* Teleport Proxy Behind ALB support for IP Pinning
* move X-Forwarded-For handling to a middleware
* fix where middleware should be nil
* minor refactor based on review comments
* remove TODO and use contains
* use_x_forwarded_for -> trust_x_forwarded_for
* add NoopHTTPMiddleware
* [Assist] Include embeddings in the prompt
* Add comments
GCI
Minor fixes
* Move stuff
* Fix tests
* Fix tests
* Fixes after rebase
Apply code review suggestions.
* Address review comments
* After rebase fix
* feat: adds motd to the ui
* address review suggestions:
- update MOTD to Motd
- moved motd state to useLogin
- added behaviour tests
* add motd test to apiserver_test.go webconfig. update snapshot test to address motd warning
* git mv to update MOTD to Motd
* multiple fix:
- add unmount test
- remove motd title
- group states together in useLogin
- update arrow func to classic js func
* remove unused waitForElementToBeRemoved
* Fix an issue ALPN handshake test does not respect "HTTPS_PROXY"
* address review comment
* remove simplehttsproxy
* Add context to IsALPNConnUpgradeRequired in ten thousand places
* add goc and dial with context
This PR adds a new gRPC service `AuditLogService` that allows clients to
request audit log events as unstructured data. Data is returned as
`structpb.Struct` representation which is convertible to JSON.
Unstructured data allows clients to receive audit events without
prior knowledge of their proto wire representation if their end goal is to
export the events as JSON to an upstream service. It allows clients
whose version is older than Auth's version to receive events that their
proto version doesn't support. Exporters can continue operating without
losing events or having to upgrade them each time Auth is upgraded.
Part of https://github.com/gravitational/teleport-plugins/pull/821
Part of https://github.com/gravitational/teleport/issues/23388
* [Assist] Allow removing assist conversations
* Display landing page after the conversion is removed
* Improve styling and add a confirmation dialog
* Change the icon opacity to copy the main navigation
* Remove unused minus icon
* Add missing trace.wrap
---------
Co-authored-by: Ryan Clark <ryan.clark@goteleport.com>
This commit updates all `err == io.EOF` comparisons to use
`errors.Is(err, io.EOF)`. This is necessary when the error may have been
wrapped and fixes at least one current breakage (in `tsh request ls`).
`golang.org/x/tools/refactor/eg` was very handy for this, I used the
following template:
```go
package teleport
import (
"errors"
"io"
)
func before(err error) bool { return err == io.EOF }
func after(err error) bool { return errors.Is(err, io.EOF) }
```
* Introduce inventory service counts.
Inventory service counts have been introduced. These will be useful when
trying to conditionally act on the presence of a particular service in a
Teleport cluster. In particular, these will be used to disable Okta's
access request reconciler when there are no Okta services connected to the
cluster.
* Rename to ConnectedServiceCounts, improve load to be more performant.
* Fix imports.
* Update GRPC.
* Expose a ConnectedServiceCount that looks for one particular service, don't populate the underlying map on read.
* Assist - API implementation
* Add Assistant CRUD test
* Move assistant API to a separate file.
* Rename GRPC methods
Fix comments
* Address PR comments
* Update GRPC API - addressing code review comments
* Move assist API to a new GRPC service
* Add Assistant RBAC rules to this backport.
* Add missing license
* Update comment.
The Okta client was creating a separate connection to Auth in
`auth.NewClient` instead of reusing the gRPC connection of the
api client. Since this method is used by every Teleport instance
when establishing their initial connection to Auth it poses two
problems:
1) Auth now has one additional connection per instance
2) Proxies require an additional trasnport channel per tunnel
Fixes#25235
* Add IsUsageBased to features and send to web UI
* Update flag name
* Improve comment
* Add comments and improve field name
* Remove duplicated property
* Support UI methods for user groups, label match user groups in API.
UI methods have been added to User Groups to support the enterprise Okta
service. This will allow groups to be queried and displayed on the new
access request page appropriately.
Additionally, after adding group labels to roles, the access checking was
not added to the appropriate user groups endpoints in auth_with_roles.
This has been added to ensure that users can only see the user groups they're
supposed to see when requesting access.
* UI lint issues.
* Use web address when appropriate for a jump hosts
Determines whether the jump host provided via `tsh ssh -J` is belongs
to the Proxy SSH or Web server to ensure when using jump hosts that
connections are established directly on the target cluster.
Closes#25178
* Modify tsh tests to capture issues with jump hosts
Alters the root and leaf cluster and node names used by tsh tests
so that the root cluster is named `root` instead of `localhost` and
sets a unique `NodeName` for each cluster instead of reusing
`localnode` for both. This was masking problems in jump hosts tests
by connecting to the node in the root cluster instead of the leaf
cluster.
Some additional changes to tsh tests were made as a result of
changing the cluster and node names.
* fix proxy client tests
* update TestList to login once
* ignore TestList in flaky test detector
* fix connecting to agentless leaf nodes
Pass user and role information to Auth server signing OpenSSH cert
so avoid user/role lookup errors if the target node is on a leaf
cluster. Also use role and trait information from the current
connection rather than the backend to support role impersonation.
* make protobuf changes backwards-compatible
* Simplify Okta assignment statuses.
The Okta assignment statuses have been simplfieid so that there's only a
status on the Okta assignment object itself and the number of states is
reduced.
* Fix tests, remove unused code.
* Add in Duration for update statuses to prevent changing status too soon.
* Make sure LastTransition is UTC.
* Remove actions in favor of targets, make cleanup time non-nullable.
* Add full IP pinning enforcement
We're adding IP pinning check to `authorizer.Authorize` which is used for every call,
so now all communications with teleport should enforce IP pinning.
Also making sure we always provide login IP for user certificate creation
and correct client IP propagation everywhere.
* Add integration test for App IP pinning.
* Fix wording
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Wrap error
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Add godocs
* Clone TLS config
* Improve proxyHeaderSigner usage
* Wider use proxyHeaderDialer and remove adhoc writing of singed header
* Add helper function TLSDial
* Use proxyHeader dialer in authConnect
* Simplify tlsConfig manipulation
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
* Remove redundant channels processing in TLSDial
* Reduce nesting
* Update generated protobufs
* Remove ignoring of bad IP on signed PROXY header generation
* Provide logger to CheckIPPinning function
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
* AWSOIDC Integration: ListDatabases
This PR adds a new Action for the AWSOIDC Integration: ListDatabases
The goal of this action is to provide the User a list of RDS Databases
from which the User will pick one to be added as a Teleport Database
Resource.
This way, the user doesn't need to copy/paste DB name, endpoints and
labels.
Before being able to call this action, the User has to set up an AWS
OIDC integration.
How does it work:
```
Client (web app)
│ ▲
│ │4. Returns list of DBs
1. List Databases │ │ (name, tags, status, endpoint)
│ │
│ │
│ │
│ │
▼ │ 3. rds.DescribeDBInstances
┌───────────┴────┐ (auth: token) ┌─────────┐
│ ├─────────────────────────────────►│ │
│ Teleport Proxy │ │ AWS │
│ │ 3.1. Get OIDC Config │ │
│ │◄─────────────────────────────────┤ │
│ │ 3.2. Get RSA Public Key │ │
│ │◄─────────────────────────────────┤ ├─────────┐ 3.3.
│ │ │ │ │Validates token signature
│ │ │ │ │with received public key
│ │ 3.4 Returns list of DBs │ │◄────────┘
│ │◄─────────────────────────────────┤ │
└─┬──────────────┘ └─────────┘
│
│ 2. Sign Token
│
▼
┌───────────────────┐
│ │
│ Teleport Auth │
│ RSA Private Key │
└───────────────────┘
```
* add resource and account ids to DB resource
* move api namespaces
* use types.Database instead of custom database format
* add database uri
* fix comments and rate limiter
* test name override when converting RDS V2 DBs
* fix webapi database URI field
* TestClusterDatabasesGet: add parallel
* ALPN connect test improvements
* fix typos
* remove extra period
* simplify error check
* moving things over
* tsh dials
* reverse tunnel
* fix auth connect
* move ping
* add ssh support
* add HTTP client support
* Move ALPN dialer, ALPN conn upgrade, Ping conn to api
* beatify
* add test
* beautify round 2
* fix timeout
* Implement alpn-ping upgrade for reversetunnel and ssh
* clean up
* fix proxy test
* minor refactor
* remove WebProxyAddr
* require IsALPNConnUpgradeRequiredFunc
* add tlsRoutingWithConnUpgradeConnect
* fix lint
* simplify
* remove debug log and change unknown upgrade type to 404
* Force new proxy client to use web proxy when TLS routing is enabled
To date clients attempting to access a resource first have to call
`proto.AuthService/IsMFARequired` to determine if an mfa ceremony
is needed for access to a resource. In an effort to reduce an
extra round trip to the Auth server this can can be bundled into
`proto.AuthService/GenerateUserSingleUseCerts`.
In order for RBAC to determine if mfa is required for SSH sessions
the OS login of the session must be known. To accomodate this a
new `SSHLogin` field was added to `proto.UserCertsRequest`.
The response to the initial request of the stream now contains a
`proto.MFARequired` enum which indicates whether mfa is required,
not required, or it's unknown if mfa is required. The last variant
should only be returned when the `SSHLogin` field is unset in the
initial request.
The `(auth.Server) isMFARequired` check was also modified for nodes
to make use of `ListResources`. Instead of retrieving **all** nodes
into memory and finding the matching ones, a request is made to
`ListResources` with the `SearchKeywords` populated with the target
from `proto.IsMFARequiredRequest_Node.Node.Node`. Care was taken
to filter out any matches from labels to preserve the original
matching behavior.
Adds `GetResource` helpers that leverage generics to return a slice
of the expected resource type. This eliminates the need to use
a `type.ListResourcesResponse` and then call `AsServers` to convert
the `[]types.ResourceWithLabels` to `[]types.Server`.
Only calls for `types.Server` have been converted. Other resources
can be converted over time.
* Convert tsh ssh to use the proxy transport service instead of ssh
In an effort to reduce latency establishing sessions `tsh ssh` is
migrating away from connecting to the Proxy via SSH in favor of
using gRPC. The SSH handshakes with the Proxy increase latency in
situations where the distance between geolocations of the client
and Proxy are large. TLS handshakes used by the gRPC service have
proven to reduce latency by ~20% in the same scenario.
A new `lib/client.ClusterClient` has been introduced that should
be used instead of `lib/client.ProxyClient` to connect to a Teleport
cluster. Most of the functionality within the `ClusterClient` was
a direct copy from the `ProxyClient`.
The `lib/client.TeleportClient` now has a `ConnectToCluster` method
which will connect to both the Proxy and Auth service via the
`api/client.ProxyClient` which first attempts to use gRPC and reverts
back to SSH to preserve backwards compatability. The `ClusterClient`
should be passed around and reused instead of following the
established pattern of `tc.ConnectToProxy` followed by a
`proxy.ConnectToCluster` to get an `auth.ClientI`.
Additionally some of the `agentless` package was refactored to reduce
dependencies and allow it to work with connections to the Proxy that
originated via gRPC instead of SSH.
Changes to the integration tests are mostly to accomodate IP Pinning
and ensure that it works for both connections established via SSH
and gPRC.
This is the final PR needed to complete #19812.
* fix typos and unify span attributes
* pass node name to ConnectToNode
* simplify jump host resetting
Instead of relying on users to provide the cluster name, the client
now determines the cluster name by inspecting the certificate
presented by the Proxy during the TLS or SSH handshake. This is
required when connecting to a Proxy via a jump host since the
name of the cluster may not match the currently logged in cluster.
This is achieved by leveraging a custom `credentials.TransportCredentials`
when connecting via gRPC and a custom `ssh.HostKeyCallback` when
connecting SSH.
* Integration resource: add types and grpc methods
This commit adds the new types for Integration resource.
It also adds the gRPC methods that will be used later on for:
- Integrations CRUD management
- Integrations resource caching
* decouple integration service from auth
* return resource on CRU operations
* Add OneOf prop to distinguish Integrations subkind
* Version subkind spec
* godocs
* Use `cloud/stable` when Automatic Upgrades is on.
Teleport provides scripts to install teleport agents/services.
Those scripts use YUM/DEB repositories when possible.
Each repo has multiple channels:
- stable/v11
- stable/v12
- cloud/stable
We want to ensure that if the cluster is running in the cloud and
automatic upgrades is on (auth service was started with
TELEPORT_AUTOMATIC_UPGRADES=yes teleport ...), then the installation
script must offer the `cloud/stable` channel.
This PR changes the following scripts:
- Discover Install Node
- Discover Install Database Service
- Install App script
- EC2 default-installer and EC2 default-agentless-installer
* add helm chart knobs to enable auto updater
* use let instead of const and remove default export
* add HA to helm chart
* always return .automatic_upgrades in web ping response
* rename cloud/stable to stable/cloud
* fix ts test
