* split database CA into server/client CAs
* update migration logging
* include auth component in migrations
* debug log when skipping db client ca migration
* update tctl auth sign for cockroachdb
* update tctl auth sign for oracle
* set ExtKeyUsage for DB certs
* clientAuth for DB Client CA
* serverAuth for DB Server CA
* inject filter for pre-v14.3.1 clients
* inject a filter instead of dropping events in grpcserver
* add DatabaseClientCA type
* debug log when skipping filter injection
* update CA filter injection version check func name and doc
* feat(web): add token and database uri validations to sql server configure
* feat: add sql server address validation
* test: update example sql server URIs
* Update lib/web/databases_test.go
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
---------
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
#24864 added a dependency of lib/web into tsh which broke windows
tsh builds because lib/web transiently depends on lib/srv which
has linux specific code. This shuffles around a few things so
that lib/web is no longer importing lib/srv at all by:
- Indirectly using the srv.SessionController to apply session
control for web ssh sessions
- Moving the common reversetunnel interfaces into
reversetunnelclient since lib/reversetunnel imports
lib/srv/forward which imports lib/srv.
- Directly converting mysql client errors in the connection
tester instead of calling a common function.
* [Backend]: allow more db fields to be updatable
* Add preventing duplicate keys for label creator
* Add sort compare fn helper
* Update db request update object
* Update CreateDatabase component
- Uncomment and touch up db service checker
- Fix db service label checking
- Allow user to make changes to updatable db fields
- Split defining db name and the other fields into
two views, to prevent user from changing the db name
which is not allowed with the update action
* Address CR: use nil value to determine CACert update
* Few more touch ups
- address CR: don't OR update db request field CACert
and use consistent camelCasing
- remove the skip button for deploying service since
we have the service checker now, which auto skips it
for user if detects service
- refactor label matching for both register database
and deploy service steps
* Address CR: make all fields updatable
* Update service polling after rebase
When creating a database with the same name of an already existing one,
we were getting a raw error (depends on the backend implementation:
memory, lite, dynamo, ...).
This message is shown to the user which sees it as a cryptic error.
To improve this we should present the error in a better way and provide
an immediate action.
* Add db access rule required for db discovery
in editors role
For the webapi layer:
* Return db access with user context
* Add AWS RDS fields for creating db request
* Return hostname of each queried db server
* Prevent race from causing remote clients from being closed
`web.SessionContext` was susceptible to races retrieving `auth.ClientI`
for remote sites. The mutex on the remote client cache was not held for
the duration of the `GetUserClient` which meant two simultaneous requests
could find no client existed in the cache, create one and then add it to
the cache. When the second client is added to the cache it would close the
first client created, which results in the `use of closed network connection`
error displaying on the web UI as described in #17173.
To remedy this the portion of `GetUserClient` that retrieves the remote client
is now protected by a `singleflight.Group`. This ensures that races on creating
a client no longer happen.
`web.SessionContext` was slightly refactored to make it easier to test, to
remove some unnecessary operations, and to provide `context.Context` to `GetUserClient`.
Additionally, all `web.SessionContext` variables which were named `ctx` in `lib/web`
have been renamed to avoid confusion as that often refers to a `context.Context`.
Fixes#17173
* WebAPI: Get database endpoint
This commit creates a new endpoint to return a single databse by its
name.
```
GET /webapi/sites/:site/databases/:database
{
"name": "<database_name>",
"desc": "<description>",
"protocol": "<protocol>",
"type": "<type>",
"labels": [
{"name": "<name>", "value": "<value>"},
...
],
"database_users": ["<db_user1>", ...],
"database_names": ["<db_name1>", ...],
}
```
The `database_users` and `database_names` will list the available
Database User and Names for the current user, based on its roles.
This commit adds two new endpoints:
Create a database with
```
POST .../databases
{
"name": "<databasename>",
"protocol": "<protocol>",
"uri": "<uri>",
"labels": [{"name":"<name>", "value": "<value>"}...]
}
```
Update a database's `ca_cert` (the only updatable field for now)
```
PUT .../databases/:database
{
"ca_cert": "------BEGIN CERTIFICATE-----\n <certificate> --END..."
}
```
Gavin Frazar