* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* split database CA into server/client CAs
* update migration logging
* include auth component in migrations
* debug log when skipping db client ca migration
* update tctl auth sign for cockroachdb
* update tctl auth sign for oracle
* set ExtKeyUsage for DB certs
* clientAuth for DB Client CA
* serverAuth for DB Server CA
* inject filter for pre-v14.3.1 clients
* inject a filter instead of dropping events in grpcserver
* add DatabaseClientCA type
* debug log when skipping filter injection
* update CA filter injection version check func name and doc
In the original releases of desktop access (circa Teleport 8),
Teleport itself authenticated to LDAP with a password. As a result,
Teleport could publish its own certificate authority to the Windows
NTAuth store, which made one less step for the user to do when
setting up Teleport.
Some time later, we removed the password authentication, and Teleport
started using a Teleport-issued certificate to connect to LDAP. A
side effect of this change was that Teleport could no longer
authenticate to LDAP and publish its own CA, because the cert-based
authentication could not succeed until the CA was already trusted.
At this time, it became necessary to write Teleport's CA to the NTAuth
store at installation time.
Ever since then, Teleport has been periodically publishing its CA to
NTAuth, even though it's guaranteed to be there already.
This commit removes the periodic write operation and updates the
docs to use more restrictive permissions on the Teleport service
account. The installation process remains exactly the same.
Today, our AD support largely assumes there is a single active directory
domain. The certificates that we generate are for users in this domain,
the computers we discover via LDAP come from this domain, and the PKI
set up we perform targets this domain.
In more complicated AD configurations, PKI is often configured in a root
domain, while users, servers, and discovery should be done against a
child domain.
The new pki_domain configuration field will allow you to override the
default domain specified in the ldap section with a root domain that is
used for configuring the NTAuth store and publishing the CRL. Teleport
continues to do discovery and issue certificates for the domain
specified in the ldap section of the config.
In several places we were effectively wrapping the same error twice.
This resulted in an error message that was duplicated and hard to read.
Also improve our handling of LDAP timeouts by:
1. Increase the LDAP request timeout to 45s
2. Retrying LDAP connections sooner if we detect a timeout error
(this allows Teleport to recover quicker)
The following error often confuses users:
*ldap.Error LDAP Result Code 1 "Operations Error": 000004DC: LdapErr: DSID-0C090ACD,
comment: In order to perform this operation a successful bind must be completed on the connection.
Since Teleport always uses x509 certs to bind, this error indicates
that the Teleport-issued cert is not trusted (which is likely due to
Teleport's CA not being imported as a trusted root).
While fixing this, unify the LDAP error handling with a common
utility for converting between LDAP error codes and trace errors.
* Change the filters used to query a Windows user's SID
The sAMAccount type is always indexed, so this is a more efficient
query than using the object class attribute.
* Don't attempt DNS resolution for an empty hostname
If we discover LDAP entries with a mising hostname, just skip
over them. This generates less noise in the logs.
* Improve desktop error messaging
Prefer a user-friendly message over "RDP Connection Failed"
where possible.
* Windows auto user creation
* changes in role
* fix roles
* make grpc
* fix imports
* fix test
* fix test
* fix test
* fix test
* fix test
* windows labels
* rename OID, add json tags
* params to struct
* grpc
* Update lib/services/role.go
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
* Update lib/services/access_checker.go
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
* grpc
* bump e
* only add extension when we create user
---------
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
* feat: fix and improve kinit sqlserver
* test(kinit): use a temp dir for writing ccache files
* chore(services): update validation error message
* chore(kinit): improve field description
* refactor(kinit): use CA from certificate generation
* refactor(kinit): remove unused function
* chore(kinit): remove leftover file
The HTTP client created by `auth.NewClient` has an idle timeout of
30s and each instance periodically gets cert authorities in
`TeleportProcess.syncRotationStateCycle`. If there has been no
activity when the ticker expires then the request will result in a
brand new connection to Auth to be established. This can cause a
spikes in open file descriptors on the Proxy when there are a large
number of instances connected via a tunnel.
To prevent periodic dialing when retrieving cert authorities the
endpoint has been migrated to the new Trust gRPC service. For now
only the get endpoint has been migrated but the rest of the CRUD
operations for cert authorities should be migrated from the HTTP
api to the gRPC service as well.
When desktop discovery via LDAP is enabled, there is enough traffic
on the connection for it to remain open for long periods of time.
If discovery is disabled and there are not frequent connections to
desktops, the LDAP server may close the connection.
In this case, future connection attempts will fail when making an
LDAP query for the user's SID. Now we detect closed connections in
this code path and attempt to open a new LDAP connection.
The first connection attempt after the connection is closed will
incur some extra latency, as we obtain a new cert when refreshing
the LDAP connection.
Additionally, increase the heartbeat period for static hosts from
5s to 5m. These hosts are infrequently changing, so heartbeating
every 5 seconds is an inefficient use of resources.
Fixes#20904
Previously we were looking up a user's SID by their ldap "name" attribute,
which is their modifiable display name. This commit has us looking them
up by their SAM Account Name, which is their unmodifiable username.
This commit further refactors existing work to make windows LDAP and Certificate services available to other parts of Teleport. In particular, this PR moves the majority of the LDAP and CA services from windows_server.go into the windows package and into a new structure CertificateAuthority
Alex McGrath