* Add proxy verb to kubernetes_resources
* Preserve upstream kube Status code in forwarder
* Readable comment
* Strip [scheme:]name[:port] on kube proxy paths
* Use SplitSchemeNamePort from k8s apimachinery
* Update Go version to v1.26.4
* Rm GO_VERSION from Makefile/Dockerfile and rely on go.mod to inform Go version. Update code to adhere to 1.26 deprecation/changes.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Bump e to 54d1d0cb67b71860b943de477b3146d32ccdd74a.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
---------
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
Co-authored-by: teleport-renovate[bot] <275214890+teleport-renovate[bot]@users.noreply.github.com>
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
"Load more" in the recordings search TUI (and --resume-token) failed with
"start_time is required" after the latest access graph update.
Follow-up pages were sent with only the batch_token, relying on the
proto comment that claimed all other filter fields are ignored
once batch_token is set. That contract is wrong: the server validates
and applies start_time/end_time and every other filter on each request,
and the access graph re-checks that the checkpoint falls
within the requested time range.
The batch token is intentionally only a cursor and does not carry the full
search state - encoding every filter into the token would let it grow to
very large sizes. So the original request must be replayed with the
batch_token set on each page. Build the request once and have the fetcher
clone it and attach the token for the initial page, resume, and load-more,
fixing both the TUI and --resume-token.
Also surface the fetch error back to the user: a failed "load more" now
opens a popup with a red header and the server message rendered as code,
instead of silently swallowing the error behind a "(retry)" label.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Move tctl acl command into its own directory
Create a accesslist preset file to be referenced later
in future acl commands
* Remakes the original acl_command.go file
This is so that during merging, the enterprise build doesn't break
This file will be removed once all merging is complete.
* Add types and API for Okta assignment target status
* Add status fields to resource output
* Validate args for RecordStatus
* Update tests for RecordStatus errors
* Tidy up
* Remove tctl changes to put in separate PR
* Add iOS and iPadOS as new OSType values
* lib/msgraph: Add `Model` field back to `ManagedDevice`
We need it to differentiate between iPhones and iPads in e/lib/intune.
* Add device_type to JamfInventoryEntry
* Use a separate block for computer types
* Add godoc and examples for `ManagedDevice.Model`
* Add os_types to SyncInventoryStart
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Add GetDisplay helper to API user type
* refactor: Simplify display retrieval functions in user_display.go
* refactor: Enhance user display retrieval logic with structured sources
* refactor: Replace firstNonEmptyValueDifferentFromUsername with cmp.Or for improved value handling
* refactor: Add first name and last name traits
Replace the functions in the scopes package to infer if scoped features
are enabled with a concrete struct that is injected to consumers. This
permits tests to toggle scopes features without having to specify environment
variables.
* Add ui interaction event protos
* make grpc
* Add userEventService method
* Fix signature
* Fix username field
it would have been logging the hash of ""
* Allow IAM Join by specific Organizational Units
* fix for account not found scenario
* move checks to write paths instead of checkandsetdefaults
* fix cache
Prevent access requests in APPROVED, DENIED, or PROMOTED states from
being updated through SetAccessRequestState, including same-state
updates that could otherwise mutate resolution metadata.
* Convert DeleteProxy RPC from HTTP to gRPC
* Use `t.Context()`
* Add more greppable TODO
* Fix usage of deprecated rpc
* Upsert RPC
* Use wrapper message for UpsertResponse
* gofmt
* Simplify godoc
* Update response message
* Update method names on public api client
* fix tests
* Introduce UpsertProxyWithoutServer
* Edoardo comments
* separate
* Change to UpsertProxyServer RPC handler
Beams runs an app_service, configured to look for apps with
the "teleport.internal/beams/app-type" label.
Users should not be able to create apps with this label - we expect
these apps are only created via static beams config or via the
`tsh beams publish` command.
It's safe to block these requests at the RPC layer because beam
apps are written directly to storage and don't go through these
auth RPCs.
* Add scope support to OpenSSH certificate generation
simplify scopes open ssh connection
Add DeviceVerified and isBot in the signer
tweak signer to be lazily referenced
revert adding login to client
Pass in targetServer to the OpenSSHCertRequest instead - use CheckAccessToSSHServer to check if scoped role has access
Respond to pr review
Changed signature of DialHost to use a struct before it gets too big
Changed requestedHostLogin to login and targetnodescope to targetserverscope
fix build
Update auth_with_roles.go
Update split_access_checker.go
Update agentless.go
Update auth.go
fix test
Update authservice.pb.go
move cert gen
alias auth proto instead and update the test error expectation
rename goproto go googleproto for better readability - address pr feedback
Update integration_test.go
test
fix build
revert merge conflict for applyTraits
Switch to using pinning package to marshal/unmarshal
* respond to PR review
* updated the need for a agents to upsert node
* revert permissions.go change for upserting node
Update auth_with_roles.go
* set gogo proto options to false for openSSHCertRequest so that we can import teleport.scoped.v1.Pin
Update authservice.pb.go
* Add node ID check in upsertNode
* fix test structure
Update auth_with_roles_test.go
* Add disconnect expired cert and lock mode for scoped role
Update IAC docs
* respond to code review
Add a scoped authorizer in the forwarder_test
fix up proto comments
Update forwarder.go
* fix forwarder setting nil disconnectExpiredCert
* Update validate lock to accept empty string - will be treated as best_effort down the line
add comment
* Add `beam-user`, `beam-admin`, and `beam` roles
Migrates the beam roles from the cloud tenant controller, adds descriptions, and
marks `beam` as a "system" role so it does not show in the role selector.
Fixes https://github.com/gravitational/beams/issues/137
* Make `host_cert` permissions more restrictive
* Disable beams roles in OSS
* Extract beams login into a constant
* Fix stray quote
* Further lock down the host cert permissions
* Fix role preset tests
* Using `host_cert.role` in expressions doesn't work
* Improve look of ReAuthenticate in Connect
* Display `<Text>` for reason only if reason is present.
* Drop "from trusted cluster" being appended to reason. This will be
moved to api/mfa/prompt.go.
* Center text for browsermfa and sso so it matches webauthn.
* Consistent comma at the end of text for each method.
* Add leaf cluster name to prompt reason for MFA
* Fix resource type casing in MFA prompt
* Assert MFA prompt in tests
Prior to this change, users who manually register dynamic desktops
using the same labels that the LDAP reconciler uses could trick
the reconciler into managing desktops that it shouldn't own.
Additionally, the LDAP reconciler would pull all desktops from
the backend, including the dynamically registered ones. Since
these dynamic desktops aren't found in LDAP, the reconciler
woudl think they are stale and incorrectly delete them.
Use a new status field (because changing teleport.dev/origin is unsafe)
in order to indicate desktops managed by LDAP. This ensures that
the LDAP reconciler operates only on LDAP-managed hosts.
* Add protos
* implement validation and matching support
* generated integrations stuff
* De Morgan, and his faithful followers, have once again defeated me in battle
* Udpate tests in lib/kube/token
* Extend join_kubernetes_test.go
* Fix missing param
* Extend validation tests
* Fix minor nits
* qF1001: CoUld aPpLY de MORgan'S LaW (stAticCHEck)
* Add session event to enhanced summaries for desktop + other recording type events
* Add more comments to proto
* Fix proto numbers
* Handle deprecation in recording TUI
* Change 'EndOfFile' property to int64 from uint32
* Plumb the new int64 'EndOfFile' field through the rest of the backend and client
* Switch 'size' field of truncate requests to uint64 instead of int64
* Update everything downstream of the new uint64 'size' field
* Update lib/srv/desktop/tdp/protocol/tdpb/translate.go
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
---------
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
STeve (Xin) Huang