* Add scope support to OpenSSH certificate generation
simplify scopes open ssh connection
Add DeviceVerified and isBot in the signer
tweak signer to be lazily referenced
revert adding login to client
Pass in targetServer to the OpenSSHCertRequest instead - use CheckAccessToSSHServer to check if scoped role has access
Respond to pr review
Changed signature of DialHost to use a struct before it gets too big
Changed requestedHostLogin to login and targetnodescope to targetserverscope
fix build
Update auth_with_roles.go
Update split_access_checker.go
Update agentless.go
Update auth.go
fix test
Update authservice.pb.go
move cert gen
alias auth proto instead and update the test error expectation
rename goproto go googleproto for better readability - address pr feedback
Update integration_test.go
test
fix build
revert merge conflict for applyTraits
Switch to using pinning package to marshal/unmarshal
* respond to PR review
* updated the need for a agents to upsert node
* revert permissions.go change for upserting node
Update auth_with_roles.go
* set gogo proto options to false for openSSHCertRequest so that we can import teleport.scoped.v1.Pin
Update authservice.pb.go
* Add node ID check in upsertNode
* fix test structure
Update auth_with_roles_test.go
* sessionsearch[17]: Add tctl recordings TUI for browsing session summaries
Introduces a `tctl recordings search` subcommand backed by a Bubble Tea
TUI. The list pane shows sessions fetched via the SessionSearchService
(with pagination and filter flags), and the detail pane renders full
session metadata, resource properties, severity colouring, and summary popup.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle review feedback
* add support for search mode
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Adds the `teleport_retrieval_model` resource and data source to the Teleport
Terraform provider. RetrievalModel is a cluster-wide singleton that configures
the embeddings provider used for session search, so the implementation uses the
singular resource template with a fixed default name rather than the usual
named-resource pattern.
* Add cache collection for beams
* Add protobuf definitions for `BeamService`
* Expose method for building bot user and role
* Add constants for beam labels
* Wire up the delegation sessions service
* Add `IterateBeams` method to `BeamReader` interface
* Add filters message to `ListBeamsRequest`
* Fix `BeamAliasLabel` doc comment
* Clarify that filters are ANDed together
* Fix constant godoc comment
* Add test coverage for `GetBeamByAlias`
* Fix import formatting
* Add `DelegationSessionService` protobuf definition
* Implement `GenerateCerts` RPC
* Prevent restricted delegation sessions from inheriting administrative privileges
Previously, the `resources` list on a delegation session would restrict regular
access to resources that weren't explicitly included, but not administrative
actions.
Now, we explicitly deny all administrative (rule-authorized) actions for
delegation sessions unless you include a wildcard in `resources`.
* Only permit list/read/readnosecrets for allow-listed resource kinds
* Fix reused extension OID
* Add a small amount of tolerance for clock skew
* Make the "expires must be in the future" message clearer
* Fix linter errors
* Access to a windows desktop implies access to the desktop service
* Add `DelegationSessionID` to the decision package's `SSHIdentity` and `TLSIdentity`
* Wrap `ExtractConditionForIdentifier` for delegation sessions too
* Prevent calling `GenerateCerts` inside a delegation session
* No need for indirection with GenerateUserCerts method now
* Fix import ordering
* Stop delegation service from returning CA certificates
Per @strideynet's request, to avoid replicating existing bad patterns around
conflating the user and host CAs.
* Error messages should start with lowercase letters
* Add `RouteToKubernetes` wrapping message
* Replace expires parameter with TTL
* Remove unnesasary error check
* Fix `AgentScope` extension type assertion
This change makes accesslists.GetInheritedGrants properly collect
inherited scoped role grants, in addition to the existing role and trait
grants.
Also exports grant conversion helpers to they can be called from e.
* Add the api/client.Client.SubCAClient() method
* Implement tctl resource support for cert_authority_override
* Remove `false` booleans
* Change "tctl create" message according to action
* Add support for all 3 forms of "tctl get"
* Teleport Connect now speaks TDPB.
* fix incorrect mousewheel encoding on web client
* Refactor tdpb protocol string to constant
* Populate FSO object in shared sirectory info response even when the file/directory does not exist
* Slightly cleaner TDP translation setup
* Refactor excessive function parameters to struct
* Fix unset 'Operation' on shared directory move response
* Fix backwards compatibility with v17 desktop service
* Guard against nil screenspec in ClientHello message
* Add mTLS certificate-based authentication for Access Graph API
Introduces a new certificate feature that grants access to the Access Graph
API without requiring a web session. When certificate usage is `usage:access_graph_api`,
the proxy routes the request directly to the enterprise access graph
handler, bypassing the standard app/session authentication path.
This allow tctl and tsh to use the Access Graph API without needing to create a
web session, which will be used by the upcoming tctl accessgraph command to fetch
and display the Access Graph data in the terminal.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle review feedback
* fix
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Update and upsert scoped tokens will reject any changes to secret, but will allow requests to come in if status is not present, not changing the secrets.
Improve comments
grpc, lint, test fix
Update tf docs
Update tf integration
Fix login test
Address comments
Fix test
Move ValidateBrowserMFAChallenge rpc to MFA service
Fix service test
Address comments
Don't materialise browser authentication
Remove browser auth materialisation in test
Convert validate browser mfa to complete browser mfa
Leverage synctest to exercise client dial timeout tests instead of
the tests sitting idle for the entire timeout. Tests were moved
to api and now test against the api.Client directly instead of
indirectly via the auth.Client to exercise tests against a fake
dialer in the synctest bubble.
* Fix bug causing the expiry service to spin infinite loop
* Use cache in the expiry service
* Add & use ListExpiredAccessRequests (also removes minPageDelay)
* Add test coverage for the service and pending grace time
* Don't log cancelled context
* Linter
* Lint 2
* Add missing license header
* Remove IncludeExpired leftover setting field
* Address review
Chris Thach