* WebAPI: read user
We currently need to fetch the whole list of users to get User's
information.
Adding more fields increases the probabilty of having performance
issues.
This PR adds a new endpoint which returns a single user.
This endpoint returns the information we already return when listing
users but also returns the user's traits
This is a follow up of
https://github.com/gravitational/teleport/pull/14076
The following traits are returned:
- Logins
- DB Users
- DB Names
- Kube Users
- Kube Groups
- Windows Logins
- AWS Role ARNs
* WebAPI: update user traits
Web API only supports updating the roles property for a given User.
This PR adds the possibility of updating User's traits
- Logins
- DB Users
- DB Names
- Kube Users
- Kube Groups
- Windows Logins
- AWS Role ARNs
It only updates if the requests contains a non-nil value for the trait's
list.
It deduplicates the trait's list before applying it.
Alias the "u2f" second factor mode to "webauthn", effectively sunsetting U2F in
favor of WebAuthn.
The change effectively disables "U2F mode" server-side, making Teleport use
WebAuthn instead. This is in line with our compatibility promise, as Teleport
8.x clients are already WebAuthn-capable (and thus have no problems talking to
the cluster).
I have cleaned up a good chunk of U2F references in lib/web and lib/client, plus
a few other places. Changes on lib/auth are just the necessary to get the tests
back to good standing. There is more work to be done, but this seems enough for
a single PR.
#10375
* Remove "Disabled" field from types.Webauthn
* Update generated protos
* Treat second_factor "u2f" as "webauthn"
* Remove references to Webauthn.Disabled
* Remove U2F from lib/web/
* Remove U2F from lib/client/
* Remove U2F from lib/auth/ (partially)
* Fix issues after rebase on master
* Fix typo
- Privilege tokens are obtained after a logged in user successfully
re-authenticates with their second factor. This token allows
access to protected actions and will last 5 minutes.
- There is one exception where a user can obtain `PrivilegeException`
token without re-authenticating if a user doesn't have any second factors.
Currently used to allow users to add their first MFA devices for
auth type optional.
- Added web handlers
* Transferred user endpoints/handlers from e
* Transferred and refactored endpoints/handlers for roles, trusted clusters, and github cn from e
* Export ok() func so e can use
* Silence rbac auth connector access denials on first check failure
* Update e-ref
Jakub Nyckowski