* Composite the cursor in Rust during ResizeCrop
* Apply code review feedback
* Update test
* Move CursorBitmap to an enum, remove Cow, avoid cloning the bitmap
* Remove dereference
* Invalidate E2E Rust cache on decoder changes
VERSION can be empty if there is an error running get-version.
Quote the arg so that empty VERSION is detected and returns
an error when running make docs.
* MWI: Ignore `user_login_state` for bots
This change is part of a fix for gravitational/teleport#63920, where
the Okta usermonitor will inadvertently create unneccessary ULS
entries for bots when they are deleted. Normally, these ULS entries
are sane, but if the bot is deleted and recreated too quickly, there's
a race.
Here's the sequence of events:
1. The user creates a bot (`tctl bots add` or similar)
2. The usermonitor watcher catches the OpPut and creates a sane ULS
entry
3. The user deletes the bot (`tctl bots rm ...`)
4. The usermonitor watcher catches the OpDelete and replaces the sane
ULS with an empty variant, with no roles or labels.
5. The user recreates the bot (`tctl bots add ...`)
6. One of two events happens first:
1. The usermonitor watcher catches the OpPut and replaces the bad
ULS with a sane variant.
2. The bot joins and receives certificates
If 6.1 occurs before 6.2, the bot joins normally and receives valid
certificates. If 6.2 occurs before 6.2, the bot is issued certs with
roles derived from the bad ULS (i.e. empty list) and fails to start
due to the invalid cert bundle.
In my testing, the race window is ~1 second. I see a ~10% failure rate
if the bot is joined within 0.5 seconds of being recreated, and a 50%
failure rate if the bot is joined immediately (well, as immediately as
tbot can start after `tctl bot add ...` returns). Bot joins generally
succeed if there's >= 1 second between recreate and join.
The associated teleport.e makes the usermonitor ignore bots so new
invalid ULS entries won't be created. However, this isn't sufficient
to fix the bug for existing clusters. This PR adds 2 additional fixes:
- `GetUserOrLoginState()` always returns the user variant for bots,
ignoring any potential ULS.
- Deleting a bot now deletes any ULS entry for the bot
See also: https://github.com/gravitational/teleport.e/pull/8773
* Fix failing test
* First Draft of teleport-session-review skill
Framework based on ACL skill
* Adds Examples and Playbook for how to use Session Search
* Add a preflight check
* Feedback from Docs
* Extra Testing on a Teleport Cloud Tenant
* Docs to Skill
* Remove local dev for now
* update locate commands to include $TSH
* Update docs/pages/identity-security/session-summaries/session-search.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove Filter caveats
These have been fixed
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Document user display names and how Teleport derives them
* remove redundant notes on display name behavior in user types documentation
* drop unnecessary word
* refine user display name mapping for Okta, Microsoft Entra ID, SAML/OIDC, and SCIM integrations
* refactor: streamline display name documentation across identity provider integrations
* update user display name documentation
* improve clarity and consistency in user display name documentation
* Add public docs for the CA override feature
* Use `code` blocks instead of `shell`
* Number steps as n/d. Move alternatives to H3.
* Move intro paragraphs to "How it works"
* Remove "Supported CAs" section, move its contents to other sections
* Mention specific commands in the info box
* Emphasize future growth
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add proxy verb to kubernetes_resources
* Preserve upstream kube Status code in forwarder
* Readable comment
* Strip [scheme:]name[:port] on kube proxy paths
* Use SplitSchemeNamePort from k8s apimachinery
When Discovery Service tries to install teleport in a given instance, so
that it can join the cluster, it first does a couple of preflight checks:
- sudo, bash, curl commands exist?
- enough disk space?
- ...
When checking for disk space we are using /opt folder.
Howevers VMs can have a specific mount point for the /opt/teleport.
This changes ensures we check the correct folder, and in order.
So, if /opt/teleport exists, that's the folder that will be used when
checking for required space.
* Surface user display names in web Users page and user details
* Refactor user authentication type display and update related tests
* reduce code churn
* add 16px back
* Refactor UserDisplayName component for improved layout and update related tests
* Refactor UserDetails tests to improve rendering checks and remove unnecessary assertions
* add session filter, access predicate, impersonate checks; fail fast on invalid expressions at create/update
* add list indexes to role validation error messages
* reject wildcards in search_as_roles and preview_as_roles
* validate join_sessions and require_session_join fields
* include index and tool value in mcp.tools validation error
* update commentary
* aggregate errors in ValidateRole
* aggregate errors in ValidateAccessPredicates
* validate linux_desktop_logins templates
In the fallback path when addresses are pulled from the context,
we were incorrectly setting the destination address to the source
address, which results in incorrect auditing.
* Update Go version to v1.26.4
* Rm GO_VERSION from Makefile/Dockerfile and rely on go.mod to inform Go version. Update code to adhere to 1.26 deprecation/changes.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Bump e to 54d1d0cb67b71860b943de477b3146d32ccdd74a.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
---------
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
Co-authored-by: teleport-renovate[bot] <275214890+teleport-renovate[bot]@users.noreply.github.com>
Co-authored-by: Chris Thach <chris.thach@goteleport.com>
* Convert existing non-gogo codegen to the Hybrid API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All existing protos explicitly set to API_OPEN have been change to
API_HBYRID. The new codegen was performed via make grpc. There are no
other functional changes to the code to start consuming the Hybrid API
those will come later. The intent is to get all Hybrid codegen in and
backported to ease the transition.
* Initial migration to the Opaque API
Contributes to https://github.com/gravitational/teleport/issues/66776.
All of the changes here are mechanical conversions generated from
`open2opaque rewrite -levels=green ./...`. There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=yellow followed by
-levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more
details.
* [2] Migration to the Opaque API
Contributes to #66776.
All of the changes here are mechanical conversions generated from
open2opaque rewrite -levels=yellow./.... There will be a follow up
to this in teleport.e which does the same. Once all changes have been
merged the process will be repeated with -levels=red.
See https://protobuf.dev/reference/go/opaque-migration/ for more details.
"Load more" in the recordings search TUI (and --resume-token) failed with
"start_time is required" after the latest access graph update.
Follow-up pages were sent with only the batch_token, relying on the
proto comment that claimed all other filter fields are ignored
once batch_token is set. That contract is wrong: the server validates
and applies start_time/end_time and every other filter on each request,
and the access graph re-checks that the checkpoint falls
within the requested time range.
The batch token is intentionally only a cursor and does not carry the full
search state - encoding every filter into the token would let it grow to
very large sizes. So the original request must be replayed with the
batch_token set on each page. Build the request once and have the fetcher
clone it and attach the token for the initial page, resume, and load-more,
fixing both the TUI and --resume-token.
Also surface the fetch error back to the user: a failed "load more" now
opens a popup with a red header and the server message rendered as code,
instead of silently swallowing the error behind a "(retry)" label.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Fix error in list helpers terminating iteration too early on unmarshal failure
The List calls in generic in a handful of handrolled implementations would pass
`Limit` to `s.Backend.Items`. This means that if enough items fail to unmarshall
in the loop we could exit early and never return the next page token.
* also fix plugins and friends
* spelling
* Resize RDP images in Rust instead of Go
* go mod tidy all
* cargo fmt
* Add tests
* Remove unused Thumbnail()
* Change ResizeCrop() to return an error
* Avoid hard-coding the bytes per pixel
* Release resources in tests
* Clamp dimensions to at least 1x1
* Add x/image to e_imports
* Fix linting
* Fold resize options and crop bounds check into resize_crop_into
* Run cargo fetch
Fix some special casing for the light theme that caused
the alerts to look different (with a full border).
Fix the ability to dismiss the alerts by clicking anywhere
outside. (We were never setting the ref correctly so this
functionality wasn't working).
Improve the styling with some padding, a divider, and
consistent width.
Lastly, avoid specifying the entire alert content as the
title, which renders in bold. Large amount of bold text
are difficult to read.
The legacy RegisterUsingToken HTTP route was removed in #53110. Outdated
agents still attempting to join via this endpoint receive a 404, which
gives operators no actionable indication of the real problem.
Re-add POST /:version/tokens/register with a handler that returns an
AccessDenied error telling the client it is too old and which version to
upgrade to.
Part of #64567.
Agentless resources (integration app servers, or tctl/gRPC-created) have
no agent to heartbeat ComponentFeatures to presence/the unifiedresources
aggregation layer. Compute from resource type instead of reading the
spec field for these.
* check arguments for NULL in converse PAM converse func, trim trailing newlines in user input
* Update session/pam/pam.c
Co-authored-by: Erik Tate <erik.tate@goteleport.com>
---------
Co-authored-by: Erik Tate <erik.tate@goteleport.com>
* ensure PAM retval is always valid when calling pam_end, prevent deadlock in PAM.free()
* don't call PAM.free in PAM.codeToError, require explicit cleanup to avoid confusion
* unregister handler if Open fails
* always return an error from codeToError
Ryan Clark