* Refactor desktop player
Adopt an approach similar to the SSH player (more standard react
calls and less event emitting). This also updates the progress
bar to be more of a "dumb" component that just renders state,
and leaves the smoothing out of progress updates to the client.
In addition, this adds support for seeking by dragging the
progress bar to a particular portion of the video.
Fixes#17199
* Prevents EOF from being reported as a tdp.Notification error at the end of every session
* Removes duplicated code, handles errors in handleRDPFastPathPDU, ensures we always spit out some message if an error notification pops up in the UI
* Add dynamic/ prefix to server info labels (#36219)
This change:
- Adds the dynamic/ prefix to labels from a server_info resource created with tctl
- Forbids labels with the dynamic/ prefix form being used in deny rules for new roles.
Existing roles will generate warnings in tctl as well as a cluster alert.
* Address deprecation TODOs for or before v15. (#36473)
* Convert insecure-drop to drop for unsupported clients (#35803)
This change converts the insecure-drop host user creation mode
to drop for clients that don't support it.
* discovery: remove update if discovery group differs (#36472)
* discovery: remove update if discovery group differs
This PR removes code marked to be removed in Teleport 15 that updated
unconditionally kubernetes and databases that were discovered using a
different discovery group.
Until this PR, if the `onCreate` function returned `trace.AlreadyExists`
error, the resource ended up being updated without any condition. After
this PR, the resource is only updated if the existing resource has an
empty discovery group. This behavior is kept to ensure that users that
migrate from bad configs don't need to delete resources manually.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Update discovery.go
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* handle code review suggestions
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Refactor Kubernetes Exec sessions upgrade logic (#36325)
* Refactor Kubernetes Exec sessions upgrade logic
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle code review suggestions
* Update lib/kube/proxy/forwarder.go
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* Update lib/kube/proxy/forwarder.go
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* handle code review suggestions
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* Deduplicate yarn.lock (#36560)
* Deduplicate yarn.lock
* Fix types in ProgressBar
* docs: updates to tsh connect your client (#36526)
* docs: updates to tsh connect your client
* remove extra dash
* Add backend code for listing EKS clusters through AWS OIDC integration. (#36489)
* Add backend code for listing EKS clusters through AWS OIDC integration.
* Remove leftover commented code.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Add godoc.
* Remove unneeded intialization of a parameter.
* Reduce nesting.
* Rename ExtraLabels to JoinLabels.
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Update devbox. (#36193)
* Update AWS account ID used in `update-ami-ids` GHA workflow (#36556)
PR #36153 updated the AWS account ID used for pulling AMIs, but the GHA
workflow was not updated to use this updated AWS account ID.
Ref #34282.
* Fix accesslist `tctl` (#36531)
* Support unmarshalling accesslists manifests wihtout next_audit_date
* Support `tctl get access_lists`
* Fix accesslist reference
* accountrecovery.go: Unconditionally delete the token after use (#36527)
A previous conditional was allowing a replay attack on the recovery process. Although discovery of this token is a high bar for an attacker, we should be able to unconditionally delete this token after it's used.
* Add app gateways to Connect (#36393)
* Allow creating app gateways in tshd
* Add UI for document gateway app
* Show apps in connections
This is a copy & paste from other connection kinds.
* Capture app protocol
* Start app proxy when clicking on 'Connect' in app
* Remove `removeAppGateway`
* `appUri` -> `targetUri`
* Add TCP and HTTP constants
* Add CLI command for HTTP apps
* Add `makeAppGateway`
* Specify `handleChangePort` dependencies correctly
* Remove `doc.gateway_app` and `connection.app`, instead differentiate gateways by URI
* Correctly report protocol usage
* Mention that AWS apps are supported in tsh
* Rename constants and add godoc
* Add a TODO comment about dialogs for connecting to unsupported apps
* `onRun` -> `onButtonClick`, `runButtonText` -> `buttonText`
* Show a notification after copying to clipboard
* Make the message about unsupported gateways more precise
* Revert mistakenly removed `document.targetUri` from `getResourceUri`
* Remove 'Local app proxy' header
* Post-merge fixes
* Use proper component for the 'offline gateway' state
* Support all gateway types in relogin UI
* Fix JSdoc comment
* Add a TODO comment about the docs link
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Allow configuration of Okta access list importing. (#36569)
Configuration options for enabling/disabling Okta access list importing have
been added. This defaults to false. This has been added to both to Okta plugin
settings and the standalone Okta service.
Co-authored-by: Trent Clarke <trent@goteleport.com>
* Fix example mysql grant all command (#36519)
Fixing example mysql grant all command, because current one fails with `ERROR 1102 (42000): Incorrect database name ' % '` because of extra spaces around `%`
* lib/teleterm app access: Add middleware for handling expired certs (#36520)
* Add middleware for app gateways
* Accommodate for app gateways in integration tests
The previous version of tests depended on receiving helpers.TeleInstance
from higher up. It was then used to generate valid and expired user certs,
as well as to get client.TeleportClient.
proxy.Suite (Kube tests) and dbhelpers.DatabasePack (db tests) expose
helpers.TeleInstance so it wasn't a problem. However, appaccess.Pack,
which we're going to use for app access tests, does not expose it.
To work around that, we introduce two new fields to gatewayCertRenewalParams,
tc (which accepts client.TeleportClient) and generateAndSetupUserCreds.
These two fields get rid of the dependency on helpers.TeleInstance.
* Add integration tests for app gateways
* Switch to the new account settings screen (#36525)
* Migrate `RotateCertAuthority` to gRPC (#36536)
* Add RotateCertAuthority to gRPC TrustService.
* Add gRPC server implementation.
* Move RotateRequest type to api/types.
* Mark deprecated HTTP rotate endpoint for deletion.
* Add client implemenation and HTTP fallback.
* Update go-oidc to get final go-jose v2 -> v3 updates (#36514)
* Update go-oidc to get final go-jose v2 updates
This updates our replaced go-oidc fork to use a tag with go-jose updated to v3: https://github.com/gravitational/go-oidc/pull/19
This update removes the final usage of v2, and fully addresses the GHSA-2c7c-3mj9-8fqh DoS.
* Update gopkg.in/go-jose/go-jose.v2 to 2.6.2 to get p2c DoS fix
* Add ClusterDropdown component (#36310)
This replaces the current ClusterSelector in the TopBar and adds
the functionality to ClusterDropdown component on relevant pages
* fix: Verify MFA device locks during authentication (#36471)
* Test authn and password change with a locked user
* Verify MFA device locks during authentication
* Configure a LockWatcher in the passwordSuite setup
* Appease linter
* Update Toggle component styles (#36535)
* Reintroduces the changes in https://github.com/gravitational/teleport/pull/33273 which were erroneously deleted in https://github.com/gravitational/teleport/pull/33273 (#36538)
* Route to server by public addr (#36584)
This change fixes a bug where tsh ssh could not dial a node with
its public address.
* Add EKS Discover into web testplan. (#36578)
* Remove unused static token endpoints. (#36545)
* Ensure player finishes at 100%
* Fix style for disabled progress bar
* Remove unused file
* fix import order
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
Co-authored-by: Andrew Burke <31974658+atburke@users.noreply.github.com>
Co-authored-by: Brian Joerger <bjoerger@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Anton Miniailo <anton@goteleport.com>
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
Co-authored-by: Steven Martin <steven@goteleport.com>
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
Co-authored-by: Michael Wilson <mike@mdwn.dev>
Co-authored-by: Reed Loden <reed@goteleport.com>
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
Co-authored-by: Mike Jensen <jentfoo@users.noreply.github.com>
Co-authored-by: Grzegorz Zdunek <gzdunek@users.noreply.github.com>
Co-authored-by: Trent Clarke <trent@goteleport.com>
Co-authored-by: Taras <9948629+taraspos@users.noreply.github.com>
Co-authored-by: Bartosz Leper <bartosz.leper@goteleport.com>
Co-authored-by: Michael <michael.myers@goteleport.com>
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* docs: note on direct mode for desktop
* fix desktop service name
* provide more info on direct mode
* verbiage updates
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* verbiage update for direct mode
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
In gravitational/docs#238, we will add a linter that lints for incorrect
usage of Teleport terms. This change fixes linter violations to
anticipate this new linter.
Changes include:
- Ensuring that Teleport service names are capitalized
- No longer using the "[Resource] Access" terminology. Instead, talk
about adding resources, using Teleport services, etc.
* Export desktop recordings to video
Add a new tsh command that will write Windows desktop recordings
to an AVI file for offline playback. Encoding is done client side
to avoid consuming server resources.
This uses the Motion JPEG codec (https://en.wikipedia.org/wiki/Motion_JPEG)
for its simplicity and ease of use. Something like ffmpeg would perform
better in nearly every aspect (run time, compression / file size, video
quality, etc), but that would complicate our build process and add extra
native dependencies. This implementation uses pure Go and works on any
platform where tsh runs today.
Also make sure `tsh recordings ls` shows Windows and SSH recordings.
* Untangle test imports
lib/events/eventstest is allowed to import lib/events
(it needs to in order to implement interfaces and use types)
This means lib/events can not import lib/events/eventstest,
which requires that we move some tests from package events
to package events_test
* tdp: break dependency on lib/srv
The lib/srv package is large and contains Unix-specific code.
Now that tsh needs to understand the TDP protocol, we need to
avoid importing lib/srv so that tsh can still build on Windows.
Make it clear that desktop.directory.* events apply only when the
directory sharing feature is used, and are not emitted for arbitrary
filesystem actions on the Windows desktop.
* Reorganize the config reference
Closes#11253
This change breaks up the config reference by moving each Teleport
service's configuration settings into a separate YAML snippet, and
organizing each YAML snippet into a `TabItem` within a `Tabs` with
`dropdownView` enabled. When Teleport Enterprise Cloud doesn't support a
service, this change adds a `Notice` with a message about Teleport
Enterprise Cloud in the relevant `TabItem`.
I thought this approach would be cleaner than alternatives:
- **Including an H2 for each service:** With this approach, the
configuration reference would be even longer than it is now. With the
approach I'm proposing, readers would navigate to "Reference
configurations", then choose a service from a dropdown menu: much less
scrolling for slightly more clicking.
- **Including another set of `TabItem`s for Teleport editions:** I
thought about adding a `Tabs` with a dropdown option for each Teleport
edition and a horizontal `TabItem` for each service, but this would
require horizontal scrolling and doesn't scale very well.
- **Including horizontal tabs for each Teleport edition**, with an inner
dropdown menu for each Teleport service: There is currently no way to
do this without multiple `Tabs` components, which gets messy quickly.
**Note** that this change does not attempt to copy-edit comments/example
values within the configuration snippets. The scope of this change is
limited only to reorganization.
* Respond to PR feedback
* Update docs/pages/includes/config-reference/instance-wide.yaml
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Respond to PR feedback
Use headings instead of `TabItem`s to split up sections of the config
reference.
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* docs: remove references to old Teleport versions
With the release of Teleport 12, the oldest supported version of
Teleport will be Teleport 10. This commit removes some references
to Teleport 7 and Teleport 8. The docs for those versions are no
longer available on goteleport.com, so it's safe to assume that
readers are on a more recent version.
* Update docs/pages/management/guides/joining-nodes-aws-ec2.mdx
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Edit tctl instructions to clarify remote login
Closes#11464
- Ensure that all example tctl commands are accompanied either by
instructions to log in to the cluster or the tctl.mdx partial.
- Edit the guides in the Architecture section to remove notes that
tctl can only be used locally to the Auth Service.
- Edit the user-client-rereqs partial to mention tctl for all
editions, since you can log in to tctl remotely for all editions.
Not editing guides where:
- tctl is run via kubectl exec
- tctl is not mentioned in a code block, i.e., only in passing, and
a reader isn't expected to run the command on their own while
following the guide.
- The user is already expected to run tctl on the Auth Service. The
docker-compose Getting Started guide is an example of this.
* Respond to PR feedback
- Provide more context on authenticating with tctl in the CLI reference
- Update the link to more information re: tctl in the architecture
overview, and indicate that tctl users must authenticate.
- Minor tweaks.
* Respond to PR feedback
- Rephrase the authentication paragraph in the Architecture Overview.
* Update desktop access docs for 9.0
- Remove admonition about being in preview
- Add audit events listing
- Break reference.mdx up into separate pages
* Update tile icons
* Address review suggestions
* Another review pass
Zac Bergquist