* Add backend handler for Web UI kube exec functionality.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Log error on sending it to websockete connection.
* Remove duplicate user key creation.
* Use scoped context.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Use local site cache.
* Simplify creating rest kube rest config.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Don't set stdErr on pod execution options, if it's interactive shell.
* Don't use public proxy addr when getting kubeconfig server address/name.
* Don't set stdErr on stream options if it's interactive shell.
* Provide local host CA to podHandler directly, instead of access point.
* Add integration test for kube exec handler.
* Use read deadline instead of closing reader.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* Add e imports for MS Graph SDK
* Add ability to sign Entra ID OIDC JWTs, rework KID handling
- Synthesize Key IDs for our JWT keys. For backwards compatibility, also
include the same keys with an empty `kid` in JWKS.
- Sign AWS OIDC tokens with a `kid=""` header claim,
rather than omitting the `kid` claim altogether.
See comment for details.
* Add validation for Entra ID plugin
* Fix typo in assertion function name
* Update the OIDC JWKS test to expect the same key twice
* Add Entra ID plugin type constant
* go mod tidy
* Fix expected JWKS size in integration test
* Add basic tests for KeyID
* Move Azure auth settings from Plugin to Integration
* Address review comments
* Add a unit test to ensure KeyID compatibility
* Add license header to token_generator.go
* Rename validation function per new conventions
* Remove Assist command execution and chat feature
The changes remove tests and related code for command execution in the assist package and web command handling.
* Remove Teleport Assist chat from CHANGELOG.md
The changes in this commit reflect the removal of the Teleport Assist chat from the CHANGELOG documentation of Teleport version 16. The Assist feature continues to be available in the SSH Web Terminal and Audit Monitoring.
* Remove assist chat from the test plan
* Add CreateAppSessionFromReq.
* Deprecate passing route_to_app.session_id in cert requests.
* Automatically create app sessions for app cert requests.
* Deprecate client use of CreateAppSession for app cert requests.
* Fix affected tests.
* Use traits and roles from existing user certificate for app sessions.
* Fix app access integration tests.
* go mod tidy.
* Fix TestTCP.
* Fix TestALPNSNIProxyAppAccess.
* Revert "go mod tidy."
This reverts commit cc6caa2485.
* rebase with master
* only retrieve logs on a specific error
* fix cache test again and a linter issue
* only look for ephemeral container name when waiting for the container to start
* address feedback
* add support for other merge strategies
* handle case
* reorganize gomod
* address feedback
* fix missing patchtype
* propagate errors
* Update lib/kube/proxy/sess.go
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* add hint of exec process into session tracker
* address feedback
* optionally filter listed waiting conts server-side
* add TODO to test against tsh kubectl
* Revert "optionally filter listed waiting conts server-side"
This reverts commit 9a33868363e427f52bba8d95ead2bfc0d939e6e7.
* fix failing integration test, undo accidental dep update
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* fix: return OpaqueAccessDenied for NotFound errors
This commit modifies OpaqueAccessDenied to return an identical generic
NotFound error whether the input error is NotFound or AccessDenied.
The commit also updates all call sites of OpaqueAccessDenied to use it in
the paths where there is any error fetching the resource as well as when
access is denied.
It doesn't do much good to return AccessDenied errors as NotFound, if
they don't match the NotFound error you would get if the resource really
didn't exist.
It's trivial to tell the errors apart and discover the existence of a
resource you shouldn't be allowed to access.
The commit attempts to mitigate that issue and properly hide the
existence of resources the user should not be allowed to list.
* remove changes unrelated to remote clusters
* improve doc comment
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* make sure gRPC errors match
* fix integration test
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Wire context.Context into `auth/register.go`
* Thread `context.Context` through `auth.Register` and add tracing
* Unwrap error before recording it in the span
* Convert recursive listing to use Proxy gRPC API
Removes deprecated usage of ProxyClient in getClusterClients used
for tsh ls -R and tsh db ls -R.
* Remove unsued helper functions
* Replace removed test
* Remove unused db listing function
* convert tsh apps ls -R and tsh kube ls -R
* remove unused function and tweak IsExpired
* create common testcase for listing resources
* Keep track of whether the user has a real password set
* lint
* Some comments
* Fix TestCreateResources
* Fix e/ link
* Review
* Review
* Review
* Use early return on error in DeletePassword
* Fix the broken teleterm test
Updates the proxy.Client to allow loading specific tls.Config for
individual clusters. This prevents issues when trying to access
leaf resources via the root cluster if WithAllCAs is not set.
* Use dbcmd.WithPrintFormat only for preview of teleterm gateway command
* Update comments for GatewayCLICommand message
* Mark check funcs as helpers, verify args length first
* Use `Daemon.ResolveClusterURI` instead of `Storage.ResolveCluster` to set a cluster in the cache
* Fix tests in `daemon_test.go`
* Add regression test
This test fails on master but not on this branch. It's largely based
on existing MFA tests that we have in integration/proxy/teleterm_test.go.
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Cast logged URIs to strings
* Remove unnecessary client.Close()
addToCache is called only if c.clients[clusterURI] returns nil.
Get calls getFromCache and returns early if there's a client in the cache
already.
* Disable client cache in teleterm local proxy integration tests
* AWS OIDC: Accept custom issuers
This PR adds a new field into the AWS OIDC fields:
- issuer
This is the issuer that was configured in AWS.
It is used by teleport to set the `issuer/iss` field when generating the
JWT.
This way we'll be able to set a custom issuer.
As an example, we could set this to be a public S3 bucket which doesn't
suffer from the thumbprint validation issuer.
* ensure issuer is a valid https url
* use s3 uri instead of any url for issuer
* typo and require s3 fields
* add missing s3 location when creating integration
* improve error messages
It was discovered that some customers' EKS clusters did not have their IMDSv2 hop limits
set correctly, causing requests for key functionality to attempt IMDSv1 fallback and failing.
For now, re-enable IMDSv1 fallback by way of removing the explicit disabling of
`EC2MetadataEnableFallback` until better documentation, error handling, and other work
can be done to inform customers that they need to correctly set their IMDSv2 hop limits.
* ensure moderated file transfers only preform allowed operations
* fix sess test
* wip integration test
* integration test working
* tweak some error messages and test cases
* allow setstat for uploads
* address nits from code review
* expand paths when necessary when creating file transfer request
* improve UX of errors in web UI
* deny request when an invalid user tries to transfer files
* don't allow open requests, they aren't done by the webui
* address feedback
* use a buffered reader when reading the file request, address a few nits
* Fix X11 forwarding with OpenSSH option control master when connecting through the Proxy ssh forwarding service.
* Add X11Forwarding integration test with ControlMaster subtest.
* Refactor forwarding server to always forward x11 channel requests.
* Address comments.
* Fix x11 forwarding integration tests.
* Enable automatic upgrade server by default
This commit means the proxy now serves automatic upgrade channels by
default. The default channel is "default" and its version is the
teleport proxy binary version.
This commit also fixes a bug with the automatic update version server
returning `teleport.Version` instead of `"v"+teleport.Version` when the
version was too high. This was not a critical issue because agents are
supposed to tolerate versions not prefixed with 'v'.
* lint
* thread safety
* Update lib/automaticupgrades/channel.go
* Update lib/config/configuration.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* fix tests and lint
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* feat(events): add event indexer based on time
* chore(events): code review changes
* chore: typos
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* chore: code review changes
* test(integration): ignore index field on audit events
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add remote client cache
* Add an integration test
* Close all clients when stopping the service
* Move RemoteClientCache to the place where it is used
* Do not check client cert in `Get`
* Fix code style issues
* Prevent potential race condition when removing a cached client
* Test concurrent calls to `Get`
* Add TODO
* `remoteclientcache` -> `clientcache`
* Reduce the `err` scope
* Move `Config` closer to `New` and docs
* Fix lint
* Improve logging and error handling
* Add missing comments
* `Close` -> `Clear`
* Improve the test
* Remove mentions about "remote" client
* Pass `cfg` directly to `Cache`
* `InvalidateForRootCluster` -> `ClearForRootCluster`
* Add docs for the interface
* `ClearForRootCluster` -> `ClearForRoot`
* Add config validation
* Log multiple fields at once
* Improve setting logger
* Use cached remote clients in Connect (#38202)
* Replace all simple `c.clusterClient.ConnectToProxy()` calls
* Use cached proxy client to create gateways
* Use cached proxy client to assume roles
* Invalidate clients when logging in and out
* Gracefully handle expired cert error returned by the server
* Drop `GetRootClusterURI` in headless auth watcher since URIs are already root URIs
* Simplify error check
* Make `auth.ClientI` parameter naming more consistent, use `root` prefix when needed
* Reduce error scope where possible
* Clear cached clients before passwordless login
* Use `fakeClientCache` without pointers
* Move separate `proxyClient` parameter to `CreateGatewayParams` in the gateways code
* Replace checking error string with `client.ErrClientCredentialsHaveExpired`
Agents performed the following steps when creating an auth client:
1) Create an auth gRPC client
2) Call proto.AuthService/GetDomainName to force gRPC to dial the
auth server in order to validate the connection since gRPC only
dials on the first RPC
3) Call proto.AuthService/GetCertAuthority to get the HostCA
4) Call proto.AuthService/Ping to get the server version to determine
if the connection should be aborted unless --skip-version-check
was provided
On the surface this seems fine, however, the skip version check
did not happen until after two RPCs to auth had already been issued.
If either of those RPCs has changed the agent could perpetually fail
to connect to the cluster even though it should have never tried
due to version differences.
The order of the steps was changed to the following such that the
version check happens first.
1) Create an auth gRPC client
2) Call proto.AuthService/Ping to force gRPC to dial AND to get the
server version information
3) Run the server version check and abort unless --skip-version-check
was provided
4) Call proto.AuthService/GetCertAuthority to get the HostCA
An added benefit to this is agents now require one less RPC when
joining.
This legacy connection mechanism uses SSH to connect to the Proxy
and tunnel the Auth connection. It was replaced by the
(TeleportClient) ConnectToCluster which uses gRPC to reduce latency
when connecting to the cluster.
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
rosstimothy