This changes the proto type (+validation) only to declutter the original PR https://github.com/gravitational/teleport/pull/49124
The real changes are in
- api/proto/teleport/legacy/types/types.proto
- api/types/access_request.go
- lib/auth/auth_with_roles.go
- lib/auth/auth_with_roles_test.go
The rest is all generated.
* Add `bitbucket` join method for Bitbucket Pipelines joining
This adds a new `bitbucket` join method that Machine ID bots can use
to authenticate to Teleport from Bitbucket Pipelines CI runs.
* Add unit tests for bitbucket joining
This also fully adds `deployment_environment_uuid` which was found to
be missing.
* Fix imports
* Update tf docs
* Docs update
* Update generated TF resources
* Attempt to work around docs linter
* Add provision token tests
* Remove pipeline_uuid and step_uuid from protos
Also, fix deploment_environment_uuid field name.
* Remove references to removed fields in tests
* Switch to go-oidc/v3 and remove now-redundant nbf check
* Fix go.mod imports for the TF provider
* Fix event-handler go.mod
* Address review feedback; add 15s timeout to fetch provider metadata
* Update lib/bitbucket/token_validator.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix build after constant rename
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
IdentityCenter accounts are exposed to the Teleport UI as applications,
with each app containing the list of AWS permission sets available on
the corresponding account.
This change adds the necessary additions to the App protobuf types
to carry the Identity Center information.
Originally, we included the `View` field in order to add the Owner
property to safeguard the returned details of a device ensure the owner
matched the caller. However, this ended up not being conditionally used
(we would never _not_ use it) so we can remove it from the request.
* Add Integration and DiscoveryConfig as labels to auto discovered RDS/EKS
This PR adds two new labels to RDS and EKS resources:
- Integration
- DiscoveryConfig
Those labels help identify which Integration and DiscoveryConfig were
used to auto enroll the resources.
* remove unused code
* add missing discovery config labels for GCP and Azure
- Add the ability create notifications with a custom TTL
(previously we relied on the server-provided default of 30 days)
- Add the ability to create notifications with custom labels
- Add (non-system) labels to the `tctl notifications ls` output
- Add the ability to filter by label when listing notifications
Closes#48631
* Use math/rand/v2's thread-local RNG for jitters
* Replace NewJitter() with DefaultJitter
* Replace NewFullJitter() with FullJitter
* Replace NewHalfJitter() with HalfJitter
* Replace NewSeventhJitter() with SeventhJitter
* Inline jitters in lib/utils/diagnostics/latency
* Replace var jitters in lib/utils with proxy functions
* Replace utils.HalfJitter with retryutils.HalfJitter
* Replace utils.FullJitter with retryutils.FullJitter
* Replace utils.SeventhJitter with retryutils.SeventhJitter
* Replace sharded jitters with thread-local ones
* Remove NewSeventhJitter reference in integrations
* Move the QUIC proxy peering envvar check to lib/config
* Move lib/proxy/clusterdial to lib/peer/dial
* Move peer.clientConn to lib/proxy/peer/internal
* Require QUIC peering label to be set to "yes"
* Move peer TLS verification funcs to lib/proxy/peer/internal
* Move QUICServer to lib/proxy/peer/quic
* Avoid stuttering in lib/proxy/peer/quic
* Remove useless quic.ServerConfig.CipherSuites param
* Fix log style in proxy.peer.quic
* Move duplicatePeerMsg into the function scope
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Using discovery service poll_interval for access graph sync
* Adding a new poll_interval field to access graph sync config
* Update lib/srv/discovery/access_graph.go
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
* Adding default poll interval
* Make fix-imports
* Updating derived functions for config
* Apply suggestions from code review
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Followup from PR comments
* Applying protobuf tags to avoid conversion
* Removing conversion
* Regen grpc from rebase
* Adding warning message and checking for nil config
---------
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Subsystem events did not include ServerMetadata, which results in
any events generated for agentless hosts to contain limited
information. For example, any sftp subsystem requests made in
response to tsh scp for agentless nodes provided information about
the proxy forwarding the requests, but no information about the
target host.
Additionally, the way ServerMetadata information was being populated
by using the ServerContext overrode only a subset of the information
that was available. This lead to SessionData events emitted when
an sftp operation was completed not populating any relevant information
about agentless nodes either. To avoid this going forward, the
GetServerMetadata receiver has been removed from ServerContext and
instead the TargetMetadata must be used from the appropriate SSH
server, which already populates the relevant information without
omitting any.
* Adds `KindIdentityCenter` umbrella resource kind
The Identity Center integration manages several resource types,
and specifying individal condition statements for each kind is
both unwieldy and unnecessary - anyone that can manipulate one
of these resources should be able to manilpate them all in the
same way.
In order to simplify things, this patch introduces an umbrella
`KindIdentityCenter` that will represent _any_ `KindIdentityCenter*`
resource in Role conditions and RBAC checks.
* Update constants.go
* Update Implicit role to use Umbrella kind
Updates the default implicit rules to refrence the new `KindIdentityCenter`
resource kind. Also updates comments on the covered `KindIdentityCenter*`
kinds with a reminder to user `KindIdentityCenter` in RBAC checks.
* Update constants.go
* [entraid] store entra `appId` in plugin settings
This PR stores the Entra ID appID of the application used for SSO in Entra ID plugin settings.
This field filled in a best effort scenario and might be empty for old Entra Plugins.
Newly created plugins will make the field mandatory.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle code review comments
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Allow SSO MFA to fail gracefully on the client when the Proxy is down.
* Update api/mfa/ceremony.go
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
---------
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
At a previous PR we added two new fields in the UI and backend, but
failed to add them to the layers in between (grpc service).
This PR adds them and also fixes a typo on the EndpointPublicAccess
field name.
* Add SSO MFA ceremony support to WebUI per-session MFA.
* Add display name to SSO MFA device; Add SSO MFA device to SSO challenge.
* Camel case json tags for front end.
* Add sso channel ID for front end broadcast channel logic.
* Fix backwards compatiblity issue; fix error message.
* Fix test.
* Fallback to connector id if display name isn't set.
* Fix test.
* Resolve comment.
* Use uuid.NewRandom.
* go mod tidy
* Add proto definitions for MsTeams no code integration
* Add access monitoring rule and hosted support to msteams plugin
* Fix linting
* Fix go sum mismatch caused by msteams dependency
* Fix linting in access monitoring rules
- Recursively check for accesslist membership
- Allow adding/removing/listing included access lists in acl commands
- Add a recursive test
- Use dynamic access lists structure from RFD
- Resolve proto changes
- Exclude 'list' members from Access List memberCount
- Calc Access List member count with members of type 'list' excluded,
return seperately to front end
- Update examples/integrations
- Update crd docs
- Update tf docs
- Perform calculation of inherited roles/traits to AccessList service in
order to utilize cache and minimize number of requests.
- Grant Okta integration RO for Access Lists
- Update AccessListMember-* events
- Include count for inherited grants
- Include MembershipKind of affected member(s)
- Emit inherited grants / members' MembershipKind for AccessListMember-*
events
- Update notified owners for Access Requests
- Ensure dynamic owners are notified for Access Requests
- Ensure dynamic owners are notified via Slack integration
- Optionally pass an AbortSignal to `fetchAccessLists` in Web UI
- Replace usages of `services.IsAccessListOwner/IsAccessListMember` with
equivelant funcs from `Hierarchy`
- Remove final references to AccessListMembershipChecker
- Don't allow ACL deletion when member/owner in other lists
- Guard Access List deletion behind membership/ownership checks for List
- Expose Hierarchy func to recursively get all members
- Tidy UserLoginStateGenerator logic involving ACL Membership/Ownership
Co-authored-by: Maxim Dietz <maxim.dietz@goteleport.com>
* Client auto updates integration for tctl/tsh
* Add version validation
Fix recursive version check for darwin platform
Fix cleanup for multi-package support
* Fix identifying tools removal from home directory
* Replace ToolsMode with ToolsAutoUpdate
* Reuse insecure flag for tests
* Fix CheckRemote with login
* Fix windows administrative access requirement
Update must be able to be canceled, re-execute with latest version or last updated
Show progress bar before request is made
* Fix update cancellation for login action
Address review comments
* Add signal handler with stack context cancellation
* Use copy instead of hard link for windows
Fix progress bar if we can't receive size of package
* Replace with list in order to support manual cancel
* Download archive package to temp directory
* Decrease timeout for client tools proxy call
- Add Hierarchy utils for nested AccessList validation and handling
- Update AccessList Protos with new fields
- Update AccessList and AccessListMember types and converters with new
fields
* emit an audit event with file transfer statistics when an SFTP session is completed
* remove unused SFTP event codes, don't embed os.File
* send oneof events to parent process to make event unmarshaling easier to reason about
* protect tracked files with mutex
* proto
* Fix update for DynamicWindowsDesktops
* fix test server
* fix test
* fix test
* fix test
* Update api/proto/teleport/dynamicwindows/v1/dynamicwindows_service.proto
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* update proto
* fix tests
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* [entraid] add setup script for offline clusters.
This PR adds a cli configuration for Entra ID where it's possible to default to system credentials instead of relying on OIDC for authentication in EntraID. OIDC is not always a possibility specially when the cluster is private and not internet acessible.
The UX is the following:
```text
Step 1: Run the Setup Script
1. Open **Azure Cloud Shell** (Bash) using **Google Chrome** or **Safari** for the best compatibility.
2. Upload the setup script using the **Upload** button in the Cloud Shell toolbar.
3. Once uploaded, execute the script by running the following command:
$ bash entraid.sh
**Important Considerations**:
- You must have **Azure privileged administrator permissions** to complete the integration.
- Ensure you're using the **Bash** environment in Cloud Shell.
- During the script execution, you'll be prompted to run 'az login' to authenticate with Azure. **Teleport** does not store or persist your credentials.
- **Mozilla Firefox** users may experience connectivity issues in Azure Cloud Shell; using Chrome or Safari is recommended.
Once the script completes, type 'continue' to proceed, 'exit' to quit: continue
Step 2: Input Tenant ID and Client ID
With the output of Step 1, please copy and paste the following information:
Enter the Tenant ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Enter the Client ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Successfully created EntraID plugin "name".
```
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* move function to api
* handle code review comments
* Apply suggestions from code review
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* fix url
* enable group claims
* add godoc
* handle code review comments
* fix gomod
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
Noah Stride