The HTTP client created by `auth.NewClient` has an idle timeout of
30s and each instance periodically gets cert authorities in
`TeleportProcess.syncRotationStateCycle`. If there has been no
activity when the ticker expires then the request will result in a
brand new connection to Auth to be established. This can cause a
spikes in open file descriptors on the Proxy when there are a large
number of instances connected via a tunnel.
To prevent periodic dialing when retrieving cert authorities the
endpoint has been migrated to the new Trust gRPC service. For now
only the get endpoint has been migrated but the rest of the CRUD
operations for cert authorities should be migrated from the HTTP
api to the gRPC service as well.
When desktop discovery via LDAP is enabled, there is enough traffic
on the connection for it to remain open for long periods of time.
If discovery is disabled and there are not frequent connections to
desktops, the LDAP server may close the connection.
In this case, future connection attempts will fail when making an
LDAP query for the user's SID. Now we detect closed connections in
this code path and attempt to open a new LDAP connection.
The first connection attempt after the connection is closed will
incur some extra latency, as we obtain a new cert when refreshing
the LDAP connection.
Additionally, increase the heartbeat period for static hosts from
5s to 5m. These hosts are infrequently changing, so heartbeating
every 5 seconds is an inefficient use of resources.
Fixes#20904
Previously we were looking up a user's SID by their ldap "name" attribute,
which is their modifiable display name. This commit has us looking them
up by their SAM Account Name, which is their unmodifiable username.
This commit further refactors existing work to make windows LDAP and Certificate services available to other parts of Teleport. In particular, this PR moves the majority of the LDAP and CA services from windows_server.go into the windows package and into a new structure CertificateAuthority
rosstimothy