* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
* Make user endpoints admin actions.
* Fix user tests.
* Fix update user in the webui.
* Add tctl admin action test suite.
* Minor test suite refactors.
* Resolve comments.
* Use localhost as RPID in test.
In order for the Okta service to be able to lock out deleted users,
it needs the ability to create and manipulate locks. This PR grants
the builtin Okta Role the ability to do so, but also puts limits on
this ability.
1. The Okta service may only create and manipulate locks with an
`okta` origin label,
2. The Okta service may only create and manipulate locks that
target a User with an `okta` origin label, and nothing else,
3. The Okta service may only delete locks with an Okta origin
This PR also
* Implements `ResourceWithLabels` interface on `types.LockV2` in order
to re-use the existing Okta restrictions,
* Refactors the existing Okta restrictions to make them accessable for
Lock CRUD, and
* Adds tests for Lock CRUD
Ensures that the metadata always contains the identity of the user
performing the action and stops falling back to the user that
last created the resource. Also adds a helper function to the
authz.Context to make getting the UserMetadata from the already
retrieved identity easier.
Prior to this change the name of the user being updated was set
in the audit event and not the user performing the updated. This
modifies upsert user to use the same code as create and update to
populate the user metadata.
* Grant the Okta service the right to write Users
In preparation for the Okta service syncing user accounts, this patch grants the Okta
service the right to create/update/delete users, in addition to the existing read
permission.
* Restricts User RBAC operations on the built-in Okta role
* Address review comments
- Consolidates update checking into a single function
- Adds implementation for new user service
* remove unused code
* Refactor Okta access and tests
* Fix merge detritus
* Doc updates
* Hopefully last pass
* Linter appeasement
* Consilidated checks
* Update auth_with_roles_okta_rbac_test.go
docs
The operator is not handling revisions which causes TestUsersUpdate
in users_controller_test.go to fail. Rolling back the user service
backend to use update until the operator is updated to unblock CI.
Converts the auth client to use the new usersv1.Service instead
of the auth.ProtoService to manage users. Since the new service
leverages conditional updates this allows optimistic locking to
now be used. The legacy RPC service now calls into the new users
service to consolidate logic for all but the UpdateUser method,
which was left alone to prevent altering the semantics of update
for legacy clients. Additionally, the auth HTTP routes to get
users were removed since they don't look to be consumed and have
long been deprecated in favor of the gRPC API.
Adds an implementation of the teleport.users.v1.UsersService RPC
service. Logic was copied from lib/auth/auth.go and
lib/auth/auth_with_roles.go but not removed in favor of the new
service yet. Follow up work will consolidate the legacy code to
call into the new users service.
Bartosz Leper