Updates app server heartbeats to use srv.Heartbeatv2 in order to
leverage the inventory control stream instead of the legacy mechanism.
The new srv.heartbeatV2Driver implementation for app servers detects
the version of Auth and falls back appropriately if the Auth server
is too old to know about the new field added to the InventoryHeartbeat
message. The connected_resources metric should be accurate if the
auth and app service are on the same version or if the auth service
is on a more recent version. If the app service is newer than auth
and the new app server driver kicks into fall back mode then the
connected resource metric will not be updated.
Partially addresses #40917
* webclient.Ping: Return err on unsuccessful response
* Log mangled response, add test case
* Point towards possible causes of errors
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
---------
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
Deletes the client fallback logic for users and auth connectors.
The server side cleanup was punted to v17 to prevent any v14 clients
from being unable to interact with a v16 control plane when trying
to interact with users and auth connectors.
The new subcommand is meant to be a replacement for tbot proxy ssh
which does the ssh proxying entirely within tbot to reduce resource
consumption. The old mechanism spawned a tsh process to perform the
proxying which leads to increased CPU and memory consumption - which
can be quite problematic when used as an OpenSSH ProxyCommand for
an ansible playbook.
The new command also deviates in behavior from tsh proxy ssh in that,
for the moment, it requires users to explicitly dictate whether
tls routing, alpn connection upgrades instead of guessing by making a
call to webapi/ping. This again turns out to be quite resource
intensive when tbot is used as an OpenSSH ProxyCommand for an ansible
playbook.
In the future tbot can look this information up out of band and store
it in the proper location so that tbot ssh-proxy-command can consume
it directly without users needing to provide it. The behavior as is
provides a path toward the future while also allowing users to gain
the performance improvements now.
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Update labels datatype in Teleport crownjewel proto
This commit modifies the labels from a map to repeated TeleportLabel in CrownJewel proto, and accordingly updates the getter function in proto generated code. The newly introduced TeleportLabel type contains a Key and repeated values for improved flexibility.
Clean up
Update and restructure CrownJewel service proto
The code modifications include renaming and restructuring several types and altering various functions in the CrownJewel service proto. Major changes involve renaming DeleteCrownJewel
Rename 'kind' to 'kinds' in crownjewel API
This commit changes the 'kind' field to 'kinds' in the crownjewel API to better reflect its purpose of holding multiple resource types. Changes are made across several files - 'crownjewel.go', 'crownjewel.pb.go' and 'crownjewel.proto'.
After rebase fixes
Remove CrownJewel type from several files
This commit represents the removal of the CrownJewel type from several files. CrownJewel type references are deleted in certain Go files, and imports of CrownJewel in multiple files are being adjusted. The specifics of why this type is removed is not evident from the diffs, but the deletions will affect the related functionalities.
Add CrownJewel update functionality
This update enables the 'UpdateCrownJewel' functionality. If a 'CrownJewel' resource already exists, it can now be updated instead of returning an error. This enhances flexibility when dealing with resource management. It also introduces the ARN field into the 'AWSMatcher' service.
Update CrownJewel service with pagination and improve matchers
This update adds pagination to the CrownJewel service for more efficient data handling. It also improves the matching capabilities with the inclusion of Teleport and AWS matchers and allows for selective querying with these matchers. Additionally, it includes various changes to structure and naming for better clarity and ease of use.
Refactor CrownJewel protos to use ResourceHeader
This refactoring replaces the previous structure of CrownJewel proto's fields Kind, Sub_kind, Version, and Metadata with a single object called Header (ResourceHeader). It simplifies the code structure and harmonizes it with other protos. Now, Header contains the essential attributes that were previously distributed across multiple separate fields.
Add GetCrownJewels method to cache and accessgraph
The function GetCrownJewels has been added to the cache and the accessgraph. It retrieves all CrownJewel instances from the cache. Additionally, CrownJewel retrieval functionality has been removed from auth server and existing usages have been refactored.
Implement Crown Jewel creation feature
Updated the method `createCrownJewel` in the resources command to handle Crown Jewel creation. Introduced a new gRPC service `crownjewelv1` to handle client-server interactions for Crown Jewel objects. Crown Jewel expiry configuration has now also been enabled.
Add missing files
I have no words...
Update authentication and event handling
Refactored the argument from 'auth.ClientI' to '*auth.Client' in 'createCrownJewel' function in 'resource_command.go'. Removed unused import 'durationpb' in 'auth_with_roles.go'. Added a new event code 'AccessGraphAccessPathChangedCode' in 'codes.go' and 'AccessGraphAccessPathChanged' in 'api.go' for better monitoring and logging of access path changes.
Add access path changed event and relevant changes.
update api
add grpc
update api
add cache support
add protos
* Fixes after rebase
* Refactor Crown Jewel resource methods
Updated API methods related to the Crown Jewel resource to improve clarity and consistency. Renamed `GetCrownJewels` to `ListCrownJewels`, added pagination parameters, and ensured uniform handling of the Crown Jewel resource across different parts of the codebase. Updated relevant comments for better code understanding.
* Removed CrownJewel converter, updated CrownJewel references
This commit removes the CrownJewel converter and updates references from the old CrownJewel type to the new protobuf-defined CrownJewel type, streamlining the codebase. The commit also disables CrownJewel deletion since it is not supported yet. Some minor errors were fixed regarding CrownJewel resource names.
* Implement Crown Jewel deletion functionality
The crown jewel deletion feature has been enabled by uncommenting and simplifying the code block. Now, the delete action is directly performed on the specific 'crown jewel' mentioned based on its name. The previously unsupported action returns an informative success message after the deletion.
* Refactored function 'allCombinations' and added authorization checks
Moved 'allCombinations' function into 'utils' package, renamed it to 'Combinations', and updated its references in 'dbobjectimportrulev1' and 'dbobjectv1' tests. Additionally, introduced admin authorization checks to 'CreateCrownJewels', 'UpdateCrownJewels', and 'DeleteCrownJewels'. Created corresponding tests for these changes.
* Add CrownJewel service to cache tests
The CrownJewel service has been added to the cache test file. The service creation is implemented and assigned to new fields in multiple methods within the cache tests. A new test function `TestCrownJewel` has also been added to validate CRUD operations for the service.
* Add access path changed event and update Crown Jewel tests
Added a new event code for when an access path changes in the access graph, and introduced new API calls to handle these situations. Also, updated crown jewel related tests and fixed copyright year in several files.
* Update protobuf import path
The protobuf import path was updated from "github.com/golang/protobuf/proto" to "google.golang.org/protobuf/proto" to ensure correct use and to prevent potential issues, while maintaining functionality in crown_jewels.go.
* Refactor CrownJewel and AccessGraph services
This commit optimizes the ListCrownJewelsResponse in the CrownJewel service by directly assigning the response instead of using an extra loop. Additionally, the EventsStream in the AccessGraph service and related tests have been updated to EventsStreamV2, reflecting the implementation of new versions of these methods.
* Add CrownJewel resource in access controls and tests
In both the cache test and access control files, CrownJewel resource has been included. This provides the system's ability to manage and test CrownJewel resources. Additionally, it allows the handling of CrownJewel resources in client events.
* Simplify implementation
* Update copyright dates and add license headers
Updated the copyright dates in several files to reflect the new year. Additionally, license headers have been added to some files where they were previously missing, ensuring the proper copyrights and GPL notice are visible.
* Refactor CrownJewel codebase for better readability
Fixed various typographical errors in CrownJewel's related functions and removed a TODO comment. Improved function and function calls' names that were incorrectly referring to different modules, making the code easier to read and understand across different CrownJewel services.
* Add validation for Teleport and AWS matchers in service
The validation has been added for Teleport and AWS matchers in the service layer to ensure that essential details are not missed when setting matchers. This includes checks to ensure that kinds and labels for Teleport, and types and tags for AWS matchers are properly set.
* gci
* Add CrownJewel update functionality and refactor related services
This commit adds the ability to update a CrownJewel resource within the ResourceCommand. It also includes refactoring of related services, condensed code logic, and improved utilization of existing methods for marshaling/unmarshaling CrownJewel. Specific changes in service.go and crown_jewels.go files have reduced code redundancy and enhanced the code structure.
* Relocate and update crown_jewels_test file
This commit moves the crown_jewels_test from the local to the services library and adds test cases for unmarshalling Crown Jewels data. Also, import statements for labelv1 and utils were introduced to support these changes.
* Update crown jewels test with AWS matchers
Revised the crown jewels test file by including AWS matchers section in the CrownJewel object. The change ensures to specifically match AWS infrastructure following certain parameters, thus enhancing the specificity and flexibility of our matchers. Apart from this, minor reordering of objects has also been done for better code organization.
* Added upsertCrownJewel function and related proto message
The commit adds the UpsertCrownJewel function in the service.go file, which enables upsert operations on crown jewel resources. Alongside, the UpsertCrownJewelRequest proto message is added to the crownjewel_service.pb.go file to handle such requests.
* Refactor CrownJewelsClient to use upsert
This change refactors the CrownJewelsClient to use the upsert method when the force flag is on. The code has been streamlined by eliminating the need for 'already exist' error checking and separate create and update methods.
* Add GetCrownJewel functionality and refactor validation
A GetCrownJewel function has been added to the Service, which retrieves a specific CrownJewel resource. Also, the CrownJewel validation process has been refactored, moving the validateCrownJewel function from service.go into the crownjewel library and renaming it to ValidateCrownJewel. These changes improve modularity and code organization.
* Add VerbCreate check and test for CrownJewel validation
The checkAccessToKind function now also checks for the VerbCreate permission. Additionally, a new test file, object_test.go, was added to validate the functionality of the CrownJewel object. This includes various validation checks such as "NilCrownJewel", "ValidCrownJewel", "MissingMatchers", among others.
* Refactor CrownJewel resource handling and validation
The codebase was updated to improve CrownJewel resources handling. This includes modifications to list, get, create, update, upsert, and delete functions in several files. Additionally, a validation function has been implemented for CrownJewel objects, ensuring required fields are present. Depreciated logger service has also been removed.
* Add cache implementation to CrownJewel service
The CrownJewel service has been enhanced by integrating it with cache. The main changes include adding "Cache" as part of ServiceConfig and using cache to fetch crown jewels instead of directly using the backend services. The cache interface with the methods "ListCrownJewels" and "GetCrownJewel" has been added to handle these operations.
* Add Cache to service configuration in crownjewelv1 tests
In this commit, we added the Cache field to the service configuration used in the tests for the crownjewelv1 service. This ensures that the service configuration used in the tests matches the expected real-world configuration.
* Update CrownJewelsService to use ConditionalUpdateResource
This commit changes the CrownJewelsService's `UpdateCrownJewel` method to use the `ConditionalUpdateResource` method instead of the `UpdateResource` method. This change will provide a more appropriate update strategy for the specific needs of the CrownJewelsService.
* Replace 'Cache' with 'Reader' in crownjewel service & remove DeleteAllCrownJewelsRequest
The 'Cache' in crownjewel service has been replaced with 'Reader' to improve code readability and to match with its functionality. Also, the DeleteAllCrownJewelsRequest functionality was removed as it posed a high risk potential for data loss and it wasn
* Update tests for Crown Jewel service
This commit updates the test suite of the Crown Jewel service. An object is fetched from the backend before updating its expiry time, ensuring the revision is populated. In addition, a new test is introduced to handle the scenario where the revision is missing when updating a Crown Jewel.
* Refactor protobuf marshaling with utils
This commit replaces the usage of the `protojson` method for marshaling and unmarshaling protobuf objects in `crown_jewel.go` with the `FastMarshal` and `FastUnmarshal` methods from `utils`.
protojson is failing to unmarshal resources.
* Update CrownJewel test and serialization methods
Updated the test condition in crown_jewels_test.go to use Proto.Equal for object comparisons. Also, swapped out the FastMarshal and FastUnmarshal methods with protojson's Marshal and Unmarshal in the CrownJewels service.
* Add missing license
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Test that an SSO user cannot use local logins
* Lock down local logins
* Lock down CreateResetPasswordToken
* Lock down account recovery
* Tweak a few existing tests
* Document new RPC limitations
* Update generated protos
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Replace isTeam for new flags in web app
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
* undo removing method by accident
* Add MobileDeviceManagement field to web config struct
* Improve comments
* Fix tests
* Simplify lockedFeatures object
* Include JoinActiveSessions in the web config object
* Remove more instances of isTeam
* Apply suggestions from code review - improve comments
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Use consistent comments to remove isTeam
* Update godocs comments
* Revert removign `isTeam` from stories it still should
* Fix godoc typo
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Add CreateAppSessionFromReq.
* Deprecate passing route_to_app.session_id in cert requests.
* Automatically create app sessions for app cert requests.
* Deprecate client use of CreateAppSession for app cert requests.
* Fix affected tests.
* Use traits and roles from existing user certificate for app sessions.
* Fix app access integration tests.
* go mod tidy.
* Fix TestTCP.
* Fix TestALPNSNIProxyAppAccess.
* Revert "go mod tidy."
This reverts commit cc6caa2485.
* Add clientside elements of TPM joining
* Update lib/auth/register.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update api/client/joinservice.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Update lib/auth/register.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Tidy up RegisterUsingTPMMethod method
* Add default case
* Rename CheckAndSetDefaults to validate
* Add basic success test for JoinServiceClient_RegisterUsingTPMMethod
* Add final touches to client joinservice test
* Add license header to joinservice_test.go
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add CrownJewel GRPC service and related messages
This commit introduces the CrownJewel service, along with its corresponding request and response messages. The changes include new proto definitions for creating, getting, updating, and deleting CrownJewels. Functions for pagination are also introduced for the GetCrownJewels method. This new service will provide methods to manage critical resources considered 'CrownJewels' for the organization.
* Update TeleportMatcher labels to use TeleportLabel
This update changes the previous map data type of 'labels' in TeleportMatcher to use TeleportLabel, allowing for more flexibility. Also, the TeleportLabel message is created with 'key' and 'values' attributes in the api/proto/teleport directory. This new structure complements the changes made in crownjewel.pb.go.
* Update label and tag value types in crownjewel.proto and crownjewel.pb.go
This commit changes the value types of labels and tags in crownjewel.proto and crownjewel.pb.go. Instead of using google.protobuf.StringValue, the label now uses simple strings for values, and a list of google.protobuf.StringValue for the tag values.
* RFD 153
* Rename CrownJewels proto messages
Updated protobuf message naming for consistency and clarity. The GetCrownJewelsRequest and GetCrownJewelsResponse were renamed to ListCrownJewelsRequest and ListCrownJewelsResponse respectively. This change better reflects their functionality.
* Rename CrownJewels proto messages
Updated protobuf message naming for consistency and clarity. The GetCrownJewelsRequest and GetCrownJewelsResponse were renamed to ListCrownJewelsRequest and ListCrownJewelsResponse respectively. This change better reflects their functionality.
* Update import and label reference in teleport's crownjewel.proto
This commit replaces the TeleportLabel message defined within the crownjewel.proto with an import from label.proto. It refers to labels under the namespace teleport.label.v1, improving modularity and reducing code duplication.
* DiscoveryConfig: Update status after each run
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* add unit tests
* drop method by reducing interface area
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
The conversion from a proto.PaginatedResource to a types.EnrichedResource
inadvertently omitted setting logins for windows desktops. A new
test, TestGetUnifiedResourcesWithLogins, was added to validate that
if logins are provided by the server that they are passed along in
the enriched resource.
Closes#40340
Updates the proxy.Client to allow loading specific tls.Config for
individual clusters. This prevents issues when trying to access
leaf resources via the root cluster if WithAllCAs is not set.
* Implement persistence for database_object resource
* Split monolithic service test
* Add `t.Parallel()` to the tests
* lint fix
* Update copyright year
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* `make grpc`
---------
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* Add conditional update methods for `AccessList` and `AccessListMembers`
This PR adds two new methods for conditinally update an AccessList and
AccessListMember resources to avoid overriding changed resources.
This is a preparation for a ineligible status reconciler.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Update lib/services/simple/access_list.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* handle review comments and drop copy methods
* simplify code
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Add protos for PresenceService and RemoteCluster CRUD
* Add service skeleton for presence service
* Add bodies for all methods
* Hook up to new backend methods
* Add presence service to auth grpc server
* Add fallback functions to call old http endpoints
* Fix tests for DeleteAllRemoteClusters
* Remove bad rebase file
* Update proto to remove Create
* Remove unused create grpc handler
* Add Patch support to Update gRPC
* Fix method missing from interface
* Add test for GetRemoteCluster
* Add test for ListRemoteClusters
* Add test for DeleteRemoteCluster
* Add tests for TestUpdateRemoteCluster
* Appease linter
* Fix GetRemoteCluster test
* Update lib/auth/httpfallback.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Update api/client/client.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Update lib/auth/httpfallback.go
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Fix reference to trace.Component
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
The Proxy web api now requests that Auth include allowed logins
per resource instead of guessing logins per resource based on the
information it has cached. However, due to the way SSH sessions
are authorized, the logins are not provide to users verbatim.
Any sessions created via the root web ui to a leaf resource will use
the SSH certificate created for that user in the root cluster. New
certificates are not minted per leaf cluster. This is important
because the nodes only allow os logins for a session if they are
present in the valid prinicpals of the SSH certificate. So even
though we are now capabale of displaying all allowed logins for
leaf SSH servers in the root web ui, the user is only able to use
a subset of them. To avoid any odd UX, the Proxy will filter out
any allowed logins which do not exist in the principals of the
root SSH certificate.
The above only holds for SSH, windows desktops are not as strict
and any allowed login from a leaf cluster is now visible in the
root web ui.
Fixes https://github.com/gravitational/teleport/issues/5041
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* add kubernetes waiting container backend service and API
* remove other resource type
* add unit test
* fix after rebasing
* address feedback
* remove KubeWaitingContainerRequest
* check for nil in validation func
* remove UnwrapResource153
* fix test
* address feedback
* address linter issues
* fix cache watch kind test
This PR adds the protobuf boilerplate code required to expose the
Access Graph config to all agents that require access to it.
The goal is to reduce the ammount of configuration changes required to
expose the Access Graph service connection parameters to all agents that
require it.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* AWS OIDC: Accept custom issuers
This PR adds a new field into the AWS OIDC fields:
- issuer
This is the issuer that was configured in AWS.
It is used by teleport to set the `issuer/iss` field when generating the
JWT.
This way we'll be able to set a custom issuer.
As an example, we could set this to be a public S3 bucket which doesn't
suffer from the thumbprint validation issuer.
* ensure issuer is a valid https url
* use s3 uri instead of any url for issuer
* typo and require s3 fields
* add missing s3 location when creating integration
* improve error messages
* Changes supporting SCIM groups in Enterprise
- Adds `services.IsEqual` implementatio to AccessListMember for
easier reconciliation
- Adds `Delete` support into internal SCIM interfaces
Changelog: None
* linter appeasement
Yassine Bounekhla