The Okta service and client have been introduced. This will allow for the
maintenance of Okta objects via our gRPC server and auth client. Some
additional improvements have been made so that the local okta service now
better reflects the gRPC definition.
Additionally, the gRPC authorization mechanism has been lifted out of
`lib/auth/grpcserver.go` and moved into a common authorizer. Finally, the
ability to check access to verbs has been lifted out of the `pluginsv1`
service into that same authorizer. This will hopefully provide a good base
for separate gRPC services in the future.
* Add CreatedBy and CreatedOn fields to locks.
* Move the setting of the CreatedBy and CreatedOn for locks to the server instead of the client.
* Add tests for the tctl resource lock import and for the tctl lock create command.
* Use clockwork for time in lock creation tests.
* Make fake clock optional and use the golang 0 date.
* Change CreatedOn to CreatedAt.
* Allow a custom time to be passed through as a fake clock.
* Actually accept a fake clock with useFakeClock.
* Pass Clock through as a configuration value when initializing Teleport for the tests.
* Test cleanup
* Set CreatedBy and CreatedAt values in test mocks.
* Fix failing test from enabling clock passthrough to auth.
This PR removes the `types.KindKubeService` objects that were
deprecated in Teleport 11.
Teleport 12 removed the double heartbeat and for Teleport 13 we can
safely drop the support of the old hearbeat based on `types.Server`
objects.
Clients older than Teleport 12 connecting to a Teleport 13 server will
fail since they cannot heartbeat using the old mechanism.
* Move the authorizer into its own package.
The Authorizer and associated functions and constants have been moved into
their own package `authz`. This will allow us to more easily create separate
services for gRPC functionality so that we're not pushing as much into the
`lib/auth` package.
Though this PR is large, the only actual code change here is making
`ContextForLocalUser` exported and changing the `permissions_test.go` so that
it doesn't rely on the `lib/auth` package.
* Use context functions.
* Test and linting fixes.
* Add in a temporary alias file to ensure e still compiles.
* Use functions instead of var aliases for performance reasons.
* Adding in godocs, cleaning up tests.
* Fix tests.
* Add a few more aliases.
* Start removing generateToken
* Refactor `tokens add` to use `CreateToken` RPC
* Correct deprecation version
* Remove calls to GenerateToken
* Start tests for token crud
* Allow user role rules to be provided wth CreateUserAndRole helper
* Add TestCreateToken to tls_test
* Add TestUpsertToken
* Add GetTokens test
* Add TestGetToken
* Add test for DeleteToken RPC
* Dedupe error assertions
* Add support for emitting trusted cluster token creation events to Create/UpsertToken
* Fix imports
* Change parameter order to appease linter
* Fix broken token expiry test
* Fix token expiry time for TestAuth_RegisterUsingToken
* Remove unnecessary cleanup
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Change test comment from deprecation notice
* `make gprc` after code review changes
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Rename tests
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* More test cases for GetTokens
* Improve message on duplicate token
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Allow the creation and usage of expiryless tokens
* Tidy up loose ends
* Fix imports
* Add tests for changes to expiryless behaviour
* Use new RPCs for new expiryless behaviour
* Add tests for new RPCs
* Remove unused import
* Recreate behaviour for tokens expiring in past
* Missing NoError check int ests
* Correctly americanize behavior
* Extract entity ID when creating SAML service provider.
The entity ID will be parsed from the entity descriptor metadata when the
service provider's entity descriptor is set. The motivation of this PR is to
do the following:
* Extract the entity ID from the entity descriptor during the creation of the
SAML IdP service provider.
* Prevent the creation of service providers in the backend that have an
entity ID that does not match the entity ID represented in the entity
descriptor.
* When reading or listing service providers, prevent the parsing of every
entity descriptor during the listing.
The goal here is to make it performant to look up entity descriptors by their
entity ID without incurring the cost of parsing every single entity descriptor
to determine the entity ID.
* Feedback, eliminating the parsing from the object, pushing parsing verification into the local service.
* Fix up tests, e_imports.
* Fix comment in types.proto.
* Remove dead comment.
* Deduplicate entity ID in update as well.
* Small refactor to move parse out of lock.
* Remove XML parsing from type, fix grpcserver test, fix locking boundaries.
* Tim's and Edoardo's feedback.
* Fix cache test.
* Update lib/services/local/saml_idp_service_provider.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Expanding the comments on the EntityID field.
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Test device authorization during cert issuance
* Skip device validation when issuing App or Windows certs
* Add an early check for GenerateUserSingleUseCerts
* SAML IdP service provider APIs
The SAML IdP service provider's associated APIs have been implemented. This
will support the use of Teleport as a SAML IdP by allowing Teleport users to
add service providers through the API.
* Correct permissions.
* Update lib/auth/grpcserver_test.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
This PR includes a new Role resource version that is compatible with V5 spec.
The new resource introduces the `kubernetes_resources` definition that allows operators to limit the Kubernetes resources that each member can access. The `kubernetes_resources` entries must follow the following format: `{"kind":"<kind>", "namespace":"<namespace>","name":"<pod>"}`. Currently, it only supports objects of `kind` `pod`. Valid examples `<namespace>/<name>:
- `*/*`: matches all pods in all namespaces.
- `default/*`: matches all pods in the `default` namespace.
- `*/nginx-*`: matches every pod prefixed with `nginx-` in every namespace.
For older resource versions - V5, V4, V3 - `kubernetes_resources` is automatically populated with `{"kind":"pod","namespace":"*","name":"*"}` to keep compatibility. For the newest version, it's mandatory to define its value otherwise access to pods will be denied.
Part of #18434
Enable device authorization by plugging into auth.Authorizer and selectively
disabling it for processes that don't (yet) want device authz.
`GenerateUserCerts` is modified to issue device-aware certificates (DB/k8s
access), as well as `CreateAppSession`. The latter is not necessary for DB
access, but it does enable App Access to issue device-aware certs - commands
such as `tsh apps login` and `tsh proxy app` can benefit from those.
DB access is now ready to benefit from trusted devices. k8s access is likely
supported with these changes as well, but I've postponed enabling it after I've
done more testing.
Both `GenerateUserCerts` and `GenerateUserSingleUseCerts` now do early
device-aware authorization; this creates a better UX, as it allows us to return
error messages directly via `tsh`, instead of having to pipe them through
database-specific protocols. Further PRs could improve errors for scenarios
where the existing certificate became lacking due to higher server-side authz
enforcement.
gravitational/teleport.e#514
Add device-aware authorization for SSH access, including both long-lived and
single-use certificates.
If the device trust mode is set to "required", then the presence of the
corresponding extensions is enforced. (Requires Teleport Enterprise.)
Adds logic related to TLS validation and single-use certificates as well, where
appropriate. TLS device-aware validation is not wired into Teleport yet, but
will be in follow up PRs.
gravitational/teleport.e#514
* DatabaseService resource: client and server CRUD
In the context of Teleport Discover, we must be able to known if there's
any DatabaseService available to proxy a given Database resource.
If there's none available, we will offer a script for the user to run
and install a DatabaseService which proxies the desired Database
resource.
By DatabaseService, we mean the process that Teleport binary manages
when the `teleport.yaml` config has the following section:
```yaml
db_service:
enabled: "yes"
```
To accomplish this we are creating a new resource: DatabaseService.
The UI will fetch all DatabaseServices and check if there's any
ResourceMatcher that matches the DatabaseLabels.
A previous PR created the DatabaseService resource.
This PR creates all the necessary CRUD operations:
- Add Service to manage DatabaseServices resources in the backend.
- Add GetAll, Upsert, Delete and DeleteAll operations to Client.
- Add DatabaseService support to ListResources.
- Add WebAPI endpoint to list DatabaseServices using ListResources.
The next PR will add the heartbeat mechanism to the DatabaseService
process.
Move the validation for SAML connectors being inserted or updated (Upsert)
from before the role check for Insert/Update to after it. The validation
can perform an HTTP GET request if the `entity_descriptor_url` field is
set. This should at least require that the user have permission to
Upsert a SAML OIDC connector.
Ensure that roles exist that are referenced in SAML connectors, as the
roles in SAML connectors are validated as the connector is inserted or
updated. The validation has moved to auth.Server (from grpcserver) so
that is now required in tests that operate against auth.Server.
Add a test case to test that an access denied error is returned when
upserting an invalid SAML connector instead of a validation failure,
showing that we are not using input from untrusted sources. Also test
that validation is still performed when access is permitted and that a
valid SAML connector can be upserted.
Replace role/authPref RequireSessionMFA (bool) with RequireMFAType
(string).
- Add new RequireMFAType constant values with custom boolean marshalling.
- Add RequireMFAType to role and auth preference and deprecate
RequireSessionMFA.
- Add session-mfa override login when hardware_key_touch is enforced.
- Add protobuf enum for RequireMFAType.
- Add support for proto enums in protoc-gen-crd and update Kubernetes
Operator manifests.
* Tag forwarded spans with custom attributes
Adds a `teleport.forwarded.for` attribute to a resource or
all spans that are forwarded to the auth server. This allows
consumers of the spans to identify where the spans are coming
from and take possible action. In some scenarios it may
be desirable to drop forwarded spans along the collection
process, by tagging them we can provide a way for those
consumers to identify them. It also allows for potentially
identifying a malicious user that may be trying to spam the
telemetry backend with spans.
Part of #12241
* Embed auth.Cache in auth.Server
* Hit the backend during Auth initialization
* Bypass the cache when rotating CAs
* Services.UpsertTrustedCluster is different
* Bypass the cache in waitForTunnelConnections
* Fix infinite recursion
* More cache bypassing during init and rotations
* Rename Services to Uncached in auth.Server
* Further cleanups
* Don't start the auth cache immediately
* Go back to Services rather than Uncached
* Comments and a missing method
Fixes total count errors for the web UI:
- Adds de-duplicating matches for `FakePaginate` func.
- This change does makes `FakePaginate` less efficient b/c
it will always run filter for every resource per fetch versus just
running it on the initial fetch to get the total count.
- Removes inaccurate de-dupping in the web api layer since we
do it from the back now
- Adds another criteria when de-duplicating `applications` by checking
for its `public_addr` as well as its name.
Implement passwordless cluster settings, as described by RFD 52: Passwordless
[1]. See https://github.com/gravitational/teleport/pull/11716 for recent RFD
changes.
Add the "passwordless" connector and allows cluster admins to configure it as
the cluster default.
teleport.yaml:
```yaml
auth_service:
authentication:
type: local
second_factor: on
webauthn:
rp_id: example.com
passwordless: true # enables/disables passwordless
connector_name: passwordless # sets passwordless as the default
```
`tsh` obeys the connector name if present. User overrides are possible via `tsh
--auth=local` or `tsh --auth=passwordless`. The `tsh --pwdless` flag is now
removed, as discussed in recent RFD changes.
Web API `/ping` and `/ping/{connector}` endpoints are changed to support
"passwordless" and to provide other necessary information.
#9160
[1] https://github.com/gravitational/teleport/blob/master/rfd/0052-passwordless.md#cluster-settings
* Add passwordless toggle to AuthPreferenceSpecV2 proto
* Update generate protos
* Add AuthPreference fields and validation
* Reserve system connector names
* Distinguish between type=local and local connector
* Add passwordless option to teleport.yaml
* Do /ping and /ping/{connector} changes
* Make tsh respect the passwordless connector, remove --pwdless
Wire passwordless registration and authorization into Auth and Proxy APIs, thus
making passwordless logins possible.
API changes are described by RFD 52: Passwordless [1].
#9160
[1] https://github.com/gravitational/teleport/blob/master/rfd/0052-passwordless.md#authentication-api-changes
* Add passwordless settings to Auth protos
* Update generated protos
* Register: Apply DeviceUsage in lib/auth
* Register: Apply DeviceUsage in lib/web
* Login: Generate passwordless challenge
* Login: Allow passwordless authentication
* Wire passwordless in lib/web endpoints
* Make mocku2f passwordless setup a bit nicer
Passwordless endpoints are rate limited because they allow unauthenticated
challenge generation. The endpoint rate limits are applied in addition to
(pre-existing) storage limits.
Setting limits to Auth only would be sufficient, but it seems best to apply
limits to Proxy as well, so we may spare Auth of unnecessary load.
Auth already has a framework for RPC rate limiting, so we took advantage of it.
The solution for the Proxy is rather simple - the handler is decorated with the
appropriate limits.
#9160
* Fix shadowing of grpcServer variable
* Add rate limiting for CreateAuthenticateChallenge
* Add rate limiting for /mfa/login/begin
* Safe parallel tests
* The web UI needed to show the total count of resources available after filter
* ListResources response returns as a struct to make adding extra fields easier
Alias the "u2f" second factor mode to "webauthn", effectively sunsetting U2F in
favor of WebAuthn.
The change effectively disables "U2F mode" server-side, making Teleport use
WebAuthn instead. This is in line with our compatibility promise, as Teleport
8.x clients are already WebAuthn-capable (and thus have no problems talking to
the cluster).
I have cleaned up a good chunk of U2F references in lib/web and lib/client, plus
a few other places. Changes on lib/auth are just the necessary to get the tests
back to good standing. There is more work to be done, but this seems enough for
a single PR.
#10375
* Remove "Disabled" field from types.Webauthn
* Update generated protos
* Treat second_factor "u2f" as "webauthn"
* Remove references to Webauthn.Disabled
* Remove U2F from lib/web/
* Remove U2F from lib/client/
* Remove U2F from lib/auth/ (partially)
* Fix issues after rebase on master
* Fix typo
* Define sorters for resource Server, AppServer, and DbServer
* Add sorting to ListResources in caching and presence layer
* ListResources now returns nextKey set to the limit+1th item,
previously it returned a possible next key, where there
may or may not be more results.
This adds an rpc UpsertKubeServiceV2 to replace UpsertKubeService. Currently, kubernetes service does not have a keepalive heartbeat unlike app, db, and windows service. This brings functionality in line with the others. This would allow for future use of the keepalive to track connected agents via prometheus metrics.
- Fixes a bug where proper user lock expire date wasn't used
- Have CreateAuthenticateChallenge return error as is instead
of overriding all errors with AccessDenied, which fixes a
backwards comp error where older proxies assume
AccessDenied type error means user got locked
Michael Wilson
