* Introduce Access Graph EventsStreamV2
A new GRPC method EventsStreamV2 is introduced. The new method allows returning responses from the Access Graph.
The new API is required by crown jewel implementation. The new API will be used to emit audit events from the access graph.
* Add new fields to Event protobuf for better tracking
Added two new fields, AffectedResourceName and AffectedResourceSource, to the Event protobuf. These additions allow for a more detailed and efficient tracking of changes and their sources, improving overall monitoring and event handling.
* Add AccessPathChanged event and update service file
A new proto file, events.proto, has been added to define the AccessPathChanged event, detailing changes in access paths. The access_graph_service.proto has been updated to use this new event instead of the legacy one. The relevant changes are also reflected in the generated Go file, access_graph_service.pb.go.
* Missing files
* Add CreateAppSessionFromReq.
* Deprecate passing route_to_app.session_id in cert requests.
* Automatically create app sessions for app cert requests.
* Deprecate client use of CreateAppSession for app cert requests.
* Fix affected tests.
* Use traits and roles from existing user certificate for app sessions.
* Fix app access integration tests.
* go mod tidy.
* Fix TestTCP.
* Fix TestALPNSNIProxyAppAccess.
* Revert "go mod tidy."
This reverts commit cc6caa2485.
* fix: prevent deleting AWS OIDC integration used by EAS
The External Audit Storage feature for Teleport Cloud depends on an AWS
OIDC integration to exist in order to get credentials for the customer
AWS account.
It's currently possible for a customer to delete the AWS OIDC
integration referenced by the EAS configuration, leading to the EAS
integration breaking and the Auth service crashing the next time it's
started up.
This commit prevents deleting an AWS OIDC integration currently
referenced by and EAS integration, and prevents creating an EAS
integration referencing an unknown AWS OIDC integration.
* use PreDeleteCheck instead of calling EAS service
* reorder tests and add missing cleanup
* create integrations svc on the fly
* switch to AtomicWrite
* set revision of returned resources
* deprecate gRPC DeleteAllIntegrations and use more general cacheMode
* Add clientside elements of TPM joining
* Update lib/auth/register.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update api/client/joinservice.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/register.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Tidy up RegisterUsingTPMMethod method
* Add default case
* Rename CheckAndSetDefaults to validate
* Add basic success test for JoinServiceClient_RegisterUsingTPMMethod
* Add final touches to client joinservice test
* Add license header to joinservice_test.go
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Don't watch web sessions with secrets by default; Deny users from watching web session secrets.
* Add backwards compatibility logic for old proxies
Fallback to web session permissions for users watching with secrets
Fix uncaught merge conflict
* CopyWithoutSecrets without proto.Clone to avoid gogoproto issue.
* Revert WebSession.CopyWithoutSecrets rename and instead add special case in fanoutv2.go since WebSessions can not implement ResourceWithSecrets without affecting upstream consumers negatively.
* Address slice iteration comment.
* Add CrownJewel GRPC service and related messages
This commit introduces the CrownJewel service, along with its corresponding request and response messages. The changes include new proto definitions for creating, getting, updating, and deleting CrownJewels. Functions for pagination are also introduced for the GetCrownJewels method. This new service will provide methods to manage critical resources considered 'CrownJewels' for the organization.
* Update TeleportMatcher labels to use TeleportLabel
This update changes the previous map data type of 'labels' in TeleportMatcher to use TeleportLabel, allowing for more flexibility. Also, the TeleportLabel message is created with 'key' and 'values' attributes in the api/proto/teleport directory. This new structure complements the changes made in crownjewel.pb.go.
* Update label and tag value types in crownjewel.proto and crownjewel.pb.go
This commit changes the value types of labels and tags in crownjewel.proto and crownjewel.pb.go. Instead of using google.protobuf.StringValue, the label now uses simple strings for values, and a list of google.protobuf.StringValue for the tag values.
* RFD 153
* Rename CrownJewels proto messages
Updated protobuf message naming for consistency and clarity. The GetCrownJewelsRequest and GetCrownJewelsResponse were renamed to ListCrownJewelsRequest and ListCrownJewelsResponse respectively. This change better reflects their functionality.
* Rename CrownJewels proto messages
Updated protobuf message naming for consistency and clarity. The GetCrownJewelsRequest and GetCrownJewelsResponse were renamed to ListCrownJewelsRequest and ListCrownJewelsResponse respectively. This change better reflects their functionality.
* Update import and label reference in teleport's crownjewel.proto
This commit replaces the TeleportLabel message defined within the crownjewel.proto with an import from label.proto. It refers to labels under the namespace teleport.label.v1, improving modularity and reducing code duplication.
* Uniform equal function names to `IsEqual`
Our API doesn't define any naming or characteristics for object
comparison functions like `IsEqual`. Checks rely on using
`services.CompareResources` that has some coverage but doesn't cover all
resources otherwise it fallsback to expensive `cmp.Equal` comparison.
This PR moves the `IsEqual` interface to `api` so we can ensure objects
satisfy the same interface required by `services.CompareResources`.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle review comments
* keep equal
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Wire context.Context into `auth/register.go`
* Thread `context.Context` through `auth.Register` and add tracing
* Unwrap error before recording it in the span
* DiscoveryService: exclusive worker per Discovery Group
This PR ensures only one DiscoveryService is running per DiscoveryGroup.
It does so using a SemaphoreLock.
This should prevent any duplicate API calls and also prevent duplicate
resources on Teleport side.
* improve eice server name and releaseGroupLockFn init
* review pt2
* improve error handling
* re-organize lock acquire
* improve eice node name handling
* simplify lock on discovery group
* Remove lock logic and rely on node name to prevent dups
* improve test comment
* change comment about skipping nodes
* DiscoveryConfig: Update status after each run
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add unit tests
* drop method by reducing interface area
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Support redirecting to TAG on first login
* Update api/proto/teleport/userpreferences/v1/access_graph.proto
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Add support for highlighting a navigation item
* Add godoc
* Re-run make grpc
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Keep track of whether the user has a real password set
* lint
* Some comments
* Fix TestCreateResources
* Fix e/ link
* Review
* Review
* Review
* Use early return on error in DeletePassword
* Fix the broken teleterm test
The conversion from a proto.PaginatedResource to a types.EnrichedResource
inadvertently omitted setting logins for windows desktops. A new
test, TestGetUnifiedResourcesWithLogins, was added to validate that
if logins are provided by the server that they are passed along in
the enriched resource.
Closes#40340
Updates the proxy.Client to allow loading specific tls.Config for
individual clusters. This prevents issues when trying to access
leaf resources via the root cluster if WithAllCAs is not set.
This PR generates the stubs for `DiscoveryConfig.Equal` function based
on goderive code generation.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Add automatic role requests
This change adds the optioin to automatically make a role access request
during tsh ssh instead of a resource access request.
* Speed up TestSSHAccessRequest
* Introduce role friendly name labels and frontend utilities.
Role friendly name labels and frontend utilities have been introduced.
* Remove unneeded sort function.
* DiscoveryConfig: Add `status` field to report discovered objects and
errors
This PR introduces a `status` field into the `discovery_config` protobuf
spec to report status and metrics about the resources discovered for
each `discovery_config` spec.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add last_sync_time
* fix typo
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Use testServer.MakeTestServer to fix issue with parallel runs using the same ports.
* Add deprecation comments for test server helpers outside of tools/teleport/testenv.
* Update tool/teleport/testenv/test_server.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Disable SSH resumption
Enable LoadAllCAs
Update comments
* Prevent context.Canceled from being wrapped across transport stream
trail doesn't properly handle conversions to and from errors that
are context.Canceled which results in code paths trying to evaluate
errors.Is(err, context.Canceled) failing. The error recevied is
an interceptors.RemoteError, which wraps a trace.TraceErr, which
contains a status.Status with codes.Canceled. To work around this
until trail is updated the server half of the stream was updated
to return an io.EOF if if encouters a canceled error.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tim Ross <tim.ross@goteleport.com>
* Implement persistence for database_object resource
* Split monolithic service test
* Add `t.Parallel()` to the tests
* lint fix
* Update copyright year
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* `make grpc`
---------
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* Add conditional update methods for `AccessList` and `AccessListMembers`
This PR adds two new methods for conditinally update an AccessList and
AccessListMember resources to avoid overriding changed resources.
This is a preparation for a ineligible status reconciler.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Update lib/services/simple/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* handle review comments and drop copy methods
* simplify code
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add protos for PresenceService and RemoteCluster CRUD
* Add service skeleton for presence service
* Add bodies for all methods
* Hook up to new backend methods
* Add presence service to auth grpc server
* Add fallback functions to call old http endpoints
* Fix tests for DeleteAllRemoteClusters
* Remove bad rebase file
* Update proto to remove Create
* Remove unused create grpc handler
* Add Patch support to Update gRPC
* Fix method missing from interface
* Add test for GetRemoteCluster
* Add test for ListRemoteClusters
* Add test for DeleteRemoteCluster
* Add tests for TestUpdateRemoteCluster
* Appease linter
* Fix GetRemoteCluster test
* Update lib/auth/httpfallback.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Update api/client/client.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Update lib/auth/httpfallback.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Fix reference to trace.Component
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
Alan Parra