Beams runs an app_service, configured to look for apps with
the "teleport.internal/beams/app-type" label.
Users should not be able to create apps with this label - we expect
these apps are only created via static beams config or via the
`tsh beams publish` command.
It's safe to block these requests at the RPC layer because beam
apps are written directly to storage and don't go through these
auth RPCs.
* Add scope support to OpenSSH certificate generation
simplify scopes open ssh connection
Add DeviceVerified and isBot in the signer
tweak signer to be lazily referenced
revert adding login to client
Pass in targetServer to the OpenSSHCertRequest instead - use CheckAccessToSSHServer to check if scoped role has access
Respond to pr review
Changed signature of DialHost to use a struct before it gets too big
Changed requestedHostLogin to login and targetnodescope to targetserverscope
fix build
Update auth_with_roles.go
Update split_access_checker.go
Update agentless.go
Update auth.go
fix test
Update authservice.pb.go
move cert gen
alias auth proto instead and update the test error expectation
rename goproto go googleproto for better readability - address pr feedback
Update integration_test.go
test
fix build
revert merge conflict for applyTraits
Switch to using pinning package to marshal/unmarshal
* respond to PR review
* updated the need for a agents to upsert node
* revert permissions.go change for upserting node
Update auth_with_roles.go
* set gogo proto options to false for openSSHCertRequest so that we can import teleport.scoped.v1.Pin
Update authservice.pb.go
* Add node ID check in upsertNode
* fix test structure
Update auth_with_roles_test.go
* Add disconnect expired cert and lock mode for scoped role
Update IAC docs
* respond to code review
Add a scoped authorizer in the forwarder_test
fix up proto comments
Update forwarder.go
* fix forwarder setting nil disconnectExpiredCert
* Update validate lock to accept empty string - will be treated as best_effort down the line
add comment
* Add `beam-user`, `beam-admin`, and `beam` roles
Migrates the beam roles from the cloud tenant controller, adds descriptions, and
marks `beam` as a "system" role so it does not show in the role selector.
Fixes https://github.com/gravitational/beams/issues/137
* Make `host_cert` permissions more restrictive
* Disable beams roles in OSS
* Extract beams login into a constant
* Fix stray quote
* Further lock down the host cert permissions
* Fix role preset tests
* Using `host_cert.role` in expressions doesn't work
* Improve look of ReAuthenticate in Connect
* Display `<Text>` for reason only if reason is present.
* Drop "from trusted cluster" being appended to reason. This will be
moved to api/mfa/prompt.go.
* Center text for browsermfa and sso so it matches webauthn.
* Consistent comma at the end of text for each method.
* Add leaf cluster name to prompt reason for MFA
* Fix resource type casing in MFA prompt
* Assert MFA prompt in tests
Prior to this change, users who manually register dynamic desktops
using the same labels that the LDAP reconciler uses could trick
the reconciler into managing desktops that it shouldn't own.
Additionally, the LDAP reconciler would pull all desktops from
the backend, including the dynamically registered ones. Since
these dynamic desktops aren't found in LDAP, the reconciler
woudl think they are stale and incorrectly delete them.
Use a new status field (because changing teleport.dev/origin is unsafe)
in order to indicate desktops managed by LDAP. This ensures that
the LDAP reconciler operates only on LDAP-managed hosts.
* Add protos
* implement validation and matching support
* generated integrations stuff
* De Morgan, and his faithful followers, have once again defeated me in battle
* Udpate tests in lib/kube/token
* Extend join_kubernetes_test.go
* Fix missing param
* Extend validation tests
* Fix minor nits
* qF1001: CoUld aPpLY de MORgan'S LaW (stAticCHEck)
* Add session event to enhanced summaries for desktop + other recording type events
* Add more comments to proto
* Fix proto numbers
* Handle deprecation in recording TUI
* Change 'EndOfFile' property to int64 from uint32
* Plumb the new int64 'EndOfFile' field through the rest of the backend and client
* Switch 'size' field of truncate requests to uint64 instead of int64
* Update everything downstream of the new uint64 'size' field
* Update lib/srv/desktop/tdp/protocol/tdpb/translate.go
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
---------
Co-authored-by: Przemko Robakowski <przemko.robakowski@goteleport.com>
* Fix headless login when in-band MFA is required.
* Set HeadlessAuthenticationID in headless cert and allow bypass of in-band MFA if set.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Update proto to fix test.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Delete useless assert.
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
---------
Signed-off-by: Chris Thach <chris.thach@goteleport.com>
* Add audit event for environment profile
* Enforce that new event codes are registered in the web audit UI
Add TestEventCodesInWebTypes, a Go test that cross-checks every code defined in lib/events/codes.go against the eventCodes map in web/packages/teleport/src/services/audit/types.ts. Without an entry there, events appear as "Unknown" in the audit log UI.
A knownMissing set exempts 14 pre-existing gaps that predate the test; those should be fixed in follow-up PRs and removed from the list.
* Add web audit UI entries for environment profile update event
* Add beam list sorting
* ACL for beams
* Add `BeamServiceClient` to api client
* Use correct expires field for sorting
* Use case-insensitive sorting for user/owner
* Fix service client comment
* Refactor index selection
* Refactor backend sort validation
* Use enums for sort field and order
* Handle nil spec.expires at key creation
* Encode uft8-unsafe page tokens
* Fix tests naming
* Apply filters in backend `IterateBeams`
* Rename `ListBeamsRequestOptions.GetFilterOwners`
* Fix yield
* Tweak len access
* Always base32 encode page tokens
* Use bytestring type
* Don't use `IterateBeams` in `ListBeams`
`pageSize` was not propagated to the lister
* Add missing error checks
* Revert unnecessary comment change
* Make `IterateBeams` backwards compatible with teleport.e
* Make `ListBeams` backwards compatible with teleport.e
* Don't lower user name for cache index keys
* Godoc for MakeBeamFilterFunc
* Deny user acl for beams without entitlement
* Comment sorting validation in backend
* Encode page token only when required
* Remove upper bound on page size
* Decode page tokens in IterateBeams
* Remove redundant database configuration references
This:
1. Adds documentation for the mysql_server_version field of proxy_service
to the general config reference and improves formatting for a couple
of fields there.
2. Removes database config/resource references that are redundant due to
being covered by auto-generated docs or the more centralized teleport
config docs.
* Update docs redirects
* Update internal links pointing to deleted pages
* Update DatabaseSpecV3.Protocol comment with allowed database protocol types
- This PR is removing the old `db` resource reference.
- The new `db` resource reference is generated from the DatabaseV3
protobuf type.
- The old `db` resource reference defined the allowed values of the
protocol field, whereas this information is not in the `DatabaseV3` type.
- docs/pages/identity-security/session-summaries.mdx links to the `db`
resource reference, using it as a source of information on which values
are allowed for the protocol field.
Therefore, we must update the DatabaseV3 protobuf type with information
on which values are allowed for the protocol field.
* Add metadata/thumbnail generation for desktop recordings
* Rename isPTYSession to metadataParamsForSessionEnd
* go mod tidy
* Disable the processor if RDP decoder is not available
* Reuse png.Encoder and buffer instead of creating new per screenshot
* Add clarifying comment about returning nil, nil when no decoder
* Add Windows desktop end events
* Set the session start time from end event if we don't already have it
* Break import cycle by extracting MFA JSON types to lib/client/mfatypes
* pnpm format
* go mod tidy all
* Remove flakey test that's covered through other paths
* Use a different interval for desktop sessions, make frames smaller than thumbnail
* Set correct flags when resuming mid-upload
* go.sum
* Handle desktop events in session post processor
* Add a semaphore to desktop recording processing
* Populate metadata from end event if start event not present
* Formatting
* Pass session start time to the metadata processor
* Reduce image sizes in tests
* feat: add entra plugin sync interval proto
* SyncIntervals custom JSON marshaller, defaults and test
* review:
- avoid mutating plugin spec and backfill default at service level
- fix test msg typo
- provide example of PluginSyncInterval.MarshalJSON
* refactor: update intervals proto type to be of string
* Add test helper for authenticating user
* Add `CreateDelegationSession` RPC
* Add `tsh delegation create-session` command
* Apply login state before checking resource access
* Set max TTL on delegation sessions
* Make `TestBuildCreateDelegationSessionRequest` table-driven
* Prevent sub-delegation for now
* Pass `allowReuse = false` when performing MFA ceremony
* Fix test error message assertion
* Honor the `DisallowReissue` flag
* Use `ttl` variable instead of calling `GetTtl`
* docs: add reference for workload-cluster
* docs: add workload clusters guide
* fix(docs): add words to ignore
* feat(build.assets): use resource-ref-generator
* fix(docs): clarify replacing account and arn
* docs(zta/wc): add How it works and clarify child cluster
* docs(zta/wc): make feature availability callout a warning
* docs(zta/wc): move IAM callout to paragraph
* docs(zta/wc): indent snippets
* docs(zta/wc): split up Go example
* docs(zta/wc): update example ARN to use assumed-role
* docs(refs/wc): update example to use assumed-role
* fix typo
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* docs(zta/wc): fix snippet indent
* docs(zta/wc): move wc Go to examples dir
* fix(examples/wc): uppercase log messages
* refactor(examples/wc): rename to timeoutCtx
* fix(examples/wc): log os.RemoveAll error
* fix(examples/wc): use fmt.Printf instead for actual output
* refactor(examples/wc): move replaceable values to vars block
* refactor(examples/wc): use ticker instead of timer
* docs(zta/wc): reword example usage
* fix(docs/wc): update example name
* fix(docs/zta/wc): fix cd command
* docs(zta/wc): clarify address
* fix(examples/wc): add license header
* refactor(examples/wc): move wc name to a var
* fix(api/proto/wc): improve godoc for bot.name
* docs(zta/wc): use company-organization as name
* fix(examples/wc): use deffered func to delete wc
* refactor(examples/wc): use consistent import naming
* refactor(examples/wc): avoid panics
* fix(examples/wc): fix log message
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Gabriel Corado