This commit reverts the namespace validation added in #19696.
The new namespace validation is a breaking change that resulted in users
being locked if roles contained invalid namespaces.
We were returning a trace.BadParameter, however we should return
trace.IsNotFound.
The godoc suggests that error.
The tests suggests that error, but they were only matching for type
which is the same for all the trace.XYZ errors.
Tests are now using the `trace.Is<Error>` helper method to correctly
validate the error message.
The side effect of this change is that we were receiving a lot of logs
when interpolating traits in a role.
That log is supressed when the error is NotFound.
That was not the case before this commit: the error was a BadParameter
one, so the log is written (as debug, but still a lot of noise).
Co-authored-by: Vitor Enes <vitor.duarte@goteleport.com>
Before this commit, only a single transformation like `email.local` or
`regexp.replace` was allowed in role templates.
With this commit now users can write:
- `email.local(regexp.replace(external.email, "_", "-"))`
- `regexp.replace(email.local(regexp.replace(external.email, "_", "-")), "dev", "admin")`
This commit also allows the above expressions to not contain any
variable, i.e., it allows constant expressions like
`email.local("vitor@goteleport.com")`.
`require` is a sister package to `assert` that terminates the test on
failure. `assert` records the failure but lets the test proceed, which
is un-intuitive.
Also update all existing tests to match.
Matchers use a similar syntax to Expressions, but behave differently:
- Expressions get evaluated - they interpolate some values and return a
final string.
- Matchers check whether some string matches a value
Matchers implement the same logic as utils.SliceMatchesRegex and add 2
new functions:
- {{regexp.match("foo")}} - match input against a raw regex
- {{regexp.not_match("foo")}} - same as match, but inverts the result
No need to handle literal expressions (e.g. without "{{foo.bar}}"
substitutions) at the higher level. Something like "foo" is a valid
expression which always returns "foo" regardless of traits.
This commit fixes#3369, refs #3374
It adds support for kuberenetes_users section in roles,
allowing Teleport proxy to impersonate user identities.
It also extends variable interpolation syntax by adding
suffix and prefix to variables and function `email.local`:
Example:
```yaml
kind: role
version: v3
metadata:
name: admin
spec:
allow:
# extract email local part from the email claim
logins: ['{{email.local(external.email)}}']
# impersonate a kubernetes user with IAM prefix
kubernetes_users: ['IAM#{{external.email}}']
# the deny section uses the identical format as the 'allow' section.
# the deny rules always override allow rules.
deny: {}
```
Some notes on email.local behavior:
* This is the only function supported in the template variables for now
* In case if the email.local will encounter invalid email address,
it will interpolate to empty value, will be removed from resulting
output.
Changes in impersonation behavior:
* By default, if no kubernetes_users is set, which is a majority of cases,
user will impersonate themselves, which is the backwards-compatible behavior.
* As long as at least one `kubernetes_users` is set, the forwarder will start
limiting the list of users allowed by the client to impersonate.
* If the users' role set does not include actual user name, it will be rejected,
otherwise there will be no way to exclude the user from the list).
* If the `kuberentes_users` role set includes only one user
(quite frequently that's the real intent), teleport will default to it,
otherwise it will refuse to select.
This will enable the use case when `kubernetes_users` has just one field to
link the user identity with the IAM role, for example `IAM#{{external.email}}`
* Previous versions of the forwarding proxy were denying all external
impersonation headers, this commit allows 'Impesrsonate-User' and
'Impersonate-Group' header values that are allowed by role set.
* Previous versions of the forwarding proxy ignored 'Deny' section of the roles
when applied to impersonation, this commit fixes that - roles with deny
kubernetes_users and kubernetes_groups section will not allow
impersonation of those users and groups.
Vitor Enes