When the SAML IdP CA was added, it was not added to `checkResourceConsistency`
during `auth.Init`. This made bootstrapping a fresh server from a cluster state
impossible from versions of Teleport that support the SAML IdP CA, as the
`auth.Init` process couldn't recognize the CA.
With this change, the SAML IdP CA is now handled properly by
`checkResourceConsistency`, which makes bootstrapping a cluster from a cluster
state possible again.
Closes#22662
* Use `ctx` rather than `context.TODO()` where available
* Further propagation of context
* Use `context.Background()` instead of `context.TODO()` where appropriate in tests
* Further remove `context.TODO` from tests
* Appease linter on parameter order
* Add RBAC labels for Databas Services access
This PR adds a new set of Labels that controls access to the
DatabaseService resource.
We changed the `RoleSet.checkAccess` to allow for checks in Resources
without Labels.
However adding complexity to this function is something that can bit us
in the future.
So, this PR reverts that change and adds a new set of labels.
Those labels will control whether the RoleSet has access to
DatabaseServices.
Given that this is a new condition that we add to the default `editor`
role, we had to create a migration/backfill for the roles that don't
have them.
This allow us to migrate the roles created previously and add this new
allow condition.
* remove preset for remote proxy and database labels
* Remove db_service_labels wildcard from editor preset role
* Fix early exit logic
* WIP adding OpenSSH CA
* fix creating OpenSSH CA for tests
* fix a test name and tctl usage flag
* fix 'tctl status' not displaying openssh CA sometimes
* add OpenSSH CA to TestInit_bootstrap, remove TLS key pair
* add OpenSSH CA to a few more places
* make help text of 'tctl auth rotate' more helpful and accurate
* fix web cert export test
* tbot doesn't need to know about OpenSSH CA
* address feedback
* fix comment formatting
Many of our tests (db package, I'm looking at you) generate many RSA keys. This has two main side effects; makes our tests slow and flaky as CPU usage spikes in random moments when the tests are run in parallel.
This change pre-generates RSA keys at the beginning of each test module and reuse them in randomized order to reduce the situation that one key has been used multiple times in one test.
I had to move a few files to avoid circular dependencies.
We were inconsistent throughout the codebase and would sometimes
use the slices package and other times use our own equivalents
in api/.
This removes our versions in favor of the golang.org/x package that
does the same, which has the added benefit of reducing the surface
area of the public API module.
Note: despite existing uses of the slices package, for some reason
it didn't show up in go.mod or go.sum. Fixed that too.
Address TODOs, add deprecation warnings and remove as many U2F code references
as possible.
Existing behavior is kept unaltered: it's still possible to inform Teleport of
old U2F AppIDs and U2F configurations are still silently converted to WebAuthn.
There's no reason to break that, so we don't.
Most server-side references to SecondFactorU2F are removed, but client-side
references remain: this makes it possible to interop newer clients with old
clusters (something else may break, but hopefully not this part).
Closes#10375.
* Add Default Allow Rules for new resources
When adding a new resource, we usually also set some default access
rules on the preset Roles (editor, access, auditor).
However, for existing clusters those new rules are not applied when we
start the cluster with the new teleport version.
This then requires manual intervention for setting up access to those
resources.
This PR adds a new mechanism to remove the need for manual intervention.
For each of the preset rules, we'll have default rules.
When the server starts, it tries to create the preset roles but if they
exist, instead of failing we will:
- check if the resource exists either in allow or deny rules
- if so, then we don't do anything else
- add the default rule
This assumes it's ok to re-create the default rules when the admin
removes those resources from the allow/deny rule set.
* add log when adding default allow rules
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* configure golangci-lint misspell to check for anglicized spellings
* Americanize spellings
* fix aws constant value with british spelling 🇬🇧
* update api types with americanized spellings
* use american spellings .cloudbuild/scripts
After the merge of https://github.com/gravitational/teleport/pull/12674 we no longer use the following configuration:
```yaml
teleport:
ca_signature_algo: "rsa-sha2-512"
```
As we now rely upon the `x/crypto` package to choose the signing algorithm (it defaults to `rsa-sha2-512`)
**Demo**
If we set `ca_signature_algo` (the value is irrelevant) and start `teleport` we get:
```shell
root@marco:/workspace# teleport start --debug
2022-06-02T09:33:58Z WARN ca_signing_algo config option is deprecated and will be ignored, we'll always default to rsa-sha2-512. config/configuration.go:348
2022-06-02T09:33:58Z INFO Generating new host UUID: b001159a-10e0-49a7-b4dc-61c73fbe9e42. service/service.go:726
...
```
Fixes#12905
U2F facets don't serve a purpose since Webauthn became the de-facto MFA
mechanism. This should make it easier for users to write v10-style
authentication configs.
The remaining U2F fields are still relevant for when we derive Webauthn settings
from U2F, so those are kept (and validated).
Note that we still keep the fileconf field, since we don't want configs to
needlessly break during version upgrades.
#10375
* Remove references to U2F.Facets
* Remove Facets from U2F proto
* Reinstate proto Facets field
U2F gets marshaled as JSON to storage, so we better keep the field to
avoid issue with resource configs.
* Add deprecation notice on comment
* Update generated protos
This commit upgrades the version of x/crypto we use, to the current latest
`go get -u golang.org/x/crypto`
We also replaced the deprecated variables and updated the tests to match the
current default KEX Algos
The x/crypto didn't support RSA-SHA2 algos, so we developed our own algorithm
signer. This is no longer the case, and after upgrading x/crypto to 20220518 we
can safely remove the custom code we have.
From OpenSSH 8.8+, it works if we explicitly add the older algorithm
Somthing like this: `./ssh -vvv -oPubkeyAcceptedAlgorithms=+ssh-rsa-cert-v01@openssh.comteleportadmin@moon.marco.mydemo`
* Add tracing instrumentation for ssh clients/servers
Add tracing context to the existing ProxyHelloSignature to provide
span information across ssh connections. To add span context per
ssh session on top of new connections, the same tracing context is
passed in the first global request of the session.
In order to ensure that tracing context is pulled from and inserted
into the proper context.Context, some interfaces and methods were
changed to take one as the first argument.
Introduce Database Certificate Authority. New CA is used by Database Access to sign database certificates making them independent from Host CA.
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Fix goroutine and memory leak in watchCertAuthorities
The CA Watcher was blocking both on writing to a channel when the watcher
was closed and on HTTP calls that had no request timeout or context passed
to cause cancellation.
All resourceWatcher implementations that had a bug which may cause them to block
on writing to a channel forever were fixed by selecting on the write and ctx.Done.
Adding context.Context to all Get/Put/Post/Delete methods on the auth HTTPClient to
force callers to propagate context. Prior all calls used context.TODO which
prevents requests from being properly cancelled.
Add context propagation to RotateCertAuthority, RotateExternalCertAuthority,
GetCertAuthority, GetCertAuthorities. This is needed to get the correct ctx
from the CertAtuhorityWatcher all the way down to the HTTPClient that makes
the call.
Closes#10648
Removing the old roles migration allows Teleport to start even in the face of
invalid roles. The system will still be largely unusable, but `tctl rm` is now
possible as a fallback.
Added logging makes it easier to determine the bad role.
Turns this scenario:
```shell
$ teleport start
> (...)
> ERROR: initialization failed
> could not parse 'where' rule: "!contains(ssh_session.participants, user.metadata.name)", error: ssh_session.participants is not defined
> (teleport exits)
```
into this:
```shell
$ teleport start
> (...)
> 2021-11-18T16:50:29-03:00 WARN [AUTH:1:CA] "Re-init the cache on error: role \"join_own_sessions_only\"\n\tcould not parse 'where' rule: \"!contains(ssh_session.participants, user.metadata.name)\", error: ssh_session.participants is not defined." cache/cache.go:725
> 2021-11-18T16:50:29-03:00 WARN [AUTH:1:CA] Cache "auth" first init failed, continuing re-init attempts in background. error:[
> ERROR REPORT:
> Original Error: *trace.BadParameterError could not parse 'where' rule: "!contains(ssh_session.participants, user.metadata.name)", error: ssh_session.participants is not defined
> Stack Trace:
> (...)
> User Message: role "join_own_sessions_only"
> could not parse 'where' rule: "!contains(ssh_session.participants, user.metadata.name)", error: ssh_session.participants is not defined] cache/cache.go:678
> 2021-11-18T16:50:35-03:00 WARN [AUTH:1:CA] "Re-init the cache on error: role \"join_own_sessions_only\"\n\tcould not parse 'where' rule: \"!contains(ssh_session.participants, user.metadata.name)\", error: ssh_session.participants is not defined." cache/cache.go:725
> (teleport running, tctl works)
```
See https://github.com/gravitational/teleport/issues/9059 for the larger
context.
* Remove Teleport 4.3 role migration
* Remove unused parameters
* Add role name to GetRoles validation failures
* Add RBAC for Windows desktop access
This commit adds RBAC checks for Windows Desktops as described in
RFD 33 and RFD 34:
- add Windows desktop logins & labels to role definition
- introduce new file config for host labels based on a regexp match
- auth server API performs access checking for Windows desktop resources
- add RDP client callback to authorize the user
- support user/role locks
- respect the client idle timeout setting
Note: in cases where an connection is terminated to to RBAC, the web UI
currently displays "websocket connection failed" because the connection
is closed from the server. We'll need to follow up with a nice error
message for the client side to improve the UX here.
Other changes:
* Remove OSS RBAC migration marked for deletion
* Stop creating a default admin role
* add wildcard desktop access to the preset access role
Updates #7761
This commit contains 2 changes:
1. Rename GenerateServerKeys to GenerateHostCerts.
This is a more accurate name and consistent with the existing
GenerateUserCerts endpoint.
2. Change the request type to include a single role, rather than a
list of roles. We only ever allowed a single role in the list
anyway, so this change will prevent future mis-use of the API.
Note: a side effect of this change is we now have two similar endpoints:
- GenerateHostCert: old API that generates SSH cert only
- GenerateHostCerts: a newer API that generates SSH and TLS certs
To avoid making this change too big, we'll aim to deprecate
GenerateHostCert in the future.
Presently, teleport start --bootstrap state.yaml fails due to incorrect
handling of JWT CAs, even when the data is generated using
tctl get all --with-secrets.
Fixes https://github.com/gravitational/teleport/issues/7853.
* Correctly validate JWT CertAuthorities on bootstrap
* Remove commented code
* hsm: migrate CA storage schema
Migrate types.CertAuthorityV2 schema according to
https://github.com/gravitational/teleport/blob/master/rfd/0025-hsm.md#backend-storage
Includes proto changes, types.CertAuthority wrapper changes and data
migration.
Note that we keep and update the old fields for backwards-compatibility.
If a cluster is upgraded to v7 and then downgraded back to v6,
everything should keep working.
* Address review feedback
Michael Wilson