opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-11-01 13:39:37 +08:00
Code Issues Packages Projects Releases Wiki Activity
12,109 Commits 9,614 Branches 7,118 Tags
acb255cd883d3d94de949f54e322edacab736112
Commit Graph
32 Commits
Author SHA1 Message Date
Isaiah Becker-Mayer e2df4a31ba Fix incorrect login options for Windows Desktops (#22118) 
* Removes desktop logins from the ACL and adds them to each Desktop resource
as returned to the frontend. This behavior parallels what's currently being
done with other similar resources such as Nodes, and fixes a bug where
users were able to see all the logins permitted by their roles on every
desktop "connect" dropdown, even if the role permitting that login didn't
apply to a given desktop.

* Extracts common logic out of GetWindowsDesktopLogins (now GetAllowedWindowsDesktopLogins), uses it to create a GetAllowedServerLogins as well, tests both of them together, removing EnumerateServerLogins

* reduce unnecessary looping by using maps

* fixes flakiness by sorting lists

* uses require.ElementsMatch rather than manually sorting lists

* consolidates duplicated logic

* Consolidates separate server and desktop logic into a single GetAllowedLoginsForResource

* fixes tests

* fixes import order and test
 2023-02-24 21:06:38 +00:00
Tiago Silva 1bbaf23d86 Add Pod resource search web API (#20183) 
This PR introduces a web API for users to search, from the UI, for Kubernetes pods whose access is only granted by their `search_as_roles`.
The new API can be used to create access requests for those resources.

The new API is located
```bash
curl 'https://<proxy_endpoint>:3080/v1/webapi/sites/<teleport_cluster>/pods?kubeCluster=<kube_cluster>&kubeNamespace=<kube_namespace|empty>&searchAsRoles=yes&limit=10&startKey=&query=&search=&sort=name:asc' \
   | jq .
```
The JSON response:

```json
{
  "items": [
    {
      "kind": "pod",
      "name": "coredns-6d4b75cb6d-k84h9",
      "labels": [
        {
          "name": "k8s-app",
          "value": "kube-dns"
        },
        {
          "name": "pod-template-hash",
          "value": "6d4b75cb6d"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "etcd-minikube",
      "labels": [
        {
          "name": "component",
          "value": "etcd"
        },
        {
          "name": "tier",
          "value": "control-plane"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "kube-apiserver-minikube",
      "labels": [
        {
          "name": "component",
          "value": "kube-apiserver"
        },
        {
          "name": "tier",
          "value": "control-plane"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "kube-controller-manager-minikube",
      "labels": [
        {
          "name": "component",
          "value": "kube-controller-manager"
        },
        {
          "name": "tier",
          "value": "control-plane"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "kube-proxy-g7j5r",
      "labels": [
        {
          "name": "controller-revision-hash",
          "value": "94985b49"
        },
        {
          "name": "k8s-app",
          "value": "kube-proxy"
        },
        {
          "name": "pod-template-generation",
          "value": "1"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "kube-scheduler-minikube",
      "labels": [
        {
          "name": "component",
          "value": "kube-scheduler"
        },
        {
          "name": "tier",
          "value": "control-plane"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "nginx-deployment-6595874d85-6j2zm",
      "labels": [
        {
          "name": "app",
          "value": "nginx"
        },
        {
          "name": "pod-template-hash",
          "value": "6595874d85"
        }
      ],
      "namespace": "default",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "nginx-deployment-6595874d85-7xgmb",
      "labels": [
        {
          "name": "app",
          "value": "nginx"
        },
        {
          "name": "pod-template-hash",
          "value": "6595874d85"
        }
      ],
      "namespace": "default",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "nginx-deployment-6595874d85-c4kz8",
      "labels": [
        {
          "name": "app",
          "value": "nginx"
        },
        {
          "name": "pod-template-hash",
          "value": "6595874d85"
        }
      ],
      "namespace": "default",
      "cluster": "minikube"
    },
    {
      "kind": "pod",
      "name": "storage-provisioner",
      "labels": [
        {
          "name": "addonmanager.kubernetes.io/mode",
          "value": "Reconcile"
        },
        {
          "name": "integration-test",
          "value": "storage-provisioner"
        }
      ],
      "namespace": "kube-system",
      "cluster": "minikube"
    }
  ],
  "startKey": "teleport-agent-0",
  "totalCount": 11
}
```

Part of #20324 and #19573
Updates #19573
 2023-02-09 21:29:58 +00:00
Lisa Kim f488007ce1 [Discover] Database related tweaks (#19824) 
* Return db users and names with fetch databases
* Include checking for AWS RDS Resource ID as valid RDS type
 2023-01-05 19:16:45 +00:00
Marco André Dinis 69dc237fe2 DatabaseService resource: client and server CRUD (#19469) 
* DatabaseService resource: client and server CRUD

In the context of Teleport Discover, we must be able to known if there's
any DatabaseService available to proxy a given Database resource.
If there's none available, we will offer a script for the user to run
and install a DatabaseService which proxies the desired Database
resource.

By DatabaseService, we mean the process that Teleport binary manages
when the `teleport.yaml` config has the following section:
```yaml
db_service:
  enabled: "yes"
```

To accomplish this we are creating a new resource: DatabaseService.
The UI will fetch all DatabaseServices and check if there's any
ResourceMatcher that matches the DatabaseLabels.

A previous PR created the DatabaseService resource.

This PR creates all the necessary CRUD operations:
- Add Service to manage DatabaseServices resources in the backend.
- Add GetAll, Upsert, Delete and DeleteAll operations to Client.
- Add DatabaseService support to ListResources.
- Add WebAPI endpoint to list DatabaseServices using ListResources.

The next PR will add the heartbeat mechanism to the DatabaseService
process.
 2022-12-21 14:34:36 +01:00
Lisa Kim f8e81e67b0 Remove use of legacy reset password token prefix (#19285) 
* Sneak in grammar fix
 2022-12-12 23:51:16 +00:00
Lisa Kim 296255f868 [Discover] Add ons for database flow (#19063) 
* Add db access rule required for db discovery
  in editors role

For the webapi layer:
* Return db access with user context
* Add AWS RDS fields for creating db request
* Return hostname of each queried db server
 2022-12-06 19:20:11 +00:00
MariuszandJim Bishopp f0dbc346e2 hide internal labels from UI (#18638) 
* hide labels from UI

* add test cases for hidding teleport.internal/ labels

* move labels logic to separate file

* move constant to right api/types/constants.go

* add godoc to makeLabels and rework label constants

Co-authored-by: Jim Bishopp <jim@goteleport.com>
 2022-12-06 09:01:38 +01:00
Marco André Dinis 692d2661f4 WebAPI: Get database endpoint (#18041) 
* WebAPI: Get database endpoint

This commit creates a new endpoint to return a single databse by its
name.

```
GET /webapi/sites/:site/databases/:database

{
  "name": "<database_name>",
  "desc": "<description>",
  "protocol": "<protocol>",
  "type": "<type>",
  "labels": [
    {"name": "<name>", "value": "<value>"},
    ...
  ],
  "database_users": ["<db_user1>", ...],
  "database_names": ["<db_name1>", ...],
}
```

The `database_users` and `database_names` will list the available
Database User and Names for the current user, based on its roles.
 2022-11-10 16:25:09 +00:00
Marco André Dinis 80f4f61032 Create and Update database http endpoints (#17783) 
This commit adds two new endpoints:
Create a database with

```
POST .../databases
{
  "name": "<databasename>",
  "protocol": "<protocol>",
  "uri": "<uri>",
  "labels": [{"name":"<name>", "value": "<value>"}...]
}
```

Update a database's `ca_cert` (the only updatable field for now)
```
PUT .../databases/:database
{
  "ca_cert": "------BEGIN CERTIFICATE-----\n <certificate> --END..."
}
```
 2022-11-08 11:37:01 +00:00
Tiago Silva de5228f784 Return allowed kube_users and kube_groups that can be used to access a certain kube_cluster and allow custom request impersonation (#17420) 
This PR returns a list of allowed principals that a user is authorized to impersonate for each Kubernetes cluster.

When a Teleport user has multiple Kubernetes users defined for the same Cluster we must allow him to choose one otherwise the request will return an error. Similar to `kubectl get pods --as {user} --as-group {kubeGroup}`.
If the user selects invalid users or groups, it will return invalid Kubernetes principals.

Closes #17382
 2022-10-21 09:51:54 +01:00
Ryan Clark 9f9461d5f0 Add labels to Windows Desktop Service, add endpoint for searching them (#16436) 2022-09-23 22:08:04 +00:00
Marco André Dinis c219962ccc ConnectionDiagnostics: SSH Tester (#15413) 
This PR implements the SSH Tester for ConnectionDiagnostic feature.
This feature is also known as Test Connection, part of Teleport
Discover.

The goal here is to provide immediante feedback about a newly added
resource. Can the user connect to it?

We are targetting SSH Nodes as a first ResourceKind.

To test the access to an SSH Node we require the ResourceName and a
login username (ssh principal).

Then a series of checks will occur in two places:
- SSH client in the Web server
- SSH server in the SSH agent

The ssh client creates a new Connection Diagnostic with some initial
state.
Then it tries to build up the necessary SSH config
This already gives us a couple of things to check for:
- does the node exist and does the current user (inherited from
  websession) can access it?
- is the node accepting TCP connections (in the specific port)?
- is the node accepting SSH protocol on top of the TCP connection?

Then, the ConnectionDiagnosticID is inject into the certificate and the
SSH Server receives it and will also Append traces into it:
- is the requested principal allowed for the current user?
- does the requested principal exist in the target node?

This is not an exhaustive list of checks.
For a complete list of which checks are verified please see the
TestDiagnoseSSHConnection test.

After all those checks, it returns if the Connection was successful and
what all of the traces generated along the way.


Demo:
![image](https://user-images.githubusercontent.com/689271/187976940-55522fd9-f581-4c6d-9bfc-f6e501c1ed72.png)

![image](https://user-images.githubusercontent.com/689271/187976957-35075112-2b42-4726-8d50-19d02fab2464.png)

![image](https://user-images.githubusercontent.com/689271/187976967-81406e2c-0517-474b-b323-dad1f8be1571.png)
 2022-09-02 08:17:21 +00:00
Marco André Dinis 37b80c03b1 Connection Diagnostic: update, traces and ConnectionTester (#15158) 
This PR adds the concept of ConnectionTester

ConnectionTester will generate ConnectionDiagnostics by connecting to
the actual resource using a user and some Resource Specific parameters
(principal for SSH access, Database User and Name for Database access,
and so on) and storing the result of multiple checkpoints.

Each resource will have a ConnectionTester (we'll start by SSH access
and then Databases).

It also improves Connection Diagnostics by adding
- update operation (similar to the create one)
- a list of traces, which contain the result of checkpoints in multiple
  steps of the connection flow

As an example, for SSH, we'll have at least the following checks:
- Node is reachable
- User has the right permissions
- Node has the expected Principal

The trigger to test a connection will be an endpoint, because our
primary goal is to let the user test the access right after adding the
resource.

This PR does not implement the actual SSHConnectionTester but creates
most of the boilerplate to do so.

The next PR will focus in adding the actual traces.
 2022-08-16 11:03:06 +01:00
Marco André Dinis 89f4d5476a Create and List Connection Diagnostics (#14781) 
In Teleport Discover, we want to improve the UX of adding a resource.
We'll suggest users to test accessing a resource, and give them immediate feedback using the UI.

Note: we'll add this feature to Server Access, later one we'll add other resources.

After adding a server resource, the user will be presented with a command to test the connection:
`tsh ssh --test-id=123 user@host`

Running that command will provide the user feedback right in the UI of whether or not it worked.
If not, a short message will be displayed describing why it didn't work and how the user can solve the problem.

---

To achieve this we'll need a couple of changes:
1. new resource that stores the result of trying to connect to a given resource, so that the UI can ask for it
2. change `tsh ssh` to receive the `--test-id` flag and write the result to a record of this new resource

This PR addresses 1 - new resource.

A new resource is created:
```
Connection Diagnostics
- success (bool)
- message (string)
```

Two new rpc methods:
- create connection diagnostics
- read connection diagnostics

One new HTTP Endpoint:
- read connection diagnostics

Related to
https://github.com/gravitational/teleport/issues/13957
 2022-08-01 08:49:35 +01:00
MatheusandNic Klaassen 8ce4e6bfbf Add sshLogins to nodes endpoint on webapi (GET /nodes) (#13266) 
* Add sshLogins to nodes endpoint on webapi

* Remove sshLogins from user context endpoint response

Co-authored-by: Nic Klaassen <nic@goteleport.com>
 2022-06-14 12:56:16 +00:00
Andrew Burke a8ed7bd1fd Automatically import EC2 tags (#12593) 
This change allows Teleport to automatically import EC2 tags when running in an EC2 instance.
 2022-05-31 23:19:16 +00:00
Lisa Kim 6b3d7eb368 Use the new ListResources in the webapi layer (#11019) 
Supports pagination and filtering for the web UI
Part of RFD 55
 2022-04-20 04:16:41 +00:00
Zac Bergquist 7e309e9ae2 Remove unused constants (#12033) 2022-04-19 18:59:35 +00:00
Isaiah Becker-MayerandZac Bergquist 066f0dbbad Expose endpoint for fetching single desktop (#9041) 
* updates endpoints

* Exposes an endpoint for fetching a single desktop by name

* Apply suggestions from code review

Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>

* changes inaccurate desktopUUID to desktopName

Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
 2021-11-18 08:15:24 -08:00
Isaiah Becker-Mayer 0abd5734ed userACL (#8560) 
Adds userACL fields and logic for desktops.
 2021-10-20 08:06:00 -07:00
Andrew Lytvynov 5b090f8633 Connect proxy <-> windows_desktop_service <-> RDP server (#7990) 
* Connect proxy <-> windows_desktop_service <-> RDP server

Link together the proxy (websocket), service (mTPS) and RDP client. Pass
target desktop UUID via SNI on the TLS connection from the proxy.

* Use client CAs to validate incoming desktop_service connections

* Send binary frames on desktop websocket
 2021-08-30 11:22:39 -07:00
Roman Tkachenko 629042ed30 Decouple database server from database (#7771) 2021-08-05 01:50:21 -07:00
Brian Joerger 9b8b9d6d0c rollback - Upgrade api version. (#7751) 2021-07-30 15:34:19 -07:00
Brian Joerger c040aca4c1 Upgrade api version. (#7609) 2021-07-28 13:51:21 -07:00
Brian Joerger 7bff7c41bd Remove API aliases (#6983) 2021-06-04 13:29:31 -07:00
Lisa Kim c15a980e2f Return unique kube cluster names when retrieving for ui display (#7002) 2021-05-21 14:34:10 -07:00
Lisa Kim 991059869e Create GET db and kube list web handlers (#6672) 2021-05-05 12:52:46 -07:00
Alexey Kontsevoy 1544d4008e Add Tunnel indicator to IP Address cell (#2775) 
* Add Tunnel indicator to IP Address cell

* E ref and dist

addesses #2751
 2019-06-14 15:29:59 -04:00
Alexey Kontsevoy e86fffd28f (web) adding CSRF protection to OIDC and SAML callbacks 2017-10-06 16:19:05 -04:00
Alexey Kontsevoy efadceae0e include license headers 2017-09-09 00:41:40 -04:00
Alexey Kontsevoy efe4e94eb4 addressing CR comments 2017-09-08 14:35:31 -04:00
Alexey Kontsevoy 789d5c7f51 retire V1 server schema from web api 2017-09-08 10:06:56 -04:00