* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* Add CreateAppSessionFromReq.
* Deprecate passing route_to_app.session_id in cert requests.
* Automatically create app sessions for app cert requests.
* Deprecate client use of CreateAppSession for app cert requests.
* Fix affected tests.
* Use traits and roles from existing user certificate for app sessions.
* Fix app access integration tests.
* go mod tidy.
* Fix TestTCP.
* Fix TestALPNSNIProxyAppAccess.
* Revert "go mod tidy."
This reverts commit cc6caa2485.
* Wire context.Context into `auth/register.go`
* Thread `context.Context` through `auth.Register` and add tracing
* Unwrap error before recording it in the span
* Keep track of whether the user has a real password set
* lint
* Some comments
* Fix TestCreateResources
* Fix e/ link
* Review
* Review
* Review
* Use early return on error in DeletePassword
* Fix the broken teleterm test
* Use dbcmd.WithPrintFormat only for preview of teleterm gateway command
* Update comments for GatewayCLICommand message
* Mark check funcs as helpers, verify args length first
* Use `Daemon.ResolveClusterURI` instead of `Storage.ResolveCluster` to set a cluster in the cache
* Fix tests in `daemon_test.go`
* Add regression test
This test fails on master but not on this branch. It's largely based
on existing MFA tests that we have in integration/proxy/teleterm_test.go.
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Cast logged URIs to strings
* Remove unnecessary client.Close()
addToCache is called only if c.clients[clusterURI] returns nil.
Get calls getFromCache and returns early if there's a client in the cache
already.
* Disable client cache in teleterm local proxy integration tests
* Enable automatic upgrade server by default
This commit means the proxy now serves automatic upgrade channels by
default. The default channel is "default" and its version is the
teleport proxy binary version.
This commit also fixes a bug with the automatic update version server
returning `teleport.Version` instead of `"v"+teleport.Version` when the
version was too high. This was not a critical issue because agents are
supposed to tolerate versions not prefixed with 'v'.
* lint
* thread safety
* Update lib/automaticupgrades/channel.go
* Update lib/config/configuration.go
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* fix tests and lint
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
This legacy connection mechanism uses SSH to connect to the Proxy
and tunnel the Auth connection. It was replaced by the
(TeleportClient) ConnectToCluster which uses gRPC to reduce latency
when connecting to the cluster.
Adds the new linter and configures it to prevent direct error
comparisions and type assertions in favor of errors.Is and errors.As.
All current violations caught by the linter have been updated
accordingly.
* Add middleware for app gateways
* Accommodate for app gateways in integration tests
The previous version of tests depended on receiving helpers.TeleInstance
from higher up. It was then used to generate valid and expired user certs,
as well as to get client.TeleportClient.
proxy.Suite (Kube tests) and dbhelpers.DatabasePack (db tests) expose
helpers.TeleInstance so it wasn't a problem. However, appaccess.Pack,
which we're going to use for app access tests, does not expose it.
To work around that, we introduce two new fields to gatewayCertRenewalParams,
tc (which accepts client.TeleportClient) and generateAndSetupUserCreds.
These two fields get rid of the dependency on helpers.TeleInstance.
* Add integration tests for app gateways
* Improve error handling in gateway/kube_test.go
* Make gatewaytest.mustGenCertSignedWithCA public
It will be needed to generate and then return cert without saving it to
a file.
* Move AddMetadataToRetryableError to where it's actually needed
Cluster.reissueDBCerts is called in two scenarios:
* During the request to create a db gateway: this request is made by
the Electron app, so we need to add metadata to let the app know that
this error can be resolved by relogin.
* When someone attempts to use the proxy but the user cert has expired:
this happens outside of the Electron app request-response cycle and
thus adding metadata is unnecessary.
* Make gatewaytest.MustGenCACert public, accept CA for MustGenAndSaveCert
This will make writing tests where we need to supply either Cert or KeyPath
and CertPath a little bit easier.
* Kube gateways: Store cert in memory instead of on disk
* Add ctx to testGatewayCertRenewal
If a gateway requires MFA, daemon.Service.CreateGateway can potentially
block forever. To work around this, we want the tests to pass a context
around so that we can set a timeout on the context in MFA tests.
* Convert test function args into structs
This will make it easier to pass webauthnLogin for tests that need MFA.
* Refactor handling of mock tshd events service addr
* Add tests for MFA
* Do not save kube key in local agent
Connect issues a new cert for every gateway anyway.
* Check kube certs after issue in teleterm gateways
This makes sure that Connect does the same checks as tsh.
* reissueDBCerts → reissueGatewayCerts
* Pass mfaPrompt from daemon to GatewayCreator
This also fixes a problem where the mfaPrompt passed from GatewayCreator
was not the expected one. daemon.Service.ResolveClusterURI attaches
MFAPromptConstructor on clusterClient. However, GatewayCreator does not
call daemon.Service.ResolveClusterURI, it calls
clusters.Storage.ResolveCluster which does not attach the proper prompt
constructor.
* Refactor GetPromptReasonSessionMFA into WithPromptReasonSessionMFA
* Verify that PromptMFA on tshdEventsService gets called during MFA ceremony
* reissueKubeCert: Get rid of unused mfaRequired var
* Use fake storage in gateway CRUD tests
Now that daemon.Service.CreateGateway needs a TeleportClient, we have
to use a fake storage that's able to provide it.
* Fix synchronization between webauthnLogin and PromptMFA
* Use sync/atomic for function call counts
* Use default upgrade channel
This commit:
- initializes default upgrade channels based on the server features
- makes all integrations use the upgrade channels instead of hitting
hardcoded s3 bucket
- makes the version channel return its own version if the target
version is too high
- makes the NoVersion handler properly: returned as an error. This way
soneone relying on the version getter doesn't have to check
- moves the version kube-agent-updater lib in main teleport libs
- add tests for noVersion channels
* Update lib/web/join_tokens.go
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* address marco's feedback
* address marco's feedback pt.2
---------
Co-authored-by: Bernard Kim <bernard@goteleport.com>
* Reorganize process config test fields
* Move PollingPeriod back from Testing field
* Fix comment text
Co-authored-by: Nic Klaassen <nic@goteleport.com>
---------
Co-authored-by: Nic Klaassen <nic@goteleport.com>
In addition to adding server and backend handling for create and
update roles, the services.Access interface was updated to return
a role from the existing Create/UpsertRole methods. Bumps the e
ref to incorporate the associated changes needed there to prevent
breaking the build.
* Add daemon.Service.ResolveClusterURI
* Accept agents dir through command line flag
tshd needs to know this out of band, so that when the Electron app tells
it to watch for host UUID file for a specific cluster, the Electron app
can send just the profile name of the cluster instead of an arbitrary path
on the computer.
* Implement WaitForConnectMyComputerNodeJoin in tsh daemon
* wait: Use addEventListener instead of onabort
* Make TshAbortController emit abort event only once
This aligns it with a regular AbortController, which also emits the event
only once.
* Refactor how types are imported in tshd fixtures
* Implement WaitForConnectMyComputerNodeJoin in Electron app
* createAbortController: Add signal.aborted, use emitter.once
* Improve wait function based on Deno implementation
https://github.com/denoland/deno_std/blob/72d6e6641e3cd39ae69fba89a78feab354018ef0/async/delay.ts#L39
* Add a comment about the events package
This PR removes from the Teleport codebase the following deprecated
code:
- Kubernetes Secret storage compatibility layer: This piece of code was
introduced in Teleport 11 to help users migrating from on-disk
credentials storage to Kubernetes secret storage. Since then, all
users should already migrated to Kube secret storage and it's no
longer needed.
- Expected `no kubernetes_users/kubernetes_groups` error message:
The error message changed in Teleport 13 and was left for compatiblity
reasons since Auth server supported `kubernetes_services` running
`v12.x.x`.
- References to `kube.` SNI prefix for Kube access
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
This PR implements a feature where it's possible to restrict access to
namespace scoped `CustomResources`.
To be able to deserialize unknown Kubernetes objects, we keep a
`serializer.CodecFactory` per cluster where we register not only the default
types - such as `Pods`, `Statefulsets`... -, but also all the
`CustomResourceDefinitions` that are namespaced.
With the list of RBAC supported resources and the serializer, Kube
access identifies if we support Kubernetes per-Resource RBAC for that
type - the match happens based on resource `kind` and `apiGroup` -
and enforces the RBAC rules.
Namespace controls access to `CustomResources`. When a user as an allow
rule for a namespace - similar to the rule bellow -, he has access to
all resources within that namespace including the custom resources.
```yaml
kubernetes_resources:
- kind: namespace
name: "someNamespace"
verbs: ['*']
```
The list of `CustomResources` is constantly updated and monitored in
intervals of `5m`. If a new CRD is created between two iteration cycles,
Teleport will only enforce RBAC after the resource and codecs are
updated.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Ignore specific teleterm proto file rather than whole package
* clusters.Storage: Avoid unnecessary casting of URI back to string
* Storage.fromProfile: Move loading profile status to separate function
* Return client.TeleportClient together with clusters.Cluster
This is a stopgap to make clusters.Cluster a regular struct with no extra
behavior and a much smaller interface.
At the moment, almost all RPCs go through layers like these:
gRPC handler → daemon.Service → clusters.Storage → clusters.Cluster →
→ TeleportClient
As a result, clusters.Cluster has a gigantic interface that's hard to test.
Instead, we want to make it hold basic information about the cluster.
The real work will be done by collaborator structs which take clusters.Cluster
and TeleportClient as args. This way we can mock them out more easily in tests.
See the issue linked in the comment of clusters.Storage.GetByResourceURI
for more details.
* Make AddMetadataToRetryableError public
Since we're moving away from doing everything in clusters.Cluster, we'll
need to use this function from within the daemon package.
* Add IsRoot and IsLeaf methods to uri.ResourceURI
These methods will be used to return early if someone tries to set up
roles for a leaf cluster. Connect My Computer works with root clusters only.
* Add handler for creating Connect My Computer role
* Add test for calling GenerateUserCerts with bogus request ID
* Fix checking logins of existing role
* Remove commented out argument to ReissueUserCerts
* Add a stopgap comment to Storage.GetByURI
* Remove invalid doc links
* Ensure owner node label has expected value if role already exists
* Add unit test which checks RoleSetup.Run idempotency
* Add godoc for Resolver
* Simplify watcher equality check, add a comment
* Expand the comment for DropAccessRequests
* Fix position of Connect My Computer popover
* Integrate role setup with setup document
* Add temporary action to additional actions
This will be removed once the parent PR is approved. I just wanted to give
reviewers a shortcut to triggering the endpoint from the actual app.
* Add return type to createRole
* Add useRetryWithRelogin
* Wrap role setup in retryWithRelogin
* Remove useRetryWithRelogin in favor of retryWithRelogin & useCallback
* Remove CMC role setup from AdditionalActions
* Prettier fix
* Fix eslint
* Connect Kube gateway part 2: command provider
* gateway.Database and gateway.Kube interface
* remove cmd.ProviderManager and fix integration test
* revert cluster.RootClusterName change for now as profile may not have key
* Extend Teleport RBAC to suport Kubernetes Verbs
This PR extends Teleport per-Resource RBAC to support Kubernetes verbs
restriction. With this change it's possible to restrict certain actions
allowed by the underlying `kubernetes_users` and `kubernetes_resources`.
Supported verbs:
- `get`
- `create`
- `update`
- `patch`
- `delete`
- `list`
- `watch`
- `deletecollection`
Fixes#27095
* address timr's comments
* assign wildcard to verbs for role <7
* address marco's reviews
#24864 added a dependency of lib/web into tsh which broke windows
tsh builds because lib/web transiently depends on lib/srv which
has linux specific code. This shuffles around a few things so
that lib/web is no longer importing lib/srv at all by:
- Indirectly using the srv.SessionController to apply session
control for web ssh sessions
- Moving the common reversetunnel interfaces into
reversetunnelclient since lib/reversetunnel imports
lib/srv/forward which imports lib/srv.
- Directly converting mysql client errors in the connection
tester instead of calling a common function.
* stop the node before resetting http proxy auth credentials,
then start the node again which succeeds immediately,
so that the test doesn't time out after 10 seconds waiting
for the node to join due to random backoff/jitter.
rosstimothy