Adds `UpsertCertAuthority` to the `teleport.v1.trust.TrustService`
and deprecates the HTTP api. The `services.Trust` interface was
also updated to include a `context.Context` in both
`CreateCertAuthority` and `UpsertCertAuthority.
To ensure backwards compatibility the `auth.Client` will first
attempt to use the gRPC client and if that fails with a not
implemented error it will fallback to using HTTP.
Part of #6394
To prevent users from being able to directly connect to registered
OpenSSH (Agentless) nodes, the OpenSSH CA was introduced. When
connecting to Agentless nodes, the Proxy will forward the connection
so the session can be recorded. The forwarding SSH server is configured
to authenticate to the target node with a certificate signed by OpenSSH
CA, which users do not have access to.
This PR removes the `types.KindKubeService` objects that were
deprecated in Teleport 11.
Teleport 12 removed the double heartbeat and for Teleport 13 we can
safely drop the support of the old hearbeat based on `types.Server`
objects.
Clients older than Teleport 12 connecting to a Teleport 13 server will
fail since they cannot heartbeat using the old mechanism.
* * Add proper context handling to auth.AuthenticateUser.
* Move PublicKey field to AuthenticateUserRequest where it can be used
for actual authentication.
* Use a simple switch statement in /webapi/ssh/certs logic to switch
between password, otp, and eventually headless login.
* Add Headless flow to /webapi/ssh/certs login enpdoint.
* Add 3 minute callback timeout.
* Move the authorizer into its own package.
The Authorizer and associated functions and constants have been moved into
their own package `authz`. This will allow us to more easily create separate
services for gRPC functionality so that we're not pushing as much into the
`lib/auth` package.
Though this PR is large, the only actual code change here is making
`ContextForLocalUser` exported and changing the `permissions_test.go` so that
it doesn't rely on the `lib/auth` package.
* Use context functions.
* Test and linting fixes.
* Add in a temporary alias file to ensure e still compiles.
* Use functions instead of var aliases for performance reasons.
* Adding in godocs, cleaning up tests.
* Fix tests.
* Add a few more aliases.
* Start removing generateToken
* Refactor `tokens add` to use `CreateToken` RPC
* Correct deprecation version
* Remove calls to GenerateToken
* Start tests for token crud
* Allow user role rules to be provided wth CreateUserAndRole helper
* Add TestCreateToken to tls_test
* Add TestUpsertToken
* Add GetTokens test
* Add TestGetToken
* Add test for DeleteToken RPC
* Dedupe error assertions
* Add support for emitting trusted cluster token creation events to Create/UpsertToken
* Fix imports
* Change parameter order to appease linter
* Fix broken token expiry test
* Fix token expiry time for TestAuth_RegisterUsingToken
* Remove unnecessary cleanup
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Change test comment from deprecation notice
* `make gprc` after code review changes
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Rename tests
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* More test cases for GetTokens
* Improve message on duplicate token
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add Device to LocketTarget proto
* Refactor LockTarget.Match
* Test lib/srv.ComputeLockTargets
* Test lib/services.LockTargetsFromTLSIdentity
* Test device lock during cert issuance
* Add device lock targets where applicable
* Add --device to `tctl lock`
* Fix godocs (unrelated)
* Review: Drop redundant comments
* Allow the creation and usage of expiryless tokens
* Tidy up loose ends
* Fix imports
* Add tests for changes to expiryless behaviour
* Use new RPCs for new expiryless behaviour
* Add tests for new RPCs
* Remove unused import
* Recreate behaviour for tokens expiring in past
* Missing NoError check int ests
* Correctly americanize behavior
* Reproduce principal mismatch bug
* Compare TLS and SSH principals independent of order
* Review: Rename filterAndSortPrincipals, more accurate test examples
This PR includes a new Role resource version that is compatible with V5 spec.
The new resource introduces the `kubernetes_resources` definition that allows operators to limit the Kubernetes resources that each member can access. The `kubernetes_resources` entries must follow the following format: `{"kind":"<kind>", "namespace":"<namespace>","name":"<pod>"}`. Currently, it only supports objects of `kind` `pod`. Valid examples `<namespace>/<name>:
- `*/*`: matches all pods in all namespaces.
- `default/*`: matches all pods in the `default` namespace.
- `*/nginx-*`: matches every pod prefixed with `nginx-` in every namespace.
For older resource versions - V5, V4, V3 - `kubernetes_resources` is automatically populated with `{"kind":"pod","namespace":"*","name":"*"}` to keep compatibility. For the newest version, it's mandatory to define its value otherwise access to pods will be denied.
Part of #18434
* Limit Device Name and User Agent lengths
* Spelling correction
* Increase ballast size while trimming message size
* Cleanup error message
* Remove additional check
* Adjust tests
* Add tests for large AuditEvent
* Rename func to add clarity
* Move limit to const and lowercase field name
* Add test for invalid device name length
* Add a test for trimming the user agent
* Replace custom emitter with MockEmitter
* Add additional background to const
* Add additional comments
* Fix import ordering
* Refactor trimN to better handle heavily quoted queries and add tests
* Convert to error assetion func
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Finish test refactor
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Allow issuance of augmented, device-aware user certificates via auth.Server.
Device-aware certificate issuance takes as input existing user certificates and
augments them with the appropriate device extensions. The certificates to
augment must be valid, issued by the Teleport CA, match each other and the
current user, and share the same public key, among other criteria.
Device authentication is performed by Teleport Enterprise. The present PR adds
only the means to issue the certificates, but doesn't wire that functionality
to any endpoints.
gravitational/teleport.e#514
Many of our tests (db package, I'm looking at you) generate many RSA keys. This has two main side effects; makes our tests slow and flaky as CPU usage spikes in random moments when the tests are run in parallel.
This change pre-generates RSA keys at the beginning of each test module and reuse them in randomized order to reduce the situation that one key has been used multiple times in one test.
I had to move a few files to avoid circular dependencies.
Refactor the OIDC connector to its own type so it is simpler to move out
of the `auth.Server` struct. This follows the same pattern as was done
with the SAML connector - a new struct that the OIDC request methods are
attached to, plugged into the `auth.Server`.
Move some small amount of code around so when it comes to removing it
later, it is largely confined to the oidc files and large contiguous
blocks - makes it slightly simpler to review.
Make `ValidateACRValues` a pure function as it did not use anything from
the struct it was a method on, and move the test for it into
`oidc_test.go`.
Move `isHTTPS()` from `auth.go` to `oidc.go` as it is only used there
and will later move out.
Export `validateOIDCAuthCallbackReq` and `oidcAuthRawResponse` and move
them to `oidc.go` so the web handler can also be moved to enterprise.
Create a new type - `SAMLAuthService` - and move the implementation of
the SAML connector from the auth Service to this new type. This
decoupling will make it easier to move out of tree in a later commit.
This also lays the basic groundwork for running without the SAML
connector at all, returning a NotImplemented error for all the SAML
logic if the SAMLAuthService is not plugged in.
A number of names in the `auth` package have been exported to facilitate
moving the SAML connector out of this repository. The types exported do
not need to be exported for this commit, but for subsequent commits that
move the `SAMLAuthService` out of the `auth` package.
Also apply a small fix to to emit `apievents.SAMLConnector*` events of
`apievents.OIDCConnector*` events in the SAML connector.
* plumb context to keystore methods
Contexts are more relevant now with the GCP KMS keystore which makes
http requests, this commit makes sure they are passed everywhere they
are needed, with only a few `context.TODO`s sprinkled in.
* shrink/remove keystore interface
This commit introduces the keystore.Manager type to handle all
interaction between CA and the keystore backends.
Why:
* reduces the code that needs to be implemented per keystore backend to
only the necessary operations
* separate concerns of managing key material and handling CA data
structures
* define interfaces where they're used, not implemented
* delete net 245 lines of code
* reduce keystore.KeyStore stutter
Move the validation for SAML connectors being inserted or updated (Upsert)
from before the role check for Insert/Update to after it. The validation
can perform an HTTP GET request if the `entity_descriptor_url` field is
set. This should at least require that the user have permission to
Upsert a SAML OIDC connector.
Ensure that roles exist that are referenced in SAML connectors, as the
roles in SAML connectors are validated as the connector is inserted or
updated. The validation has moved to auth.Server (from grpcserver) so
that is now required in tests that operate against auth.Server.
Add a test case to test that an access denied error is returned when
upserting an invalid SAML connector instead of a validation failure,
showing that we are not using input from untrusted sources. Also test
that validation is still performed when access is permitted and that a
valid SAML connector can be upserted.
* Introduce Github Actions join support
* Go mod tidy
* run goimports on source files
* Address PR comments
* More PR review comments
* Changes to tests based on PR feedback
* Improve error message in github rule validation
* Add support for SHA
* Add short message describing which fields shouldb be included
* Allow for multiple installer scripts instead of using a singleton
* Resolve comments
- require name be provided to installer
- MetaNameClusterInstallerScript -> defaults.InstallerScriptName
- Require VerbList for GetInstallers
* Resolve comments
- Include the default installer in GetInstallers output
- Update how the scripts are prefixed
* resolve conflicts
* make the linters happy
* Add an installer script resource type and HTTP endpoint
* Add default installer scripts
* Resolve comments
- run `shfmt` over the installer script
- add MustNewInstaller
- move default installer logic to GetInstaller
- only include PublicProxyAddr in server.Config
* Resolve comments
- move from auth_with_roles -> auth/grpcserver
- document `MustNewInstallerV1`
## What
First part of the Kubernetes [Discovery RFD](https://github.com/gravitational/teleport/pull/13376/) to introduce a Kubernetes server per cluster.
This PR introduces a separate Kubernetes server that uses the already introduced `KubernetesClusterV3`.
## Compatibility
In previous versions, Kubernetes Clusters were part of regular `ServerV2` resource and this refactoring deprecates the `ServerV2` usage but keeps them for compatibility with previous version.
Everything is backward compatible, so v10 kubernetes agents and trusted clusters can connect fine.
## Next steps
Once this is merged, a new PR will introduce dynamic registration for Kubernetes Clusters discovered through EKS Discovery.
* Embed auth.Cache in auth.Server
* Hit the backend during Auth initialization
* Bypass the cache when rotating CAs
* Services.UpsertTrustedCluster is different
* Bypass the cache in waitForTunnelConnections
* Fix infinite recursion
* More cache bypassing during init and rotations
* Rename Services to Uncached in auth.Server
* Further cleanups
* Don't start the auth cache immediately
* Go back to Services rather than Uncached
* Comments and a missing method
Updates auth.ClientI to require that both methods take a
context.Context as the first argument. Context propogation required
some additional call sites to ensure the proper context is plumbed
down to the auth.ClientI calls.
* Add context to CreateWebSession and DeleteWebSession
Updates the WebService interface to include a context.Context in
CreateWebSession. Other function signatures were changed as needed
to propagte the context.Context into all the call site of
CreateWebSession.
* Ensure ListResources is accurate with denied resources
Prior to this tsh ls and the web UI were reporting different number
of resources when a user had role/roles that restricted access to
certain resources. This was caused by returning an incorrect
`NextKey` in the `ListResourcesResponse`.
In the event that `IterateResourcePages` was returning early due to
the callback requesting to stop iteration, the `NextKey` being returned
was the last key for the **current page** instead of the key for
the **next resource** in the page. This would cause N resources between
the last resource iterated on and the end of the page to be skipped.
To remedy this `IterateResourcePages` has been refactored to
`IterateResources`. This shifts the responsiblity of building the
`ListResourcesResponse` onto the caller and not the iterator. There
are no more pages to worry about, so the logic about what the next
key should be becomes simpler.
`TestListResources_WithRoles` was added to ensure that a user with
a set of roles that denies access is always returned the correct
resources from `ListResources` from both tsh and the web ui.
* Allow register passwordless on invite/reset
* Specify the type of device usage when registering new device
* Minor refactoring to reduce number of parameters to funcs
* Check if device register requested pwdless, response is pwdless capable
* Changes for tctl sso test, tctl sso configure commands.
* Log SSO diagnostic information for SSO test flows.
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Introduce Database Certificate Authority. New CA is used by Database Access to sign database certificates making them independent from Host CA.
Co-authored-by: Marek Smoliński <marek@goteleport.com>
rosstimothy