* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Replace isTeam for new flags in web app
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
* undo removing method by accident
* Add MobileDeviceManagement field to web config struct
* Improve comments
* Fix tests
* Simplify lockedFeatures object
* Include JoinActiveSessions in the web config object
* Remove more instances of isTeam
* Apply suggestions from code review - improve comments
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Use consistent comments to remove isTeam
* Update godocs comments
* Revert removign `isTeam` from stories it still should
* Fix godoc typo
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add support for hardware key serial number attestation through user
trait.
* Modify AttestHardwareKey interface to return full attestation data
* Add serial number to attestation data and verify it
* Add unit test.
* Address comments.
* Don't accept partial matches.
* Fix build and test errors.
* Revert "Restrict IGS flag check to usage based plans only (#35431)"
This reverts commit 31e1715532.
* Update test
* Pass access request monthly limit to webconfig
* Fix typo
* Add product type to features and define feature limit helpers
* Add IGS check with access request monhtly verify
* Move limit getters to enterprise
* Simplify product type conversion
* Add clarifying comment
* Revert "Deprecate field AdvancedAccessWorkflows to AccessRequest.Enabled (#34792)"
This reverts commit 79d1a5d16e.
* Add IGS related fields to features and modules
* Boiler plate for enabling access monitoring through modules
* Add IGS related license fields
* Use access monitoring feature flag instead
* Fix test
* Add backwards comp without deprecating field
* Address CR
* Address CR
* Deprecate AdvancedAccessWorkflows proto field
* Remove AdvancedAccessWorkflows feature module field
* Rename fields
* Rename fields for all plugins
* Test ping proto response
* Address CR
* Proxy TAG requests through Auth
* Integrate Access Graph feature and optimize services
This commit entails the integration of the Access Graph feature into the existing service configuration. This feature is manifested through an 'IsEnabled' method that checks the state of the access graph. Additionally, the auth service logic now includes a flag for enabling access graph. The services have been further optimized with adjustments geared towards improving performance and readability of the code.
* Move TAG enabled flag from proxy to user setting/auth context
* Swap a pointer to AccessGraph config with a value.
* Add 'TestNewAccessGraph' function to 'useracl_test.go' file.
The function 'TestNewAccessGraph' has been added to run tests checking the configuration of Access Graph. Furthermore, a small change is made for the 'KindAccessGraph' comment in 'constants.go' to provide more accurate information.
* Implement Access Graph feature across various files
The Access Graph feature has been incorporated in 'module.go', 'authservice.proto', 'auth.go', and 'plugin.go' files. A method 'EnableAccessGraph' is also introduced in 'module.go' to allow the usage of this feature. Descriptions of Access Graph have been adjusted across files to explicitly state the feature's enablement.
* Fix tests
* Remove unused access graph feature code
This commit removes all references and uses of the access graph feature from the codebase. It also updates corresponding tests to reflect this removal. It also adds EnableAccessGraph() method to testing module to fix test compilation.
* Allow locks to deny access to access lists.
Access list membership will now be impacted by active user locks. If a user
is locked, they will not be considered a part of an access list. This, in turn
will be used for things like Okta assignments to ensure that Okta access can be
rescinded while a lock is active.
* Access list membership checker is its own struct now.
* Rebase and fix tests.
* Update e ref
* Complete services.Users interface refactoring
Removes temporary functions required to migrate the interface
without breaking e.
Closes#32949.
services.UsersService now takes a context and returns the user
from write operations as shown in the diff below. The bulk of the
changes are from modifying code to account for the additional
parameter and/or return value. Functional changes to better make
use of the new API will come in follow up PRs.
```diff
// UserGetter is responsible for getting users
type UserGetter interface {
// GetUser returns a user by name
- GetUser(user string, withSecrets bool) (types.User, error)
+ GetUser(ctx context.Context, user string, withSecrets bool) (types.User, error)
}
// UsersService is responsible for basic user management
type UsersService interface {
UserGetter
// CreateUser creates user, only if the user entry does not exist
- CreateUser(user types.User) error
+ CreateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateUser updates an existing user.
- UpdateUser(ctx context.Context, user types.User) error
+ UpdateUser(ctx context.Context, user types.User) (types.User, error)
// UpdateAndSwapUser reads an existing user, runs `fn` against it and writes
// the result to storage. Return `false` from `fn` to avoid storage changes.
// Roughly equivalent to [GetUser] followed by [CompareAndSwapUser].
// Returns the storage user.
UpdateAndSwapUser(ctx context.Context, user string, withSecrets bool, fn func(types.User) (changed bool, err error)) (types.User, error)
// UpsertUser updates parameters about user
- UpsertUser(user types.User) error
+ UpsertUser(ctx context.Context, user types.User) (types.User, error)
// CompareAndSwapUser updates an existing user, but fails if the user does
// not match an expected backend value.
CompareAndSwapUser(ctx context.Context, new, existing types.User) error
// DeleteUser deletes a user with all the keys from the backend
DeleteUser(ctx context.Context, user string) error
// GetUsers returns a list of users registered with the local auth server
- GetUsers(withSecrets bool) ([]types.User, error)
+ GetUsers(ctx context.Context, withSecrets bool) ([]types.User, error)
// DeleteAllUsers deletes all users
- DeleteAllUsers() error
+ DeleteAllUsers(ctx context.Context) error
}
```
Depends on gravitational/teleport.e#2346
Implements step 3 of #32949
* Start migrating services.Identity to use context and return users
Adds new variants of existing methods that are going to be updated
to support propagating context and return users from create, update
and upsert. This is an unfortunate step required because e utilizes
the interface for various functionality. In order to prevent breaking
builds, the temporary methods were added so that e can be converted
to them first, then oss can be updated to the new version of the
interface. Once that is done e will be converted and then the temp
methods will be removed.
* fix typos in comment
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix: don't set metadata on existing item in CAS
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* fix: gci
* fix: set resource id on update
---------
Co-authored-by: Edoardo Spadolini <edoardo.spadolini@goteleport.com>
* Generate access list suggestions on access request creation
* Add test
Cleanup code
* Add comment
* Fix typo and refactor access suggestion in services library
Fixed a typo in a comment in `access_list.go`. Refactored `accessrequest/suggestion.go` for enhanced code structure. The old model had all methods related to access request in a single interface, `accessRequestAPIGetter`, which had been divided among multiple interfaces for better division of responsibilities. A new function `GetSuggestedAccessLists` was created to narrow down the single duty for each function. These changes ensure more convenient unit testing and better accountability.
* Improve access request suggestions logic
This commit improves the logic for generating access request suggestions. It includes the requester's roles and traits as well as those from the access list and provides suggestions only for resource-based requests. A new method was also introduced for initializing AccessRequestSuggestions to avoid nil error.
* Refactor access list suggestions to promotions
The concept of 'suggestions' was updated to 'promotions' in different files (auth.go, client.go, auth_service_test.go, auth_service.proto among others) to make it more intuitive and align with the business context. This implies changing the wording, the functions called and the variable names. The feature itself hasn't changed, just the way it is referred.
* This commit changes the method name "GenerateAccessListSuggestions" to "GenerateAccessRequestPromotions" in multiple files. The naming is changed to reflect the actual function of the method, which is generating promotions for given access requests, rather than generating list suggestions. All relevant mentions and usages of this method are updated to reflect the name change. Modification also includes adjustments to the comments and interfaces related to the updated function for better code clarity.
* Refactor "GenerateAccessListSuggestions" to "GenerateAccessRequestPromotions"
Renamed method "GenerateAccessListSuggestions" to "GenerateAccessRequestPromotions" across the codebase. This change reflects the actual functionality of the method, which is to generate promotions for access requests, not suggestions. This aligns the method name with its purpose, and offers better code readability. Comments related to this function were also updated to maintain consistency.
* Update method handling access requests promotions
Revised the method of handling failures when generating access requests promotions. Now, even if promotions fail to generate, the request will not fail entirely. Instead, the request can still be approved but without promotions. Also, changed the UpsertAccessRequestAllowedPromotions method to CreateAccessRequestAllowedPromotions to clearly indicate its purpose, while revising related test cases and comments.
* Use Amazon EICE to connect into EC2 instances
This PR adds a new method to SSH into EC2 instances.
It uses the Amazon EC2 Instance Connect Endpoint to do so.
You can read more about the capabilities/limitations of this feature
here
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-using-eice.html
From the Teleport point of view, this uses the AWS OIDC Integration to
call the AWS APIs.
This connection mode is similar to the Agentless mode, where Teleport
connects to the OpenSSH daemon on the target server.
Except, that with this mode there's no required set up on the target
machine (no CAs are being used).
An overview of the flow when the user tries to SSH into a node:
- an SSH Public Key is sent to the target EC2 Instance
- a connection is made to the EC2 Instance Connect Endpoint using
websockets, which in turn pipes the connection to the Private IP of
the EC2 Instance
* review pt1
* pass CA for tests
* add godocs to OpenTunnelEC2
* fetch proxy public address jit
* add docs and move key generation to native package
* remove tcp socket
* Add access request monthly limit to Features
* Add a method to retrieve usage of Access Requests
* Verify access request limit when creating
* Remove AccessRequestsFeature.Enabled
Feature is always enabled now, the flag serves no purpose
* Expose usage of access requests in auth server
* Reimplement access request usage using audit log
* Disallow unauthenticated access to resource usage
* Tidy proto structures
* Start enforcing access request limit in auth
* Run GCI
* Add a license header to usage_test.go
* Add missing godoc
* Restructure usage proto per PR comments
* Construct proto.AccessRequestUsage in getARMU
* Reduce log level when encountering an unexpected event
* Simplify return
* Add godoc to GetResourcesUsage in client
* Fix merge mess-ups
* Count all requests, no matter their review state
* Factor out GetAccessRequestMonthlyUsage
* Move out resource usage to its own service
* Validate the limit after dry run is done
Unbreak UI when the limit is up
* Fix imports
* Remove Limit
SearchEvents will default to defaults.EventsIterationLimit
* Rename the service proto
* Add godocs to the gRPC service
* Move resource usage to a dedicated package
* Define single GetUsage rpc for all resource types
* Additions for limited access requests UI rework
* Add a test for GetAccessRequestMonthlyUsage
* Address lint
* Run GCI
* Add licenses where missing
* Expect CTA_UNSPEICIFED rather than `undefined`
* Expect CTA_UNSPECIFIED instead of undefined
* Add IsUsageBased to features and send to web UI
* Update flag name
* Improve comment
* Add comments and improve field name
* Remove duplicated property
* Use `cloud/stable` when Automatic Upgrades is on.
Teleport provides scripts to install teleport agents/services.
Those scripts use YUM/DEB repositories when possible.
Each repo has multiple channels:
- stable/v11
- stable/v12
- cloud/stable
We want to ensure that if the cluster is running in the cloud and
automatic upgrades is on (auth service was started with
TELEPORT_AUTOMATIC_UPGRADES=yes teleport ...), then the installation
script must offer the `cloud/stable` channel.
This PR changes the following scripts:
- Discover Install Node
- Discover Install Database Service
- Install App script
- EC2 default-installer and EC2 default-agentless-installer
* add helm chart knobs to enable auto updater
* use let instead of const and remove default export
* add HA to helm chart
* always return .automatic_upgrades in web ping response
* rename cloud/stable to stable/cloud
* fix ts test
* Add Plugins feature flag
* Add config for plugins runtime
* Allow reading OAuth secrets from files
* Rename Plugins to HostedPlugins
Make it clear that this is separate from the upcoming
self-hosted, standalone plugins that will be part of the Teleport
binary.
* Only allow to read client credentials from files
* Add Machine ID enterprise license enforcement
This adds two checks to Machine ID for license enforcement: one on
initial bot create, and another on join.
* Use modules.SetTestModules(); fix failing test
Forbids the use of the `--insecure` mode when FIPS mode is enabled in teleport
Disables the `--insecure` tsh command line option when built with FIPS support
See-Also: #5073
Implements RFD #7https://github.com/gravitational/teleport/blob/master/rfd/0007-rbac-oss.md
OSS users can use roles. Some FedRamp related role options
are limited to enterprise.
All users are migrated to a new role "ossuser".
This role is a limited access role downgrading all users
from OSS role "admin".
All trusted clusters are mapped to "ossuser" as well.
Github connector maps teams to generated roles.
For transition period, format `tctl users add alice` works
alongside with `tctl users add alice --roles=admin`, but prints
a warning.
Michael