This commit enables login rule evaluation during login for users logging
in with a GitHub connector.
The GitHub connector is a bit different from the SAML and OIDC
connectors in that the user roles are not mapped from the traits
(claims/assertions) but from the user's GitHub organizations and teams
directly.
This makes login rules slightly less useful for GitHub logins because
they cannot affect the user's roles, only their traits.
However, GitHub login is mostly an OSS feature and login rules will be
enterprise-only.
Any enterprise users making use of GitHub login will still be able to
use some of the features (trait mapping).
Create a new type - `SAMLAuthService` - and move the implementation of
the SAML connector from the auth Service to this new type. This
decoupling will make it easier to move out of tree in a later commit.
This also lays the basic groundwork for running without the SAML
connector at all, returning a NotImplemented error for all the SAML
logic if the SAMLAuthService is not plugged in.
A number of names in the `auth` package have been exported to facilitate
moving the SAML connector out of this repository. The types exported do
not need to be exported for this commit, but for subsequent commits that
move the `SAMLAuthService` out of the `auth` package.
Also apply a small fix to to emit `apievents.SAMLConnector*` events of
`apievents.OIDCConnector*` events in the SAML connector.
Update metalinter, fix a few lint warnings and replace deprecated linters.
`deadcode`, `structcheck` and `varcheck` are abandoned and now replaced by [`unused`][1].
Since 1.19, `go fmt` reformats godocs according to https://go.dev/doc/comment. I've done a bulk-reformatting of the codebase to keep the linter happy. Backporting is mostly harmless (the exception being `lib/services/role_test.go`, that for some reason breaks the _old_ linter using the new format).
[1]: https://golangci-lint.run/usage/linters/
* Bump golangci-lint version
* Replace abandoned linters
* Fix bodyclose on lib/auth/github.com
* Fix bodyclose on lib/kube/proxy/streamproto/proto_test.go
* Fix bodyclose on lib/srv/alpnproxy/proxy_test.go
* Fix bodyclose on lib/web/conn_upgrade_test.go
* Silence staticcheck on lib/kube/proxy/forwarder_test.go
* Silence staticcheck on lib/utils/certs_test.go
* Address BuildNameToCertificate deprecation warnings
* Run `go fmt ./...`
* Run `go fmt ./...` on api/
* Ignore formatting in role_test.go
* Remove redundant initializers in lib/srv/uacc/
* Update e/
* added check that blocks enterprise Github organizations using external SSO from using Github auth connectors on Teleport OSS
* added details to docs and changelog
* move check from init to on login
* cache org sso status; address small pieces of feedback
* use utils.FnCache instead of 3rd party cache
* addressed feedback
* addressed feedback
* revised docs
* addressed more feedback
* remove notes in changelog
* removed unused interface
This change, along with gravitational/webapps#530, adds a new error message for when a user successfully authenticates with SSO but fails to match any roles.
Refactored "lib/services/suite" and "lib/services/local" packages to use
testify instead of gocheck.
Swapped backend from "lite" to "memory" to cut time to run tests in
half.
* Update logrus package to fix data races
* Introduce a logger that uses the test context to log the messages so they are output if a test fails for improved trouble-shooting.
* Revert introduction of test logger - simply leave logger configuration at debug level outputting to stderr during tests.
* Run integration test for e as well
* Use make with a cap and append to only copy the relevant roles.
* Address review comments
* Update integration test suite to use test-local logger that would only output logs iff a specific test has failed - no logs from other test cases will be output.
* Revert changes to InitLoggerForTests API
* Create a new logger instance when applying defaults or merging with file service configuration
* Introduce a local logger interface to be able to test file configuration merge.
* Fix kube integration tests w.r.t log
* Move goroutine profile dump into a separate func to handle parameters consistently for all invocations
* Support resource-based bootstrapping for backend.
Outside of static configuration, most of the persistent state of an
auth server exists as a collection of resources, stored in its
backend. The resource API also forms the basis of Teleport's more
advanced dynamic configuration options.
This commit extends the usefulness of the resource API by adding
the ability to bootstrap backend state with a set of previously
exported resources. This allows the resource API to serve as a
rudimentary backup/migration tool.
Notes: This features is a work in progress, and very easy to misuse;
while it will prevent you from overwriting the state of an existing
auth server, it won't stop you from bootstrapping into a wildly
misconfigured state. In general, resource-based bootstrapping is
not a complete solution for backup or migration.
* update e-ref
Moved expiry field from spec to metadata for services.Users and updated
expiry check to prefer metadata and fallback to spec if not found. Added
test coverage.
Nic Klaassen