* Fix Moderated session on leave pause action.
* Unpause when moderator rejoins session with onLeave=pause
This commite fixes a case when the moderator rejoins a paused session
but Teleport didn't resume the operations and the session was still
locked to everyone.
* Fix panic when re-joining SSH session.
* Update lib/kube/proxy/sess.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Update lib/kube/proxy/sess.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Fix typo
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* SAML IdP access checker.
A new SAML IdP access checker has been added. This will allow for the SAML IdP
to determine whether or not a user should have access to the SAML IdP.
* Update lib/services/role.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
The web handler now has its access point exposed. This will allow for using it
for enterprise functionality. In particular, this will allow us to use it for
auth.Middleware for enterprise web plugins.
* Add WEBASSETS_SKIP_BUILD to Makefile
WEBASSETS_SKIP_BUILD allows skipping webassets build for development purposes. Teleport build in that mode displays blank page instead of WebUI, but the build significantly faster.
`make full` - always builds webassets
`make WEBASSETS_SKIP_BUILD=0` - works the same as `full`
`make WEBASSETS_SKIP_BUILD=1` - skips webassets build.
* Copy the root UI index.html file and serve it as it's used to fetch the config in the UI dev server.
---------
Co-authored-by: Jeff Pihach <jeff.pihach@goteleport.com>
We still plan to address this root issue, and are tracking making CodeQl faster so it can be a required PR check: https://github.com/gravitational/SecOps/issues/269
However, until then we need to switch this job to be a scheduled task rather than on every PR and push. This is partly cost motivated, but also we are already hitting our timeouts. This PR also increases the analysis timeout so that the daily job can be sure to complete.
* Add check on apiserver upserUser to ensure all roles on user exist
* Move role check on upsert user to client side
* Move user role checks on upsert to tctl
* Add err to message about missing role
When performing a KeepAlive the key was first retrieved from
etcd to verify that it existed before updating the item. However,
a Put operation with the `ignore_value` set will return a not
found error if the key does not exist
(https://etcd.io/docs/v3.4/learning/api/#put). So we can safely
remove the get and rely on etcd to prevent updating a key that
does not exist.
Also converts `concurrentqueue.Queue` to be generic over the given
Input and Output of the worker function.
* Start removing generateToken
* Refactor `tokens add` to use `CreateToken` RPC
* Correct deprecation version
* Remove calls to GenerateToken
* Start tests for token crud
* Allow user role rules to be provided wth CreateUserAndRole helper
* Add TestCreateToken to tls_test
* Add TestUpsertToken
* Add GetTokens test
* Add TestGetToken
* Add test for DeleteToken RPC
* Dedupe error assertions
* Add support for emitting trusted cluster token creation events to Create/UpsertToken
* Fix imports
* Change parameter order to appease linter
* Fix broken token expiry test
* Fix token expiry time for TestAuth_RegisterUsingToken
* Remove unnecessary cleanup
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Change test comment from deprecation notice
* `make gprc` after code review changes
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Rename tests
* Update lib/auth/tls_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* More test cases for GetTokens
* Improve message on duplicate token
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Instance heartbeats have caused significant etcd instability in
larger clusters. This makes the instance heartbeat a noop unless
the `TELEPORT_UNSTABLE_ENABLE_INSTANCE_HB` is explicitly set.
This allows for us to keep the instance heartbeats to continue to
test and determine the underlying problem without rolling back the
entire feature, while also preventing it from imapcting users.
The plugin doesn't write into a custom field like the docs suggest.
The plugin uses the `properties` field of the Create Issue request.
That `properties` field is an array of `Key:string Value:string`.
When the issue is updated in JIRA, that's the value we look for to
update the Teleport Access Request.
Fixes#19293
The error message "missing parameter hostname" wasn't very clear what hostname
was missing. Fail faster further up the stack and print a better error message
explaining what is happening.
This applies some checks aroung argument parsing while also adding some
belt-and-suspenders validation into `NewClientStoreFromIdentityFile`
* Include enterprise for tctl for cloud and ent
* Include enterprise in tctl
* removed enterprise from tsh
* correct labels
* Update commercial-prereqs-tabs.mdx
* Add docs references to `tsh request search --kind=pod`
This PR adds references to the new supported command to search for pods
in a Kubernetes Cluster without requiring access to the cluster itself.
* copy edits
* add paul feedback
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
My previous PR https://github.com/gravitational/teleport/pull/21660 broke the git installation path, as `git` compiles in the `--prefix` provided during configuration. Using`DESTDIR` with `make install` instead of `--prefix` copies the file in the intermediate container with the correct path.
* Unify x86/AMD64 build process
Currently, our ARM64 pipeline builds limited subset of Teleport features as none of the 3rd party dependencies (openssh, libbpf etc) are not built on AMR64. This change build all dependencies on AMR64 in the same way as we do on x86.
FIPS changes are not included as we do not support FIPS on ARM64.
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Update teleterm README
* Remove the Usage section in favor of linking to the docs.
* Mention that the OSS build is broken.
* Remove post-webapps-merge inconsistencies.
* Remove "Gravitational", align teleterm desc with teleport
* Allow a tsh aws user to specify a command to run with the AWS environment variables set
* Update name of the argument per feedback
* Address nits
---------
Co-authored-by: Daniel Ballenger <daniel@otter.ai>
Co-authored-by: Marek Smoliński <marek@goteleport.com>
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Change formatting for "/version" endpoint
This PR changes the formatting for "/version" endpoint since Kubernetes
clients do not expect a JSON response on that endpoint.
This PR returns the error message directly into the body without any
formatting so that `kubectl` is able to present the desired error.
```
kubectl version --short
Flag --short has been deprecated, and will be removed in the future. The --short output will become the default.
Client Version: v1.25.4
Kustomize Version: v4.5.7
Error from server (InternalError): an error on the server ("this user cannot request kubernetes access, has no assigned groups or users") has prevented the request from succeeding
```
Fixes#20900
* change message wording
* add validation when generating kube creds
* fix typo
Current implementation of NewlyAdded() requires to keep different implementation on production branches. New implementation will allow to keep the same source code to be identical on all branches.
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Add SAML query functions to auth preferences and role.
Getter functions have been made for the new IdP configuration fields in the
AuthPreferences and RoleOptions.
* Remove role query, as we can access this in the object.
* Make sure the IdP options section won't hit any nil pointer errors.
This PR removes a deprecated warning when Teleport proxy starts.
If the cluster is running in multiplex mode the warning is not valid
because Kubernetes Proxy is enabled by default using ALPN proxy
listener.
* BPF build fix
https://github.com/gravitational/teleport/pull/21745 switched CentOS 7 image to the upstream, but I missed a few other places were we're using our fork.
This change fixes all places.
* Add missing FIPS changes
* Update e
This commit adds a user message ("Detected security key tap") that is
printed at the earliest opportunity after `tsh` succesfully detects a
security key tap.
This solves a problem users have when there is significant latency in
their connection to their teleport proxy, where there may be zero
visible feedback to the user for upwards of 8 seconds after they tap
their security key.
This often causes users to think that the tap was not detected or
failed, and they attempt to tap again.
This can cause the user to accidentally paste a "yubisneeze" into their
terminal, which is not great from a security perspective.
As an API choice here I added a `TouchAcknowledger` returned by they
`PromptTouch` of the `LoginPrompt` interface.
It may seem like a bit of a weird API, but I did it this way so that all
callers of `PromptTouch` are forced to explicitly acknowledge the touch
or explicitly ignore that return value, they cannot simply forget to ack.
This applies to WebAuthn and Passwordless logins from `tsh`, no changes
are made to Connect.
* Add more info re: AWS credentials to the docs
Closes#2781
- Add a partial for how to provide credentials to Teleport's AWS client.
Since this includes adding environment variables to the file used by
our systemd service, I also created a partial re: how to configure
Teleport's systemd service and added these two partials to the
relevant guides.
- Removed `Admonition`s that link to the docs re: AWS credentials in
favor of the partial above. (The partial links to the Go SDK for AWS
docs for situations where users have a specific use case.)
- Remove mentions of the AWS credential-related config settings from the
Backends reference. The example config snippets don't actually include
the `access_key` and `secret_key` settings, so these are left over
from an earlier version of the guide. While you can still add these
settings to a config file, I thought it would make sense to leave them
undocumented since using an EC2 instance, environment variables, etc.
is the recommended approach.
- Split the S3/DynamoDB sections of the Backends reference into
subsections so the extra authentication info fits a bit better.
* Respond to PR feedback
* Add new partials to the RDS Proxy guide
Update to libbpf 1.0.1 and github.com/aquasecurity/libbpfgo v0.4.5-libbpf-1.0.1. As we're building our releases on CentOS 7 anyway we can also switch to mainstream libbpf instead of using our fork.
This PR removes the requirement of providing a cluster name to login
into if the user provides the `--all` flag.
If the user does not provide a cluster, Teleport does not select any
cluster by default.
Fixes#21713
* SAML IdP session objects.
The upcoming SAML IdP feature requires session storage in the backend. To
support that, the `WebSession` that has been adapted for app sessions and
Snowflake sessions has been adapted for SAML IdP sessions.
The SAML IdP will be encoding the session structure as JSON and packing it
into the new `data` field within the web session.
* Update api/types/session.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Use specific structure instead of a JSON blob.
* Update the create SAML session request.
* Make SAML session a pointer.
* Add in link to crewjam/saml object.
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
