This change replaces all `Tile`s in the docs with lists of links. This
achieves two things:
- Helps us move toward a more text-focused look and feel for the docs.
See gravitational/docs#93.
- Makes it easier to reorganize the docs. Currently, there's no linting
for internal links in `Tile` hrefs (See gravitational/docs#100).
I used this script to edit each docs page, invoking the script for all
MDX files in docs/pages:
```
gawk '
BEGIN{inopentag=0; indesc=0; desc=""; title=""; href="";}
/<\/?TileSet>/{next;}
/<Tile/ {
inopentag=1;
}
inopentag==1 && /title=/{
title=gensub(/.*title="([^"]+)".*/, "\\1", "g", $0);
}
inopentag==1 && /href=/{
href=gensub(/.*href="([^"]+)".*/, "\\1", "g", $0);
}
inopentag==1 && />/ {
inopentag=0;
indesc=1;
next;
}
indesc==1 && !/<\/Tile/{
gsub(/(\n|\t|\s{2,})/," ",$0);
desc=desc ($0);
next;
}
/<\/Tile/{
print "- [" title "](" href "):" desc;
indesc=0;
desc="";
title="";
href="";
next;
}
inopentag==0 && indesc==0{ print $0 }
' $1 > "$1.tmp";
cat "$1.tmp" > "$1";
rm "$1.tmp";
```
I then cleaned up each file changed by the script and fixed any
incorrect URLs.
* Update desktop access docs for 9.0
- Remove admonition about being in preview
- Add audit events listing
- Break reference.mdx up into separate pages
* Update tile icons
* Address review suggestions
* Another review pass
The linting applied to file via the tools in next appears to vary if the files are outside the /src directory: If the files are under /src, a rigorous lint is applied. If the files are outside of /src, a "less-rigorous" lint is applied, letting many legitimate issues slip through.
This patch alters the CI script to symlink the /workspace directory (the mount-point that GCB uses to inject code into the container running a build step) under the next image's /src/content directory, so that the correct, rigorous lint will be applied.
It also fixes the lint errors that have crept in during the time the linter was being incorrectly lenient.
See-Also: #9600
See-Also: #10107
* Recommend a highly available LDAP endpoint.
Early versions of our docs were worded in such a way that suggested
pointing Teleport at a single domain controller, which would result
in issues if a DC goes down for maintenance or due to error.
We also used to make insecure LDAP connections on port 389, and then
upgrade them using a STARTTLS operation. This is no longer supported.
Fix both of these issues by recommending a highly available LDAP
server and removing references to port 389.
* Add note about direct vs IoT mode
* Move the desktop config reference to a shared includes file
This will prevent the desktop access config examples from diverging
in different parts of the docs.
Additionally, simplify the example in the getting started guide,
as the goal of that guide is to get up and running quickly, not
to provide an exhaustive reference of all the configuration options.
* Refactor component heartbeat callbacks
Consolidate the OK/degraded broadcasts so the same logic isn't
duplicated for each component.
* Periodically update discovered desktops
Fixes#8644
* Allow customizing the desktop search
With this change, we support a discovery base DN other than '*',
and add support for further filtering the results with additional
LDAP filters.
Additionally, we filter out group managed service accounts, which
show up in LDAP searches for (objectClass=computer), despite not
being comptuers. (This is mostly harmless, as the service accounts
aren't present in DNS, so Teleport just ignores them. It does, however,
log a DNS error message that could be confusing, so we explicitly
filter these out just to be safe. This was discovered when testing
on AWS managed AD, which creates a gMSA for DNS.
* updating docs with service account tutorial
* minor corrections
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
* wording changes based on CR
* minor changes and fixes and adds updated photos with new naming convention
* Updating documentation
* updating gpo instructions to actually make sense
* nits
* adding instructions for exporting ca
* removing unhelpful screen shot
* Fixes quotes and updates to LDAPS
Co-authored-by: Ben Arent <ben@goteleport.com>
* clarifying comment
Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
Co-authored-by: Ben Arent <ben@goteleport.com>
Since our LDAP-based desktop discovery is not very configurable,
we opt to have it disabled by default.
Teleport will log a warning if desktop discovery is disabled and there
are no statically defined Windows desktops. In this case, the Windows
Desktop Service will simply sit idle, as there will be no desktops
available to connect to.
This commit implements the above, but also paves the way towards
a more flexible discovery system (described in the RFD).
We introduce a new config section:
discovery:
base_dn: '*'
filters:
- filter1
- filter2
For now, the only valid value for base_dn is the wildcard, which
instructs Teleport to search from the domain root. Additionally,
teleport will validate that any provided filters are valid but
does not currently respect them when performing the search.
Future updates will allow for changing the base DN to something
more specific and filtering the results with LDAP filters.
- Remove mentions of the "built in admin role" as we no longer create it
- Remove mentions to "beta" and use "preview" instead
- Add troubleshooting step for allowing DNS traffic
- Add a desktop access section to the main docs page
Fixes#8576
This approach avoids the need to put sensitive credentials in the
teleport config file, which is often shared for examples, testing
and troubleshooting purposes.
* Add RBAC for Windows desktop access
This commit adds RBAC checks for Windows Desktops as described in
RFD 33 and RFD 34:
- add Windows desktop logins & labels to role definition
- introduce new file config for host labels based on a regexp match
- auth server API performs access checking for Windows desktop resources
- add RDP client callback to authorize the user
- support user/role locks
- respect the client idle timeout setting
Note: in cases where an connection is terminated to to RBAC, the web UI
currently displays "websocket connection failed" because the connection
is closed from the server. We'll need to follow up with a nice error
message for the client side to improve the UX here.
Other changes:
* Remove OSS RBAC migration marked for deletion
* Stop creating a default admin role
* add wildcard desktop access to the preset access role
Updates #7761
* Desktop Access documentation
First draft of the Desktop Access docs. This is for Beta and has the
warnings on every page to make that clear.
* Apply suggestions from code review
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
Paul Gottschling