* Automatically parse entity ID from SAML SP during CLI creation.
When a SAML IdP service provider is created in the CLI, the entity ID will
be automatically parsed out of the entity descriptor and pushed into the
object before pushing the object to the backend.
Additionally, a small bug was found with the SAML IdP service provider get
logic and fixed.
* Update tool/tctl/common/collection.go
Co-authored-by: Andrew Burke <31974658+atburke@users.noreply.github.com>
* Update tool/tctl/common/resource_command_test.go
Co-authored-by: Andrew Burke <31974658+atburke@users.noreply.github.com>
* Bring back copy loop.
* Remove the SkipCheckAndSetDefault.
* Removing the check for the entity ID in the SP object.
* Restore missing comment.
* Parse entity ID as part of check and set defaults.
* Cleanup api go.mod/go.sum.
---------
Co-authored-by: Andrew Burke <31974658+atburke@users.noreply.github.com>
`btree.BTree` has been a backward compatability wrapper over a
`btree.BTreeG` since `github.com/google/btree@v1.1.0`. This converts
all usages to the new generic variant.
* Simplify the cache tests.
Several of the cache tests had a very similar structure. Where possible, these
have been adjusted such that all tests with similar structures use a generic
testing function that executes the same logic on each resource type.
* Re-add t.Parallel() for namespaces.
* Connect: Remove resource cache
This commit refactors parts of the Electron app which still depend on
the resource cache, that is cluster sync and `tsh ssh` executed from the
command bar.
A number of adjustments has been made to executing `tsh ssh` from the
command bar, namely the logic of resolving the hostname has been moved
from the command launcher to useDocumentTerminal. The UI was also
adjusted to allow the user to reconnect to an SSH server if resolving
the hostname fails. This has a nice benefit of also allowing them to
retry if the PTY couldn't be created for some reason.
---
Before gravitational/webapps#1307, Connect was pulling all resources
from the cluster on app start and cluster login. Then it'd show them to
you in tables if you opened a new tab with cluster resources. There were
at least two problems with this approach:
1. It was slow for big clusters as pagination, filtering and sorting
were all done client-side and blocked the main thread.
2. It wasn't possible to implement advanced search unless we copied the
implementation from the backend to tshd.
gravitational/webapps#1307 made it so that instead of depending on that
resource cache to show resource tables, Connect would pull paginated
resources from the backend.
However, the resource tables were not the only part of the app depending
on that cache. Due to time constraints, we weren't able to refactor all
of them. We managed to refactor autocomplete (gravitational/webapps#1406)
and the remaining places are listed in #21800.
This PR refactors those remaining places to not use the cache by either
not depending on resource details or by making a call to the proxy
instead.
* Add missing license
Only proxy, node, auth, db, or app are applicable roles. Windows desktop and kube are not supported roles with `teleport start --roles=...`. The default roles if none is specified is proxy, node and auth.
Previously the tokens add would show the command to include these as a role. That was incorrect and has been corrected.
The SAML IdP service provider collections object in the CLI was inadvertently
appending to the end of a preallocated array instead of using the array
directly.
* Reorganize the config reference
Closes#11253
This change breaks up the config reference by moving each Teleport
service's configuration settings into a separate YAML snippet, and
organizing each YAML snippet into a `TabItem` within a `Tabs` with
`dropdownView` enabled. When Teleport Enterprise Cloud doesn't support a
service, this change adds a `Notice` with a message about Teleport
Enterprise Cloud in the relevant `TabItem`.
I thought this approach would be cleaner than alternatives:
- **Including an H2 for each service:** With this approach, the
configuration reference would be even longer than it is now. With the
approach I'm proposing, readers would navigate to "Reference
configurations", then choose a service from a dropdown menu: much less
scrolling for slightly more clicking.
- **Including another set of `TabItem`s for Teleport editions:** I
thought about adding a `Tabs` with a dropdown option for each Teleport
edition and a horizontal `TabItem` for each service, but this would
require horizontal scrolling and doesn't scale very well.
- **Including horizontal tabs for each Teleport edition**, with an inner
dropdown menu for each Teleport service: There is currently no way to
do this without multiple `Tabs` components, which gets messy quickly.
**Note** that this change does not attempt to copy-edit comments/example
values within the configuration snippets. The scope of this change is
limited only to reorganization.
* Respond to PR feedback
* Update docs/pages/includes/config-reference/instance-wide.yaml
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Respond to PR feedback
Use headings instead of `TabItem`s to split up sections of the config
reference.
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Removes desktop logins from the ACL and adds them to each Desktop resource
as returned to the frontend. This behavior parallels what's currently being
done with other similar resources such as Nodes, and fixes a bug where
users were able to see all the logins permitted by their roles on every
desktop "connect" dropdown, even if the role permitting that login didn't
apply to a given desktop.
* Extracts common logic out of GetWindowsDesktopLogins (now GetAllowedWindowsDesktopLogins), uses it to create a GetAllowedServerLogins as well, tests both of them together, removing EnumerateServerLogins
* reduce unnecessary looping by using maps
* fixes flakiness by sorting lists
* uses require.ElementsMatch rather than manually sorting lists
* consolidates duplicated logic
* Consolidates separate server and desktop logic into a single GetAllowedLoginsForResource
* fixes tests
* fixes import order and test
* Fix Kube impersonation header overwrite when dealing with remote clusters
When forwarding exec requests to remote clusters I introduced an empty
header that failed the validation in `setupImpersonationHeaders`. This
results in the request being denied.
This problem only affects Teleport 11 and 10, but I am fixing the behaviour
on master as well.
Fixes#22226
* add tests
* Create a generic local backend service.
Many of the local backend services have a very similar pattern in terms of how
objects are retrieved and stored. This PR introduces a generic backend which
implements backend retrieval and storage of objects and migrates the SAML
IdP service provider service to it. More services could easily be migrated
to this generic service implementation.
* Feedback, add in generic tests.
* Tim's feedback, added in a test for updating a resource that doesn't exist.
* Tim's feedback.
* Apply suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Edoardo's feedback.
* Added in UpdateAndSwap.
* Edoardo's feedback, Tim's feedback.
* Use a default page size if the page limit is not specified.
* More of Edoardo's feedback.
* Propagate error instead of panic.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
When a client sends an SSH session before the shell process ends, Teleport sends the SIGKILL signal to the subprocess. This causes the still-leaving shell to be resigned to PID 1 and live forever.
This PR tried to stop the terminal first before killing the subprocess to prevent the terminal from living forever.
Closes#13335Closes#6245Closes#4469
* Adds `kubernetes_resources` references
This PR adds references to Role `v6` in `Role Versions` and updates the
Terraform docs to include the new Role's field `kubernetes_resources`.
It also fixes a typo in Helm chart guide.
Fixes#21889Fixes#22117
* Update docs/pages/reference/terraform-provider.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/reference/terraform-provider.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Completes the service implementation of the transportv1.Service.
Ensures that both SSH and SSH Agent protocols are multiplexed
correctly over the gRPC stream via TestService_ProxySSH.
Part of #19812
* format collected data nicely
* remove name prefix
* update comment
* Update tool/tctl/common/device/resource.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* fix test
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add check on apiserver upserUser to ensure all roles on user exist
* Move role check on upsert user to client side
* Move user role checks on upsert to tctl
* Add check to upsertuser to ensure roles exist
* Add test to ensure upsertUser rejects users with unknown roles
* Change user creation test to use a role that will always exist
* add device spec docs
* format specifics of key
* add yaml tag
* add collected data
* cli ref update
* Update docs/pages/includes/device-spec.mdx
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* update example
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Test ARM64 assets build
Use all available cores when building Clang
Add test trigger
Update assets buildbox name
Build all dependencies on ARM64 including BPF
Kube
This PR fixes the inheritance of `kubernetes_resources` from the user's roles when the user has active access requests to a `kube_cluster`.
If the user had an active request to a `kube_cluster`, Teleport ignored the role's `kubernetes_resources` and returned an empty set for the allowed and denied pods. This resulted in the user being unable to see any pods in the cluster.
Fixes#22126
`auth.Middleware` to make use of them. This allows for less redundancy
per RPC and provides the ability to perform session control when grpc
connections are established.
The `auth.Middleware.withAuthenticatedUser` function was called from all
interceptors of any gRPC server that leveraged `auth.Middleware`. This
was constructing the identity of the client from the TLS certificate
per RPC. Since the identity of a connection cannot change between RPCs
there is no need to construct the identity in an interceptor. Instead,
the new `auth.TransportCredentials` can build the identity once after the
TLS handshake completes. When interceptors or gRPC handlers need to
acquire the identity they can do so using the same
mechanism via `peer.Peer.AuthInfo` and assert on the new `auth.IdentityInfo`
type:
```go
peerInfo, ok := peer.FromContext(ctx)
if !ok {
return
}
connInfo, ok := peerInfo.AuthInfo.(auth.IdentityInfo)
if !ok {
return
}
identity := connInfo.IdentityGetter.GetIdentity()
connState := connInfo.TLSInfo.State
```
The gRPC server that is served on the Proxy ssh port needs to hold the
same invariants as the ssh server available on the same port. This
means that connection limits need to be enforced when new connections
are established. To achieve this the new `auth.TransportCredentials` can
be provided with an `auth.ConnectionEnforcer` and an `auth.Authorizer`
to first build an identity, then ensures that the user is authorized and
finally that the user has not exceeded their connection limits.
Other minor changes include providing the cluster name to the
`auth.Middleware` instead of it looking the value up from the cache every
time an identity is created. Some interceptors were also moved around or
removed to eliminate the chances of having duplicate interceptors end up in
the interceptor chain.
Part of #19812
* Add plugin exchange service
* Add Plugin methods to auth
* Add gRPC-layer methods for Plugin
* Add RBAC presets for Plugin
* Test GetPlugin()/NoSecrets access
* Make error assertions more correct in role test
* Deny setting credentials if user can not read them
* gofmt
* Apply minor suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Move dependency into an existing block in go.mod
* Improve error messages for failed type assertions
* DRY WithSecrets access checks for Plugins
* Run new tests in parallel
* Improve error assertions in auth_with_roles_test
* TestGetPluginWithSecrets: split cases to subtests
* Clean up test servers and clients
* Add proto for plugin service
* Remove Plugin methods from auth service
Moved to a dedicated service
* Remove plugin-related auth methods
Moved to a dedicated service in Enterprise
* Remove CreatePlugin test from auth_with_roles_test
Moved to a dedicated service in Enterprise
* Pass "backend getter" to local plugins service
This pattern is used in Enterprise to set up secondary services
before auth (and backend) are created.
* Rename InitialCredentials to BootstrapCredentials
* Add plugins service to genproto.sh
* Reformat generated proto
* Remove obsolete PluginExchangeService
The equivalent of this is now in Enterprise
* Add kube service to genproto.sh; regenerate
* Add ListPlugins to plugin backend service
* Reimplement GetPlugins on top of ListPlugins
This is a "convenience" implementation for the backend service layer.
* Replace GetPlugins with ListPlugins in gRPC schema
* Fix ListKubernetesResources unit test
* Simplify plugin pagination key to just the name
* Use existing constant for page size
* Make dummy clients return errors instead of panic
* Remove obsolete field
* Ensure go.mod is valid for corresponding e changes
* Fix passing mutex ref
* Move teleport-plugins import to e_imports
* Revert oauth change in go.mod
* Use limit+1 to look-ahead when paginating plugins
* Test plugin pagination with pageSize > numPlugins
* Add descriptive messages to gRPC dummy clients
* Plugin: add RW for editor; remove secrets from gRPC
* Make message more descriptive for dummy gRPC conn
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Without this early return, createPtyProcess of PtyHostService would call
the callback twice on error. This doesn't have much negative implications
since the gRPC implementation will simply ignore the second call, however
it does pose some problems when trying to manually test PTY failures
by making `new PtyProcess` return an error.
dependabot[bot]