We added this function to mitigate slow user.Current() calls in
Windows Active Directory environments. Go 1.24 ships with an optimized
verison of user.Current, rendering this utility unnecessary.
Closes#41922
* Vendor gravitational/trace/trail in api
Pulling in the trail package directly in api will allow the trace
module to shed the grpc-go dependency. This needs to land prior
to https://github.com/gravitational/trace/pull/112 being included
in a new version of trace.
There should be no noticable change in the api depdency tree since
it already depends on grpc-go. Some additional items from the
trace/internal package were also vendored within trail as needed.
Additionally, some of the public api of trail that was not being
consumed has been made private.
* fix: appease linters
We suggest that a UUID is used for agentless nodes metadata.name
field, but we do not enforce it. This causes several edge cases
and slightly weird UX in places that expect the name to be a UUID.
Most notably, this presents dialing problems for the web ui as
described in https://github.com/gravitational/teleport/issues/50914.
To allowing dialing to function in all cases for these servers,
routing has been updated to permit matches on metadata.name, however,
the match is given a lower score then a match on a UUID. This should
permit dialing, though, it may still result in ambiguity.
Closes#50914.
* Add TargetPort to RouteToApp and AppMetadata proto messages
* Pass TargetPort during cert generation
* Refactor Pack.makeTLSConfig to accept struct
This will make it easier to add targetPort to it.
* Add labels to UUIDs used by appaccess test pack app servers
This makes them easier to distinguish when routing doesn't work as expected.
* Refactor Pack.CreateAppSession to accept a struct
* TestTCP: Create app session within test
If we kept the old code, we'd need to manually create a session for each
target port, which would create a lot of duplication.
* Prepare integration test fixtures for multi-port tests
* Add api/utils/net.IsPortInRange
* Use TargetPort when routing TCP connections
* Inline dialMultiPortTCPApp, centralize logic
* Check target port when connecting to single-port app
* Reorder check in IsPortInRange
* Use int instead of uint16
* Extract picking dialTarget to separate function
* addr → uriAddr
* Improve err msg for single-port apps when targetPort != uriPort
* Fix unnecessary conversion to int
* Add Ports to AppSpecV3
* Validate ports of api/types.AppV3
* Add Ports to lib/config and lib/service/servicecfg
* lib/config TestApps: Improve error messages
* lib/service: Convert servicecfg.PortRange to types.PortRange
* Add multi-port TCP apps to config and tctl tests
* Rename Ports to TCPPorts
* Change port fields to uint16 where possible
* Update comments for Port and EndPort
* Extract port range validation to api/utils/net
* Replace custom check type with require.ErrorAssertionFunc
* Simplify validation of end port
* Fix expected message in api/types test
I forgot to update that one.
* Use math/rand/v2's thread-local RNG for jitters
* Replace NewJitter() with DefaultJitter
* Replace NewFullJitter() with FullJitter
* Replace NewHalfJitter() with HalfJitter
* Replace NewSeventhJitter() with SeventhJitter
* Inline jitters in lib/utils/diagnostics/latency
* Replace var jitters in lib/utils with proxy functions
* Replace utils.HalfJitter with retryutils.HalfJitter
* Replace utils.FullJitter with retryutils.FullJitter
* Replace utils.SeventhJitter with retryutils.SeventhJitter
* Replace sharded jitters with thread-local ones
* Remove NewSeventhJitter reference in integrations
* [entraid] add setup script for offline clusters.
This PR adds a cli configuration for Entra ID where it's possible to default to system credentials instead of relying on OIDC for authentication in EntraID. OIDC is not always a possibility specially when the cluster is private and not internet acessible.
The UX is the following:
```text
Step 1: Run the Setup Script
1. Open **Azure Cloud Shell** (Bash) using **Google Chrome** or **Safari** for the best compatibility.
2. Upload the setup script using the **Upload** button in the Cloud Shell toolbar.
3. Once uploaded, execute the script by running the following command:
$ bash entraid.sh
**Important Considerations**:
- You must have **Azure privileged administrator permissions** to complete the integration.
- Ensure you're using the **Bash** environment in Cloud Shell.
- During the script execution, you'll be prompted to run 'az login' to authenticate with Azure. **Teleport** does not store or persist your credentials.
- **Mozilla Firefox** users may experience connectivity issues in Azure Cloud Shell; using Chrome or Safari is recommended.
Once the script completes, type 'continue' to proceed, 'exit' to quit: continue
Step 2: Input Tenant ID and Client ID
With the output of Step 1, please copy and paste the following information:
Enter the Tenant ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Enter the Client ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Successfully created EntraID plugin "name".
```
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* move function to api
* handle code review comments
* Apply suggestions from code review
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* fix url
* enable group claims
* add godoc
* handle code review comments
* fix gomod
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Marco Dinis <marco.dinis@goteleport.com>
* Add new protos for hardware key prompts
* Implement hardware key prompts on the daemon side
* Show prompts in the UI
* `PromptHardwareKeyPINAsk` -> `PromptHardwareKeyPIN`
* Improve proto docs
* `PromptHardwareKeySlotOverwrite` -> `ConfirmHardwareKeySlotOverwrite`
* Fix typo
* Remove unnecessary `form`
* Pass an enum to `AskPIN` instead of the entire message
* Remove an invalid restriction of PIN/PUK to numbers only
* Improve the copy
* Allow passing custom prompt to YubiKey
* Handle `prompt.Touch` cancellation
* Pass `HardwareKeyPrompt` through all the layers
* Add an empty `HardwareKeyPromptConstructor` to Connect
* Remove `ParsePrivateKeyWithCustomPrompt`
* Add missing godoc
* Fix teleterm tests
* Include `cliprompt.go` only for `go:build piv && !pivtest`
* Lint and test fixes
* Cache yubikey objects.
* Cache PIV connections to share across the program execution.
* Do not release the connection until `sign` returns
* Do not ignore errors
* Perform a "warm up" call to YubiKey
* Fix tests
* Use a specific interface to check if the key can be "warmed up"
* Allow abandoning `signer.Sign` call when context is canceled
* Make sure that the cached key is valid for the given private key policy
The reason for adding this check was failing `invalid key policies` test.
* Make `hardwareKeyWarmer` private
* Force callers to release connection
* Improve comments
* Fix lint
* Improve `connect` comment
* Fix race condition
* Simplify `release` logic
* Trigger license/cla
---------
Co-authored-by: joerger <bjoerger@goteleport.com>
* Fix creation of JKS wallet for Oracle.
Unwrap *keys.PrivateKey to fetch inner signer that satisfies `x509.MarshalPKCS8PrivateKey` expectations. This change allows passing keys.PrivateKey to createJKSWallet. The updated function will correctly marshal the private key for Oracle's JKS wallet creation.
* Add and use `MarshalSoftwarePrivateKeyPKCS8DER`.
* Update lib/client/db/oracle/oracle_test.go
Co-authored-by: Nic Klaassen <nic@goteleport.com>
---------
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* fix: tolerate mismatched key PEM headers
Issue #43381 introduced a regression where we now fail to parse PKCS8
encoded RSA private keys within an "RSA PRIVATE KEY" PEM block in
some cases.
This format is somewhat non-standard, usually PKCS8 data should be in a
"PRIVATE KEY" PEM block. However, certain versions of OpenSSL and
possibly even Teleport in specific cases have generated private keys in
this format.
This commit updates ParsePrivateKey and ParsePublicKey to be more
tolerant of PKCS8, PKCS1, or PKIX key data no matter which PEM header is
used.
Fixes#46710
changelog: fixed regression in private key parser to handle mismatched PEM headers
* fix typo in comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* key split wip
* fix piv tests
* fix terraform tests
* spelling fixes
* fix kube benchmark
* fix identity files in integrations tests
* self review
* fix typo in comment
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* speed up device login tests
* use EC keys in TestProxyAppWithIdentity
* faster tsh tests
* fix race on error value
* fix lint
* write out EC SSH keys in OpenSSH format
* fix lint
* fix keyring comparisons
* PrecomputeTestKeys in lib/client
* parallelize TestNoRelogin subtests
* use ecdsa for self-signed TLS certs
* remove redundant GetTrustedCerts
* improve latency of precomputeTestKeys
Instead of waiting for all 25 test keys before returning a single one,
tests can now make use of the first precomputed test key as soon as it's
ready.
In local testing with this change, the first key is ready after ~75ms vs
>350ms on master.
* fix test and lint
---------
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* disable tls client resumption
* avoid redundant verification in TLSDial
* fix wrong use of InsecureSkipVerify in HTTP auth client
* avoid overwriting GetClientCertificate in api client
* Use a getter function for CAs in TunnelAuthDialer
* Use dynamic connector data for the agent's auth client
* Make getPROXYSigner dynamic
* WIP: the thing (reloadless)
* Fix TestInstanceCertReissue
* Fix TestIntegrations/RotateFoo
* get rid of the whole reload mechanism
* Update most tests to not check for reloads
* Get rid of TestDatabaseAccess/RotateTrustedCluster
The test has been unconditionally skipped for two years now.
* avoid clobbering the auth connector
* overwrite clientState in update_servers anyway
* fix integration/hsm tests
* Document ListenForNewEvent
* fix RunWithSignalChannel godoc
* simplify ListenForNewEvents
* Remove forgotten commented code
* Explain the t.Setenv trick for non-parallelism
* explain waitingForNewEvent in integration/hsm
* consolidate (un)marshalling of key PEMs
This commit consolidates various functions we have for marshalling
private and public keys to and from the PEM format, mostly by replacing
functions from lib/utils and lib/tlsca with equivalents in api/utils/keys.
The new functions also support ECDSA and Ed25519 keys, which is
necessary for the implementation of RFD136.
* speed up TestMTLSClientCAs
* fix new use in local proxy middleware
* Save the WebAuthn UserHandle in the mock Key
* Simplify passwordless tests
* fix: Forbid SSO users from logging in using passwordless
* Rename tests to TestPasswordlessProhibitedForSSO
* Use testServer.MakeTestServer to fix issue with parallel runs using the same ports.
* Add deprecation comments for test server helpers outside of tools/teleport/testenv.
* Update tool/teleport/testenv/test_server.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Disable SSH resumption
Enable LoadAllCAs
Update comments
* Prevent context.Canceled from being wrapped across transport stream
trail doesn't properly handle conversions to and from errors that
are context.Canceled which results in code paths trying to evaluate
errors.Is(err, context.Canceled) failing. The error recevied is
an interceptors.RemoteError, which wraps a trace.TraceErr, which
contains a status.Status with codes.Canceled. To work around this
until trail is updated the server half of the stream was updated
to return an io.EOF if if encouters a canceled error.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
Edoardo Spadolini