* fix: prevent deleting AWS OIDC integration used by EAS
The External Audit Storage feature for Teleport Cloud depends on an AWS
OIDC integration to exist in order to get credentials for the customer
AWS account.
It's currently possible for a customer to delete the AWS OIDC
integration referenced by the EAS configuration, leading to the EAS
integration breaking and the Auth service crashing the next time it's
started up.
This commit prevents deleting an AWS OIDC integration currently
referenced by and EAS integration, and prevents creating an EAS
integration referencing an unknown AWS OIDC integration.
* use PreDeleteCheck instead of calling EAS service
* reorder tests and add missing cleanup
* create integrations svc on the fly
* switch to AtomicWrite
* set revision of returned resources
* deprecate gRPC DeleteAllIntegrations and use more general cacheMode
In the latest release, we added support for S3 bucket as OIDC Provider
URL.
There are two places were the Token is generated.
One used in Discover Wizard, EICE access and Auto-Discover.
Another one for the External Audit Storage.
The first was updated to include the S3 Bucket as possible Issuer.
EAS flow was not updated.
This PR merges both flows.
* AWS OIDC: Accept custom issuers
This PR adds a new field into the AWS OIDC fields:
- issuer
This is the issuer that was configured in AWS.
It is used by teleport to set the `issuer/iss` field when generating the
JWT.
This way we'll be able to set a custom issuer.
As an example, we could set this to be a public S3 bucket which doesn't
suffer from the thumbprint validation issuer.
* ensure issuer is a valid https url
* use s3 uri instead of any url for issuer
* typo and require s3 fields
* add missing s3 location when creating integration
* improve error messages
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
* AWSOIDC: Move enrollment of EKS clusters to the gRPC service.
* Add missing godoc.
* Remove unneeded code.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Fix after rebase.
* Remove proxyPublicAddr field from grpc request.
* Change test address.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove isCloud and enableAutoUpgrades fields from grpc request.
* Update EKS cluster name field in AWSOIDC integration
* Fix tests.
* Refactor variable initiation.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix after rebase
* Remove unused code.
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
This PR creates a new method on the AWS OIDC gRPC service that deploys
multiple EC2 Instance Connect Endpoints.
This is part of a refactor that moves the API calls behind the Auth
Service.
* AWS OIDC: List EKS Clusters service
This PR creates a new method on the AWS OIDC gRPC service that lists eks
clusters.
This is part of a refactor that moves the API calls behind the Auth
Service.
* doc pb
* AWS OIDC: DeployService service
This PR creates a new method on the AWS OIDC gRPC service that deploys
an ECS Service.
This is part of a refactor that moves the API calls behind the Auth
Service.
* add rbac test and rename teleport config string
* revert e
* AWS OIDC: List EICE service
This PR creates a new method on the AWS OIDC gRPC service that lists ec2
instance connect endpoints.
This is part of a refactor that moves the API calls behind the Auth
Service.
* add required fields and aws api ref
* add test
This PR creates a new method on the AWS OIDC gRPC service that lists ec2
instances as Teleport Nodes.
This is part of a refactor that moves the API calls behind the Auth
Service.
This PR creates a new method on the AWS OIDC gRPC service that lists
SecurityGroups.
This is part of a refactor that moves the API calls behind the Auth
Service.
* AWS OIDC: DeployDatabaseService implementation
This PR creates a new method on the AWS OIDC gRPC service that deploys a
database service.
The deployment logic already existed.
* review pt1
* AWSOIDC: ListDatabases service
This PR implements the ListDatabases service.
The Web API will now use this service instead of calling the
GenerateAWSOIDC Token.
* log and skip instead of failing when convertion fails
This PR adds a new gRPC Service to handle the AWS OIDC Integration
actions.
All the HTTP exposed actions will use this new service.
Eg, list databases, list ec2 instances, and so on
This PR adds the new service and a placeholder for the first action to
me refactored: ListDatabases.
This action is not used/implemented yet.
* AWSOIDC: Compute Proxy's Endpoint for issuing a token
Instead of receiving the issuer URL as param, use the internal state of
the proxies to fetch the public endpoint.
This deprecates the field so that old clients can still talk to the
AuthServer, but their Issuer param is ignored.
* Add single param for cached resources
* use cache for everything except keystore
* Refactor how authorizer interfaces with ValidateMFAAuthResponse.
* Pass MFA challenge extensions through create/validate flows and endpoints.
* Address comment.
* Address comments.
* Fix account recovery test by using proper scope.
* Address comments.
* Discovery: Use Integration credentials for fetchers
* fix typos, improve docs, add clients.closer
* be explicit about using ambient or integration credentials
* remove integration assignment when using ambient credentials
* be explicit about using ambient credentials in db service
* fix cache key for region only sessions
* re-trigger license/cla check
* Add method to check MFA challenge response for admin actions.
* Add tests.
* Move AuthorizeAdminAction to authz package.
Add ValidateMFAAuthResponse as a dependency for the authorizer.
Update tests to include a mock ValidateMFAAuthResponse method.
* Resolve comments.
In addition to adding server and backend handling for create and
update roles, the services.Access interface was updated to return
a role from the existing Create/UpsertRole methods. Bumps the e
ref to incorporate the associated changes needed there to prevent
breaking the build.
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
* AWSOIDC Integration: ListDatabases
This PR adds a new Action for the AWSOIDC Integration: ListDatabases
The goal of this action is to provide the User a list of RDS Databases
from which the User will pick one to be added as a Teleport Database
Resource.
This way, the user doesn't need to copy/paste DB name, endpoints and
labels.
Before being able to call this action, the User has to set up an AWS
OIDC integration.
How does it work:
```
Client (web app)
│ ▲
│ │4. Returns list of DBs
1. List Databases │ │ (name, tags, status, endpoint)
│ │
│ │
│ │
│ │
▼ │ 3. rds.DescribeDBInstances
┌───────────┴────┐ (auth: token) ┌─────────┐
│ ├─────────────────────────────────►│ │
│ Teleport Proxy │ │ AWS │
│ │ 3.1. Get OIDC Config │ │
│ │◄─────────────────────────────────┤ │
│ │ 3.2. Get RSA Public Key │ │
│ │◄─────────────────────────────────┤ ├─────────┐ 3.3.
│ │ │ │ │Validates token signature
│ │ │ │ │with received public key
│ │ 3.4 Returns list of DBs │ │◄────────┘
│ │◄─────────────────────────────────┤ │
└─┬──────────────┘ └─────────┘
│
│ 2. Sign Token
│
▼
┌───────────────────┐
│ │
│ Teleport Auth │
│ RSA Private Key │
└───────────────────┘
```
* add resource and account ids to DB resource
* move api namespaces
* use types.Database instead of custom database format
* add database uri
* fix comments and rate limiter
* test name override when converting RDS V2 DBs
* fix webapi database URI field
* TestClusterDatabasesGet: add parallel
* Integrations service for CRUD operations
This adds the services that will handle the CRUD operations.
It also includes a custom JSON serializer.
* improve integration.unmarshaljson
* add trace.wrap to service
* add CheckAndSetDefaults and godocs
* Integration resource: remove status
Marco Dinis