This PR adds a missing permission to the RoleDiscovery so that it can
create nodes of EICE kind.
These nodes are the only ones created by the DiscoveryService.
Teleport Nodes are created when the teleport process joins the cluster
Agentless Nodes are either created via `tclt` or `teleport join` command
* Implement persistence for database_object resource
* Split monolithic service test
* Add `t.Parallel()` to the tests
* lint fix
* Update copyright year
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* `make grpc`
---------
Co-authored-by: Anton Miniailo <anton@goteleport.com>
* add kubernetes waiting container backend service and API
* remove other resource type
* add unit test
* fix after rebasing
* address feedback
* remove KubeWaitingContainerRequest
* check for nil in validation func
* remove UnwrapResource153
* fix test
* address feedback
* address linter issues
* fix cache watch kind test
* Remove logging from circuit breaker
The logging is never output, and if it was would be very verbose.
Instead of dropping the level down to trace the logger is removed
entirely.
* Add constants from trace library
The logging functionality in trace is being removed in an upcoming
release. To prepare the logging component keys are copied from trace
into teleport.
* Convert trace.ComponentFields to teleport.ComponentFields
* Replace trace.Component with teleport.ComponentKey
* Replace trace logging constants
* Lock AWS Sync into a single discovery service
This PR prevents multiple `discovery_services` running with the same
configuration to race against each other and push new resources to
Access Graph service.
This PR also introduces the notion of features to identify the list of
supported resources by the Access Graph service to which the service is
connected to.
Paired with https://github.com/gravitational/access-graph/pull/591
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle review comments
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* AWSOIDC: Move enrollment of EKS clusters to the gRPC service.
* Fix after rebase.
* Add EKS auto discovery for dynamic integration based fetchers.
* Remove commented code.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove unneeded code.
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Add missing godoc.
* Initiate map with length.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Fix typo in the interface name.
* Introduce iam join method for EKS enrollment.
* Correctly process DiscoveredEKSCluster in kube watcher.
* Remove remaining CreateToken related code from Discovery service.
* Change var initialization.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Remove dev version detection for EKS enrollment.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Revert "Introduce iam join method for EKS enrollment."
This reverts commit 0eb3f4f1226239a5d4e768ebe9129535be318ccb.
* Fix usage of a missing function.
* Refactor cluster features to be a function.
* Change discovery to use gRPC call for EKS enrollment.
* Remove unused mock.
* Correct a comment.
* Remove token creation permission from Discovery service.
* Fix after rebase.
* Improve sorting clusters by region and integration.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Return and error if cluster features are missing.
* Fix tests.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Remove marshal options from GetSessionRecordingConfig
* Add SessionRecordingConfig support to cluster configuration RPC service
Extends the clusterconfigv1.Service to implement RPCs for interacting
with SessionRecordingConfig. The various GetSessionRecordingConfig
interfaces were also all updated to remove the marshal options since
they were never used and served no purpose.
* Remove marshal options from GetClusterNetworkingConfig
* Add ClusterNetworkingConfig support to cluster configuration RPC service
Extends the clusterconfigv1.Service to implement RPCs for interacting
with ClusterNetworkingConfig. The various GetClusterNetworkingConfig
interfaces were also all updated to remove the marshal options since
they were never used and served no purpose.
* Implement persistence for db_object_import_rule resource
* Apply suggestions from code review
Co-authored-by: Bartosz Leper <bartosz.leper@goteleport.com>
* Use plural interface name: DatabaseObjectImportRules. Fix typos. Refactor test.
* token => pageToken
* Simplify resource command
* Fix permission checks
* add details
* refactor, rebase fixes
* better name
* Fix several issues.
- Change type of `db_labels` proto field to the new shared `label` message.
- Implement missing method.
- Cause compilation errors in case of unipmlemented methods.
- Add test coverage for `tctl` commands.
- Change output of Marshal/Unmarshal methods.
* Fix test
* Fix nondeterminism in test
* Add mising docs
* Resolve protobuf breaking changes
* Shorten component name for logging
* Add access test
* Fix test
* Update error message and tests
* Remove temp test `TestCreateUser`
---------
Co-authored-by: Bartosz Leper <bartosz.leper@goteleport.com>
* Only enforce admin MFA when webauthn is required.
* Add TELEPORT_UNSTABLE_DISABLE_MFA_ADMIN_ACTIONS env flag for an emergency escape hatch.
* Fix TestAdminActionMFA unit tests.
* Refactor MFA prompt logic for the API client to enable various MFA
ceremony use cases.
* Address comments.
* Prompt for MFA before creating a user with tctl.
* Check if AdminActionMFA is enforced before attempting to create an MFA auth challenge.
* Refactor how authorizer interfaces with ValidateMFAAuthResponse.
* Pass MFA challenge extensions through create/validate flows and endpoints.
* Address comment.
* Address comments.
* Fix account recovery test by using proper scope.
* Address comments.
* Make user endpoints admin actions.
* Fix user tests.
* Fix update user in the webui.
* Add tctl admin action test suite.
* Minor test suite refactors.
* Resolve comments.
* Use localhost as RPID in test.
In order for the Okta service to be able to lock out deleted users,
it needs the ability to create and manipulate locks. This PR grants
the builtin Okta Role the ability to do so, but also puts limits on
this ability.
1. The Okta service may only create and manipulate locks with an
`okta` origin label,
2. The Okta service may only create and manipulate locks that
target a User with an `okta` origin label, and nothing else,
3. The Okta service may only delete locks with an Okta origin
This PR also
* Implements `ResourceWithLabels` interface on `types.LockV2` in order
to re-use the existing Okta restrictions,
* Refactors the existing Okta restrictions to make them accessable for
Lock CRUD, and
* Adds tests for Lock CRUD
Ensures that the metadata always contains the identity of the user
performing the action and stops falling back to the user that
last created the resource. Also adds a helper function to the
authz.Context to make getting the UserMetadata from the already
retrieved identity easier.
* Discovery: Use Integration credentials for fetchers
* fix typos, improve docs, add clients.closer
* be explicit about using ambient or integration credentials
* remove integration assignment when using ambient credentials
* be explicit about using ambient credentials in db service
* fix cache key for region only sessions
* re-trigger license/cla check
* Add method to check MFA challenge response for admin actions.
* Add tests.
* Move AuthorizeAdminAction to authz package.
Add ValidateMFAAuthResponse as a dependency for the authorizer.
Update tests to include a mock ValidateMFAAuthResponse method.
* Resolve comments.
* Grant the Okta service the right to write Users
In preparation for the Okta service syncing user accounts, this patch grants the Okta
service the right to create/update/delete users, in addition to the existing read
permission.
* Restricts User RBAC operations on the built-in Okta role
* Address review comments
- Consolidates update checking into a single function
- Adds implementation for new user service
* remove unused code
* Refactor Okta access and tests
* Fix merge detritus
* Doc updates
* Hopefully last pass
* Linter appeasement
* Consilidated checks
* Update auth_with_roles_okta_rbac_test.go
docs
Access Request follow their own set of RBAC rules.
Usually, none of the typical create/read/list/delete verbs are required
in any user's roles.
Access is handled via custom rules based on the allow.request, deny.request,
allow.review_requests, and deny.review_requests role fields.
The create/read/list/delete verbs commonly used for other resources are
usually all or nothing (barring `where` expressions), but a more nuanced
set of rules apply to access requests. E.g. users should always be
allowed to see access requests that they created or are allowed to
review, without being allowed to see other access requests in the
cluster.
This seemed mostly logical once you thought about it long enough, but
one detail that has been lacking so far is that explicit deny rules in
the user's roles have no effect at all, even though explicit allow rules
grant god-mode access to create or view any access requests in the
cluster.
Even with the following role, you could still create and view
access requests:
```yaml
kind: role
version: v6
metadata:
name: example
spec:
allow:
request:
roles: ["*"]
review_requests:
roles: ["*"]
deny:
rules:
- resources: ["access_request"]
verbs: ["create", "read", "list"]
```
This commit makes any explicit deny rules actually take effect.
Fixes https://github.com/gravitational/customer-sensitive-requests/issues/103
changelog: Respect explicit deny rules for Access Requests.
In addition to adding server and backend handling for create and
update roles, the services.Access interface was updated to return
a role from the existing Create/UpsertRole methods. Bumps the e
ref to incorporate the associated changes needed there to prevent
breaking the build.
* Update RFD with hardware key pin policies.
* Consolidate policy logic and update tests.
* Add pin private key policies; Make PIV PIN/Touch prompts work together.
* Prompt user to set pin/puk from default.
* Handle unexpected PIN auth errors.
* Resolve RFD password prompt comment.
* Handle incompatible private key policy in role sets (future-proof).
* Resolve comment on require mfa type string godocs and tests.
* A satisfying change.
* Address PIN/PUK prompt comments and other code suggestions.
* Resolve comments.
* Fix test that prompts for pin twice.
* Fix test.
* DiscoveryConfig: init service and add it to `tctl`
This PR starts the DiscoveryConfig service in gRPC server and allows
`tctl` to interact with those records.
It also adds access to the `editor` role.
Users should be able to RW any DiscoveryConfig.
DiscoveryService should be able to watch those resources, so that it can
act upon any changes.
* add revision
* add upsert method
* improve tctl -f command
* Update e ref
* Complete services.Users interface refactoring
Removes temporary functions required to migrate the interface
without breaking e.
Closes#32949.
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
Tiago Silva