* AWS OIDC App Access: add PublicAddr to App
This PR adds a missing field to the App created to handle the AWS App
Access when using the AWS OIDC credentials
The PublicAddr is required and was not being set.
* fix identation
This starts separating the lib/auth client and server code into
distinct packages to reduce the dependency tree of client tools.
For the time being aliases were left to all things moved into
lib/auth/authclient to reduce the changeset and ensure code still
compiles. Future changes will be built off this to convert code
to use lib/auth/authclient where applicable, this was intentionally
left to a minimum amount of changes to facilitate backports.
The session closing in TerminalHandler.Close did not always close
established ssh sessions if the client closed the web socket
at any point between the new browser tab being opened and the session
being established. In these cases the SSH connection was leaked for
the duration of the Proxy process. To ensure sessions are always
terminated a check to see if the client closed the web socket was
added prior to writing the session metadata and after the shell
is established for the ssh session.
* Add backend handler for Web UI kube exec functionality.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Log error on sending it to websockete connection.
* Remove duplicate user key creation.
* Use scoped context.
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Use local site cache.
* Simplify creating rest kube rest config.
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Don't set stdErr on pod execution options, if it's interactive shell.
* Don't use public proxy addr when getting kubeconfig server address/name.
* Don't set stdErr on stream options if it's interactive shell.
* Provide local host CA to podHandler directly, instead of access point.
* Add integration test for kube exec handler.
* Use read deadline instead of closing reader.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* AWS OIDC: Script to configure EC2 Auto Discover with SSM
There's a new teleport command that adds an inline policy which enables
the AWS OIDC Integration to handle EC2 Auto Discover using the script
mode (SSM).
It also adds the SSM Document used in the teleport installation.
There's also a new endpoint which returns the one off script that uses
that command.
* Update lib/integrations/awsoidc/ec2_ssm_iam_config.go
Co-authored-by: Edward Dowling <EdwardDowling@users.noreply.github.com>
---------
Co-authored-by: Edward Dowling <EdwardDowling@users.noreply.github.com>
* Validate application URL extracted from /web/launch/<app-url>
Prevents overwriting or setting new CSP directives.
Validating prevents this because a valid CSP directive
requires spaces between values and spaces are not valid
in URL (encoded or not).
Invalid CSP directives or its values gets ignored by the browser.
* Address CR
* Use accurate wording
* Use AWS OIDC Integration for AWS App Access
This PR enables the usage of the AWS OIDC Integration when proxying
access to AWS.
When a request comes, it generates the AWS OIDC credentials to proxy the
request directly to AWS.
This removes the requirement for an AppService with local credentials.
* rename var
* remove dependency on lib/srv
* API for creating AppServer that uses AWS OIDC Integration
This PR adds two new APIs:
- web api endpoint
- `tctl create` for AppServers
This allows the client to create AppServer which use the integration
credentials.
This also updates the `editor` role so that they are able to upsert the
AppServer.
* return ui.App after creation
* improve comment
* Add e imports for MS Graph SDK
* Add ability to sign Entra ID OIDC JWTs, rework KID handling
- Synthesize Key IDs for our JWT keys. For backwards compatibility, also
include the same keys with an empty `kid` in JWKS.
- Sign AWS OIDC tokens with a `kid=""` header claim,
rather than omitting the `kid` claim altogether.
See comment for details.
* Add validation for Entra ID plugin
* Fix typo in assertion function name
* Update the OIDC JWKS test to expect the same key twice
* Add Entra ID plugin type constant
* go mod tidy
* Fix expected JWKS size in integration test
* Add basic tests for KeyID
* Move Azure auth settings from Plugin to Integration
* Address review comments
* Add a unit test to ensure KeyID compatibility
* Add license header to token_generator.go
* Rename validation function per new conventions
* Save the WebAuthn UserHandle in the mock Key
* Simplify passwordless tests
* fix: Forbid SSO users from logging in using passwordless
* Rename tests to TestPasswordlessProhibitedForSSO
* Add new flags to modules
* Add deprecated comments to isTeam
* Make support flag an enum
* Add a TODO instead of deprecating flag right away
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Add gogoproto.jsontag to new fields
* remove meaning from enum zero value
* Reuse proto.SupportType instead of suping
* Replace isTeam for new flags in web app
* Update proto file: rename enum 0 value to unspecified;fix json tag casing
* Reuse proto file instead of aliasing it
* undo removing method by accident
* Add MobileDeviceManagement field to web config struct
* Improve comments
* Fix tests
* Simplify lockedFeatures object
* Include JoinActiveSessions in the web config object
* Remove more instances of isTeam
* Apply suggestions from code review - improve comments
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Use consistent comments to remove isTeam
* Update godocs comments
* Revert removign `isTeam` from stories it still should
* Fix godoc typo
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Michelle Bergquist <11967646+michellescripts@users.noreply.github.com>
* Remove Assist command execution and chat feature
The changes remove tests and related code for command execution in the assist package and web command handling.
* Remove Teleport Assist chat from CHANGELOG.md
The changes in this commit reflect the removal of the Teleport Assist chat from the CHANGELOG documentation of Teleport version 16. The Assist feature continues to be available in the SSH Web Terminal and Audit Monitoring.
* Remove assist chat from the test plan
* AWS OIDC: IAM set up for AWS App Access
AWS App Access using AWS OIDC Integration requires a new policy in the
AWS OIDC Role.
This PR adds a one-off script that executes the configuration command
that adds said policy.
* improved comments, remove dead code, improve logging
* improve comment and http client var name
* move back to interface
* remove default client
* rename role to rolename
* enable fips endpoint support
* restrict target roles by their tags
* use true for tag value
* player: fix seeking during dead time
This addresses a bug in the new player API where the player does
not respond to seeking during large periods of "dead time."
For example, if there is 30 seconds of dead time between two events,
the player is effectively in a 30 second sleep. Attempting to change
the position of playback during this 30-second period works, but is
not observed until the sleep completes.
With this change, the sleep period is canceled when the user seeks
to a new position.
Fixes#38560
* Improve UX when the user seeks while paused
Restart the stream in this case rather than trying to keep server
and client state in sync.
* Fix
* Update desktop player
* Lint/test fixes
* increase timeout
* Use a real clock for the new test
* Support redirecting to TAG on first login
* Update api/proto/teleport/userpreferences/v1/access_graph.proto
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Add support for highlighting a navigation item
* Add godoc
* Re-run make grpc
---------
Co-authored-by: Rafał Cieślak <rafal.cieslak@goteleport.com>
* Keep track of whether the user has a real password set
* lint
* Some comments
* Fix TestCreateResources
* Fix e/ link
* Review
* Review
* Review
* Use early return on error in DeletePassword
* Fix the broken teleterm test
* Switch "get roles" endpoint to the paginated version
* Use the paginated API in the roles screen
* Use the paginated API in the locks screen
* Switch select components for roles to an async version
* Do not break backward compatibility of list roles endpoint
* Allow the new web UI to handle old response types
* Disable pagination buttons in the serverside table when loading data
* Add TODO item about rename
* Add `UrlListRolesParams`
* Remove pagination config
* Remove unused `UrlIntegrationExecuteRequestParams`
Exposes SetReadDeadline on the terminal web socket so that the
test helper `waitForOutput` can set it to unblock reads if the
timeout is exceeded. While this alone should not fix any
flaky tests it should allow tests failures to occur prior to
the 10m test timeout and isolate at which parts of the test things
are becoming stuck.
Updates #36061 and #30892
Michael