateToken to tls_test
* Add TestUpsertToken
* Add GetTokens test
* Add TestGetToken
* Add test for DeleteToken RPC
* Dedupe error assertions
* Add support for emitting trusted cluster token creation events to Create/UpsertToken
* Fix imports
* Change parameter order to appease linter
* Fix broken token expiry test
* Fix token expiry time for TestAuth_RegisterUsingToken
* Remove unnecessary cleanup
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Change test comment from deprecation notice
* `make gprc` after code review changes
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Rename tests
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* More test cases for GetTokens
* Improve message on duplicate token
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Current implementation of NewlyAdded() requires to keep different implementation on production branches. New implementation will allow to keep the same source code to be identical on all branches.
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add SAML query functions to auth preferences and role.
Getter functions have been made for the new IdP configuration fields in the
AuthPreferences and RoleOptions.
* Remove role query, as we can access this in the object.
* Make sure the IdP options section won't hit any nil pointer errors.
* SAML IdP session objects.
The upcoming SAML IdP feature requires session storage in the backend. To
support that, the `WebSession` that has been adapted for app sessions and
Snowflake sessions has been adapted for SAML IdP sessions.
The SAML IdP will be encoding the session structure as JSON and packing it
into the new `data` field within the web session.
* Update api/types/session.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Use specific structure instead of a JSON blob.
* Update the create SAML session request.
* Make SAML session a pointer.
* Add in link to crewjam/saml object.
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Add Device to LocketTarget proto
* Refactor LockTarget.Match
* Test lib/srv.ComputeLockTargets
* Test lib/services.LockTargetsFromTLSIdentity
* Test device lock during cert issuance
* Add device lock targets where applicable
* Add --device to `tctl lock`
* Fix godocs (unrelated)
* Review: Drop redundant comments
* Make UsageSessionStart more selective and granular for app access
* Allow generic "app" kind for app.session.start
app.session.start is consistently emitted, just not consistently stored
* Avoid singling out aws app access
* Use the same check as app access
* Allow the creation and usage of expiryless tokens
* Tidy up loose ends
* Fix imports
* Add tests for changes to expiryless behaviour
* Use new RPCs for new expiryless behaviour
* Add tests for new RPCs
* Remove unused import
* Recreate behaviour for tokens expiring in past
* Missing NoError check int ests
* Correctly americanize behavior
* Extract entity ID when creating SAML service provider.
The entity ID will be parsed from the entity descriptor metadata when the
service provider's entity descriptor is set. The motivation of this PR is to
do the following:
* Extract the entity ID from the entity descriptor during the creation of the
SAML IdP service provider.
* Prevent the creation of service providers in the backend that have an
entity ID that does not match the entity ID represented in the entity
descriptor.
* When reading or listing service providers, prevent the parsing of every
entity descriptor during the listing.
The goal here is to make it performant to look up entity descriptors by their
entity ID without incurring the cost of parsing every single entity descriptor
to determine the entity ID.
* Feedback, eliminating the parsing from the object, pushing parsing verification into the local service.
* Fix up tests, e_imports.
* Fix comment in types.proto.
* Remove dead comment.
* Deduplicate entity ID in update as well.
* Small refactor to move parse out of lock.
* Remove XML parsing from type, fix grpcserver test, fix locking boundaries.
* Tim's and Edoardo's feedback.
* Fix cache test.
* Update lib/services/local/saml_idp_service_provider.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Expanding the comments on the EntityID field.
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Test device authorization during cert issuance
* Skip device validation when issuing App or Windows certs
* Add an early check for GenerateUserSingleUseCerts
Rename `protoEqual` to `protoKnownFieldsEqual` and add a warning about
its usage.
Manually ignoring `XXX_` fields in full comparisons runs the risk of
ignoring unknown fields, which in itself is a strong hint that we are
running outdated code. The recommended practice for scenarios where full
equality is not desirable is to code it as such, comparing the fields
that matter.
`proto.Equal` should be preferred in most scenarios.
* Add Plugins service
* Add tests for local plugins service
* Remove validation calls from service
These are already invoked by MarshalPlugin
* Separate concerns of local Plugins service
Credentials will be exchanged by the auth server,
so there is no need to have proto.CreatePluginsRequest
in the service layer.
Proto types will be reintroduced in a later PR
covering the auth server changes.
* Rename method to better reflect purpose
* Run GCI
* Use `ctx` rather than `context.TODO()` where available
* Further propagation of context
* Use `context.Background()` instead of `context.TODO()` where appropriate in tests
* Further remove `context.TODO` from tests
* Appease linter on parameter order
This PR introduces a gRPC service to retrieve the pods available using the `search_as_roles` configured in the user's roles.
This gRPC service receives a TLS identity and manipulates it to access the Teleport Kubernetes Proxy and retrieve the pods available for a hypothetical user that has the `search_as_roles` defined for its roles.
The response does not leak the certificate nor the pod details other than `name`, `namespace` and `labels`.
```mermaid
sequenceDiagram
participant User as User
participant gRPC as grpc Server
participant Auth as Auth Server
participant KubeProxy as Kube Proxy
participant KubeSVC as Kube Service
User->>+gRPC: ListKubeResources(cluster,namespace)
Note left of gRPC: Includes search_as_roles <br/> and preview_as_roles <br/>into identity!
gRPC-->>+Auth: Sign cert with ProcessKubeCSR
Auth-->>-gRPC: Signed certificate
gRPC->>+KubeProxy: list pods "v1.../namespaces/{namespace}/pods"
KubeProxy-->>+KubeSVC: list pods "v1.../namespaces/{namespace}/pods"
KubeSVC-->>-KubeProxy: filtered response
Note left of KubeSVC: Applies Pod RBAC filtering!
KubeProxy-->>-gRPC: response
gRPC->>-User:Return name, namespace and labels
```
Part of #21107 and #19573
* Loop over the CA type list in collections
Also adds a NewlyAdded method to CertAuthType to indicate the CA types
that have been added in the current major version, so that we can
ignore any related BadParameter error when handling those kinds of CAs
with potentially older versions of Teleport.
* Mention NewlyAdded in the CertAuthType description
* Define event types
* Define event names for each flow
* Report events upon start, exiting, and next steps
* Update json property name change
* Emit user skipped event
* Emit error events
* Handle unloading event for 'completed' step
* Move updating event state into hook
* Finish emitting events for desktop
* Address CR: rename DiscoverDesktop to DiscoverResources
* Various changes:
- address CR: remove use of ref
- diagnostic traces can also be a success, only emit event on failed traces
- add mysql to discover events
- consistent naming on exit prompt
* Update and add new event names
* Update tests
* Emit events for unimplemented flows (apps and other dbs)
* Redo emitting events for test connection
Send event for EACH test connection failure or success.
If a user does not do any testing, send a skipped event.
* Add RBAC labels for Databas Services access
This PR adds a new set of Labels that controls access to the
DatabaseService resource.
We changed the `RoleSet.checkAccess` to allow for checks in Resources
without Labels.
However adding complexity to this function is something that can bit us
in the future.
So, this PR reverts that change and adds a new set of labels.
Those labels will control whether the RoleSet has access to
DatabaseServices.
Given that this is a new condition that we add to the default `editor`
role, we had to create a migration/backfill for the roles that don't
have them.
This allow us to migrate the roles created previously and add this new
allow condition.
* remove preset for remote proxy and database labels
* Remove db_service_labels wildcard from editor preset role
* Fix early exit logic
* Adding in a new SAML IdP certificate authority.
A new SAML IdP certificate authority has been added. It has been added to
initialization, the cache, and the certificate can be rotated.
* Update lib/services/authority.go
Co-authored-by: Sam Freiberg <sfreiberg@goteleport.com>
* Update api/types/trust.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Only validate private key if it's present.
---------
Co-authored-by: Sam Freiberg <sfreiberg@goteleport.com>
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Adjust go_package of lib/prehog Go protobufs
This makes them follow the pattern set out by api/proto and proto.
* Adjust go_package of lib/teleterm Go protobufs
* Use single buf.gen.yaml to generate JS protos
This also entailed changing the location of lib/teleterm protos and changing
the value of their package specifier to match the conventions in other parts
of the codebase. This is a breaking change but that is fine for Connect
as the protos are used locally only and each build ships with matching
protobufs.
* Make web/packages/teleterm use protobufs from gen-proto-js
We used to copy protobufs over to web/packages/teleterm/src/services/tshd
since webapps used to be in a separate repo.
This is no longer the case, so we can just make teleterm use protobufs
from gen-proto-js.
* Move prehog & teleterm protos into proto/teleport/lib
* Generate JS protos to gen/proto/js
* Move lib/teleterm Go protobufs to gen/proto/go
* Move lib/prehog Go protobufs to gen/proto/go
* Rename lib/teleterm proto package
* Re-enable linter rules for teleterm & prehog
* Update prehogv1 path in usagereporter_test.go
* Use except instead of ignore_only to allow Google API-style responses
* Add UNARY_RPC to api/proto & proto
* Ignore gen/ when running addlicense
* buf-js.gen.yaml: Remove comment about lack of go_package for JS
* Move prehog protos to proto/prehog/v1alpha
* Adjust prehog's go_package to match proto package
* SAML IdP service provider APIs
The SAML IdP service provider's associated APIs have been implemented. This
will support the use of Teleport as a SAML IdP by allowing Teleport users to
add service providers through the API.
* Correct permissions.
* Update lib/auth/grpcserver_test.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add Plugin resource schema, methods
* Improve shebang of genproto.sh
Execute using bash, no matter where it actually lives
* Use Metadata.Expiry()
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Remove field reservations from PluginStatusCode
* Add plugin (un)marshaling
* Snake case fields of Plugin (and children)
* Ensure timestamp fields on Plugin are always UTC
https://github.com/gogo/protobuf/issues/519
* Rename credentials according to proto conventions
* Fold check for nil settings into the type switch
* Remove extraneous field checks
These are set in setStaticFields()
* Add missing godocs
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add IdP options to role and auth preferences.
Both role and auth preferences have IdP options added to them. At the auth
preferences level, if the SAML IdP option is set to false, the IdP will be
disabled globally. At the role level, it will control which roles allow
access to the IdP.
* Make SAML access by default.
* Fix tests.
* Fix config test.
* Initial SAML IdP service provider object.
The SAML IdP service provider object has been added to support the use of
Teleport as a SAML identity provider. Please see
https://github.com/gravitational/teleport.e/pull/668 for more information.
The local service for handling backend management of the SAML IdP
service provider objects has been added as well. This will be expanded upon
in a later PR.
* Fix imports.
* Copy paste error.
* Update api/types/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update api/types/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Update lib/services/local/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Use errAssertionFunc, paginate service provider resources.
* Marco's and Tim's feedback.
* Update proto comments.
* Update NewSAMLIdPServiceProvider comment.
* Fix linting, test issues.
* Remove unnecessary functions already given by ResourceHeader.
* Apply suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fixes, removal of explict getter for service provider.
* Remove unnecessary functions.
* Update api/types/saml_idp_service_provider.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Linting fix.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Forrest