* Update kingpin
* Convert CLI formatting to use kingpin UsageRenderers
Avoiding the legacy kingpin text/templates allows for DCE to be used
by the linker. The existing formatting has been matched with a
pure Go UsageRenderer.
* Write CLI --help text to stdout instead of stderr
* Display only one level of subcommands in help text
* Prevent a hidden command from increasing indentation level
* Add entry to changelog explaining updates to --help output
* expose logs of Teleport child processes
Configures Teleport child proceses to log with the exact same
configuration as the parent process. Logs from child processes
previously were essentially discarded.
* Fix issues around os_log; Fix log spam from child process.
* Address comments; Fix lint.
* * Only write remote command failure errors to client tty
* Don't try to write errors to unserviced os.Stderr/Stdout of child process
* Don't connect networking stderr to parent process, just use logger
* Don't log client-responsible shell errors, e.g. shell interrupt
* Mention running teleport as root for common subprocess permission errors.
* Pass io.Discard pipe to child process if a log writer is not available.
* Fix tests with nil log writer.
* Add default child logger for tests.
* Fix lint.
* default to discard writer for tests.
* Write reexec errors to os.Stdout for parent process to digest.
* Address comments.
* Clean up child pipe copy logic.
* Cleanup log config inheritance.
* Address comments.
* Revert whitespace change.
* Fix typo.
* Fix merge conflict.
---------
Co-authored-by: joerger <bjoerger@goteleport.com>
* Fix printing empty usage and terminate CLI for parsing global flags
* Add test with check of both `--help` flag and `help` command that usage print is not empty and both identical.
Add godoc clarification
* Disable managed update check for version help command test
* Add profile integration to disable update and re-execution for specific cluster
* Complete integration for the tctl and tsh
* Add commands for tsh
* Fix linter warnings
* Add config file with version and disabling status
* Move check out from helper
* Fixed re-execution ignore if versions is identical
* Move logic out from client
* Remove helper package and profile integration
* Fix argument parsing by filtering
* Use same Darwin platform approach of package extraction for Linux
Add client tools cleanup for V1 directories
* Fix packaging unit test
* Add cleanup for last recently used tools
* Add migration from v1 for better support
Show error log message about failed update/re-execution instead of failing command execution in case if updated binary was broken, modified or not able to validate signature
* Add ignore the version check fail, add more debug information
* Check update for commands `tsh ssh`, `tsh proxy ssh`
Fixed creating `.tsh` subdirectory when TELEPORT_HOME is set
Fix `tsh --proxy` flag parsing
* Wraps client init function to check client tools managed update only when it requested for `tsh ssh` and `tsh proxy ssh`
* Move filesystem lock to configuration library
Configuration modification protected by lock, other process must wait until it is released
* Rename command to `tsh update`, `tsh update --clear`
* Add test for argument filtering
* Update RFD
Make max tools installed to be configurable and set to 3 by default
* Replace "automatic updates" to "managed updates"
* Updated comments to reflect the latest changes
* Fix migration for older versions with two packages
* CR changes
* Prevent failing tools execution if configuration file is corrupted
* Remove lock file as part of cleanup command
* Added context to arguments
* Use a separate Kingpin application for tctl, as is already done for tsh. Double parsing may cause issues since it is not stateless.
Moves all test related logger initialization and creation to the
logtest package to reduce testing symbols in production code. The
existing helpers in lib/utils have been left in place until the
enterprise references can be converted.
Updates #51023.
* Add a CLI reference generator
See #3568
Add a function to update the kingpin usage template for a CLI
application and print a docs page. As a starting point, includes a
`docs` subcommand in `tsh` to call the function for that tool. By
generating CLI documentation, we can ensure that commmand, argument, and
flag usage information is consistent with the terminal help text for a
given CLI. We can also ensure that all changes to a CLI application are
reflected in the documentation.
As an alternative, we could edit `UpdateAppUsageTemplate` in `lib/utils`
to update the usage template to print an MDX page, e.g., using build
tags to print a docs template instead of the default usage template.
This approach would update all CLI tools at once and use a consistent
approach with minimal changes to each CLI tool. However, using a
separate function to take a `*kingpin.Application` and print a docs page
is more straightforward and explicit, even though it does require
editing each CLI tool to call the function.
One shortcoming of generating the CLI reference docs versus our current
manual approach is that it is non-trivial (and potentially impossible)
to use `kingpin`'s usage API to obtain the value types of the
subcommands, flags, and arguments registered against a
`*kingpin.Application`. We can use flag and argument descriptions and
default values to achieve the same purpose.
Another shortcoming is that `kingpin`'s usage API does not print usage
information for arguments, environment variable, etc. that a CLI looks
up directly from the OS, such as the `TELEPORT_CLUSTER` environment
variable for `tsh`.
* Respond to zmb3 and atburke feedback
**Separate docs generation code from production code.**
Add a separate implementation of `UpdateAppUsageTemplate` that requires
the `docs` build tag. Since all Go-based Teleport CLI tools call
`UpdateAppUsageTemplate`, the `docs` build of the function ensure that
the `help` command for Teleport CLI tools prints a docs page.
This change also adds a `cli-docs-tsh` make target to generate a docs
page for `tsh`.
**Escape pipes in `formatHelp`** to avoid breaking table cells.
* Respond to atburke feedback
- Make the main help description more visible. Assume that the main help
description is not necessarily a complete sentence, adding the text to
the end of the introductory sentence using a colon.
- Add a make rule for running CLI docs generator tests. Use the `-run`
flag since the tests are in a package we already run tests for in
another make rule.
* Respond to zmb3 feedback
- Use Fprintf instead of Buffer.WriteString.
- Use the zero value of bytes.Buffer instead of NewBuffer.
- Rename `.*ToColumns` functions to `.*ToRows` for clarity.
- Use slices.ContainsFunc in anyVisibleFlags.
- Use slices.ContainsFunc in anyEnvVarsForCmd.
- Clean up argsToRows.
- Minor cleanup in TestUpdateAppUsageTemplate.
- Clean up sortCommandsByName (no need to implement sort.Interface).
- Read the docs usage template from disk in UpdateAppUsageTemplate. For
this to work, add the function updateAppUsageTemplate, which takes an
io.Reader, and use separate file paths to pass the io.Reader to the
function in the tests and in UpdateAppUsageTemplate.
- Inline formatFlagForTable and remove unnecessary branching.
- Add an ADDTAGS environment variable to the `test-go-unit` make
target so it's possible to pass arbitrary build tags, e.g., "docs".
* feat(mcp): initial postgres mcp
* test(postgres): fix missing mock function
* fix(gomod): go mod tidy all
* refactor: code review suggestions
* fix(tsh): mcp init missing logger
* chore(tsh): missing other route to database field
* refactor: use in-memory net listener
* test(tsh): add mcp db command test
* chore: fix license
* refactor(tsh): move logger init
* test(mcp): sort slices to avoid flakiness
* chore: fix lint
* test(mcp): sort the resources before assertion
* fix(mcp): update error handler for better message
* refactor: code review suggestions
* feat: add external error retriever for more accurate error messages
* refactor: use the same logger init for mcp purposes
* refactor: code review suggestions
* refactor(tsh): rename command to `tsh mcp db start`
* refactor(mcp): protect database resources with rw mutex
* chore: update server godocs
* chore: go mod tidy
* refactor: update command to take list of databases
* chore(mcp): license
* chore(tsh): remove unused function
* refactor: code review suggestions
* refactor(tsh): validate duplicated databases in MCP configuration
* refactor(tsh): rename files to mcp_db
* feat(mcp): add cluster name to the database resource
* Support os_log in lib/utils.InitLogger
* Refactor code for getting bundle identifier
* Rename DaemonLabel to VNEDaemonLabel
Rename the Obj-C function so that we can add a C function called
DaemonLabel later. The C function will be called from Go code.
* Use os_log in VNet daemon
* Adjust logging preferences of VNet daemon
* Clean up logger components in lib/vnet
This is the _last_ step required to migrate from logrus to slog.
All components in the repository have been migrated to use slog
allowing the logrus formatter to be deleted.
The slog handler tests that validate the output have been updated
to assert the format directly instead of comparing it to the output
from the logrus formatter.
This change is a change in how we are handling the untrusted input. Instead of adopting a strategy of quoting (which was incomplete), this instead escapes any special characters.
Although github.com/google/safetext is new, and without any current tags for us to reference, I believe it would be better to reference their implementation than to update the UnixShellQuote to handle the newly identified cases.
* Quote user supplied inputs provided to scripts to avoid RCE
This change introduces the func `utils.UnixShellQuote` which will quote any inputs which could potentially allow execution or script escape.
This is utilized to ensure that scripts produced from a potential Phishing link could not contain code execution which may expose a user.
* awsAccessGraphOIDCSync: Ensure role parameter is quoted correctly
* join_tokens: Move shell quote to `getJoinScript` rather than where parameters are extracted
This will increase safety moving forward, but it requires a more conservative quoting strategy.
* Bump github.com/gravitational/trace from 1.3.1 to 1.4.0
## Changelog
- Bump google.golang.org/grpc from 1.43.0 to 1.53.0 by @dependabot in #94
- Bump golang.org/x/net from 0.8.0 to 0.17.0 by @dependabot in #100
- Bump google.golang.org/grpc from 1.53.0 to 1.56.3 by @dependabot in #101
- Bump golang.org/x/crypto from 0.14.0 to 0.17.0 by @dependabot in #105
## Breaking Changes
- Remove logrus dependency by @rosstimothy in #107
- Remove references to UDP logrus hook from README by @rosstimothy in #108
Full Changelog: https://github.com/gravitational/trace/compare/v1.3.1...v1.4.0
* remove final references to removed trace functionality
* fix: formatter error handling
When creating a reverse proxy the ErrorLog was being created
with the writer returned from logrus.WriterLevel. This writer
uses an io.Pipe and a goroutine to get any log messages written
from a standard log.Logger to our custom formated logrus.Entry.
The ErrorLog only ever omits output in a few very rare (hopefully)
error cases, which means we were creating an extra goroutine per
reverse proxy which in most cases would never be used to produce
any added output. Additionally, now that we are starting to support
log/slog, any output from a log.Logger will now be formatted via
our registered default slog handler. Meaning that we can still
get the benefits of producing output from the ErrorLog in the
desired format without the penalty incurred by using logrus.WriterLevel.
Partially addresses #36541.
* Update slog handlers to support configured extra_fields
In addition to configuring output format users can configure the
fields which are included in log messages. Prior to this our slog
handlers didn't support this feature and always output the default
fields. Now, both the slog and logrus output is identical no matter
the extra_fields configuration as verified by TestExtraFields. It
was also found that due to the way the logurs json formatter was
configuring itself in CheckAndSetDefaults the timestamp was always
included in the final output even if it was not included in the
configured extra_fields.
* fix: update component comment
In all places that a logrus logger is being initialized an equivalent
slog logger is now being intialized as well. The TeleportProcess
was also updated to have a slog.Logger which is created with the
same fields that its logrus equivalent has. This does not convert
any logging to actually use slog yet, but does pave the way for
conversions to start.
Implements two new slog.Handlers that attempt to output text in the
same format as existing logrus.TextFormatter implementations. The
most notable differences are that the order of fields in the json
output does NOT match the logrus order and the additional items
in text output are NOT sorted alphabetically like they are in logrus.
Tests added validate the output roughly matches between the two
loggers given the differences noted above. A benchmark test is also
included to demonstrate the improvements slog offers over logrus.
This PR replaces the usage of `gravitational/oxy.Forwarder` in our codebase with `httputil.ReverseProxy`.
`httputil.ReverseProxy` is part of Go's standard library and thus it is
maintained by the Go team. Converting everything to use the std lib
allows us to drop our `oxy` fork.
There are some operational changes between the two versions:
1. `httputil.ReverseProxy` handles WebSockets upgrades internally and
reuses the `Transport` provided for the initial request. Thus, it does
not require any special dialer or rewriter mechanisms for WebSockets only.
2. `httputil.ReverseProxy` calls the `ErrorHandler` with the request
after it was rewritten and after roundtrip was called. This was a
problem because our `web.transport` deletes Teleport associated
cookies and when the request failed, the request received by the
`ErrorHandler` missed the cookies to generate a new session. This was
fixed by cloning the request at `web.transport` round tripper.
3. `httputil.ReverseProxy` uses std's `log.Logger`. `logrus` exposes a
method `Writer` that allows it to be used with standard lib logger.
The API is similar to what our `oxy` fork has available.
Fixes#27412
* check for correct kube listen address in starting message
* fix for ssh proxy and usage of String function
* remove consolef output and simplify output
* remove consolef output
* Remove consolef from services for startup
* fix imports
* remove all consolef usage
In “tsh login” show only alerts with on-login label.
In “tsh status” show only alerts with “high” severity. Which license warning should match.
In all “tctl” commands show only alerts with “high” severity.
Update metalinter, fix a few lint warnings and replace deprecated linters.
`deadcode`, `structcheck` and `varcheck` are abandoned and now replaced by [`unused`][1].
Since 1.19, `go fmt` reformats godocs according to https://go.dev/doc/comment. I've done a bulk-reformatting of the codebase to keep the linter happy. Backporting is mostly harmless (the exception being `lib/services/role_test.go`, that for some reason breaks the _old_ linter using the new format).
[1]: https://golangci-lint.run/usage/linters/
* Bump golangci-lint version
* Replace abandoned linters
* Fix bodyclose on lib/auth/github.com
* Fix bodyclose on lib/kube/proxy/streamproto/proto_test.go
* Fix bodyclose on lib/srv/alpnproxy/proxy_test.go
* Fix bodyclose on lib/web/conn_upgrade_test.go
* Silence staticcheck on lib/kube/proxy/forwarder_test.go
* Silence staticcheck on lib/utils/certs_test.go
* Address BuildNameToCertificate deprecation warnings
* Run `go fmt ./...`
* Run `go fmt ./...` on api/
* Ignore formatting in role_test.go
* Remove redundant initializers in lib/srv/uacc/
* Update e/
* start work on self signed tsh fixes
* fix go sum
* Adjust error formatting
* Complete less explicit error checks last
* Adjust PR feedback
* Further PR review
* Support darwin and linux certificate errors
* aliases are read from global and user configs.
* we prevent Kingpin from terminating `tsh`; we handle parsing errors better.
* added support for `TELEPORT_DEBUG` env variable, changed how logging is initialized.
* debugging aliases is possible via `TELEPORT_DEBUG=1` env variable; `--debug` is ineffective as it comes into play too late.
* if alias definition calls `tsh`, we call the `Run()` function directly instead of spawning fresh `tsh`; this improves the UX.
* alias loops are detected and a proper error is shown.
* all flags are made repeatable; if only one value for a given flag is possible, the last instance of the flag will be effective.
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Add certificate renewal bot
This adds a new `tbot` tool to continuously renew a set of
certificates after registering with a Teleport cluster using a
similar process to standard node joining.
This makes some modifications to user certificate generation to allow
for certificates that can be renewed beyond their original TTL, and
exposes new gRPC endpoints:
* `CreateBotJoinToken` creates a join token for a bot user
* `GenerateInitialRenewableUserCerts` exchanges a token for a set of
certificates with a new `renewable` flag set
A new `tctl` command, `tctl bots add`, creates a bot user and calls
`CreateBotJoinToken` to issue a token. A bot instance can then be
started using a provided command.
* Cert bot refactoring pass
* Use role requests to split renewable certs from end-user certs
* Add bot configuration file
* Use `teleport.dev/bot` label
* Remove `impersonator` flag on initial bot certs
* Remove unnecessary `renew` package
* Misc other cleanup
* Do not pass through `renewable` flag when role requests are set
This adds additional restrictions on when a certificate's `renewable`
flag is carried over to a new certificate. In particular, it now also
denies the flag when either role requests are present, or the
`disallowReissue` flag has been previously set.
In practice `disallow-reissue` would have prevented any undesired
behavior but this improves consistency and resolves a TODO.
* Various tbot UX improvements; render SSH config
* Fully flesh out config template rendering
* Fix rendering for SSH configuration templates
* Added `String()` impls for destination types
* Improve certificate renewal logging; show more detail
* Properly fall back to default (all) roles
* Add mode hints for files
* Add/update copyright headers
* Add stubs for tbot init and watch commands
* Add gRPC endpoints for managing bots
* Add `CreateBot`, `DeleteBot`, and `GetBotUsers` gRPC endpoints
* Replace `tctl bot (add|rm|ls)` implementations with gRPC calls
* Define a few new constants, `DefaultBotJoinTTL`, `BotLabel`,
`BotGenerationLabel`
* Fix outdated destination flag in example tbot command
* Bugfix pass for demo
* Fixed a few nil pointer derefs when using config from CLI args
* Properly create destination if `--destination-dir` flag is used
* Remove improper default on CLI flag
* `DestinationConfig` is now a list of pointers
* Address first wave of review feedback
Fixes the majority of smaller issues caught by reviewers, thanks all!
* Add doc comments for bot.go functions
* Return the token TTL from CreateBot
* Split initial user cert issuance from `generateUserCerts()`
Issuing initial renewable certificate ended up requiring a lot of
hacks to skip checks that prevented anonymous bots from getting
certs even though we'd verified their identity elsewhere (via token).
This reverts all those hacks and splits initial bot cert logic into a
dedicated `generateInitialRenewableUserCerts()` function which should
make the whole process much easier to follow.
* Set bot traits to silence log messages
* tbot log message consistency pass
* Implement `tbot init` subcommand
This adds a new CLI subcommand to initialize a tbot destination
directory by creating required files ahead of time and assigning
proper permissions (and ACLs, where possible).
* Resolve lints
* Add config tests
* Remove CreateBotJoinToken endpoint
Users should instead use the CreateBot/DeleteBot endpoints.
* Create a fresh private key for every impersonated identity renewal
* Hide `config` subcommand
* Rename bot label prefix to `teleport.internal/`
* Use types.NewRole() to create bot roles
* Clean up error handling in custom YAML unmarshallers
Also, add notes about the supported YAML shapes.
* Fetch proxy host via gRPC Ping() instead of GetProxies()
* Update lib/auth/bot.go
Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
* Fix some review comments
* Add renewable certificate generation checks (#10098)
* Add renewable certificate generation checks
This adds a new validation check for renewable certificates that
maintains a renewal counter as both a certificate extension and a
user label. This counter is used to ensure only a single certificate
lineage can exist: for example, if a renewable certificate is stolen,
only one copy of the certificate can be renewed as the generation
counter will not match
When renewing a certificate, first the generation counter presented
by the user (via their TLS identity) is compared to a value stored
with the associated user (in a new `teleport.dev/bot-generation`
label field). If they aren't equal, the renewal attempt fails.
Otherwise, the generation counter is incremented by 1, stored to the
database using a `CompareAndSwap()` to ensure atomicity, and set on
the generated certificate for use in future renewals.
* Add unit tests for the generation counter
This adds new unit tests to exercise the generation counter checks.
Additionally, it fixes two other renewable cert tests that were
failing.
* Remove certRequestGeneration() function
* Emit audit event when cert generations don't match
* Fully implement `tctl bots lock`
* Show bot name in `tctl bots ls`
* Lock bots when a cert generation mismatch is found
* Make CompareFailed respones from validateGenerationLabel() more actionable
* Update lib/services/local/users.go
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* Backend changes for tbot IoT and AWS joining (#10360)
* backend changes
* add token permission check
* pass ctx from caller
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* fix comment typo
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* use UserMetadata instead of Identity in RenewableCertificateGenerationMismatch event
* Client changes for tbot IoT joining (#10397)
* client changes
* delete replaced APIs
* delete unused tbot/auth.go
* add license header
* don't unecessarily fetch host CA
* log fixes
* s/tunnelling/tunneling/
Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
* auth server addresses may be proxies
Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
* comment typo fix
Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
* move *Server methods out of auth_with_roles.go (#10416)
Co-authored-by: Tim Buckley <tim@goteleport.com>
Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
Co-authored-by: Tim Buckley <tim@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Tim Buckley <tim@goteleport.com>
Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
Co-authored-by: Nic Klaassen <nic@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
* Address another batch of review feedback
* Addres another batch of review feedback
Add `Role.SetMetadata()`, simplify more `trace.WrapWithMessage()`
calls, clear some TODOs and lints, and address other misc feedback
items.
* Fix lint
* Add missing doc comments to SaveIdentity / LoadIdentity
* Remove pam tag from tbot build
* Update note about bot lock deletion
* Another pass of review feedback
Ensure all requestable roles exist when creating a bot, adjust the
default renewable cert TTL down to 1 hour, and check types during
`CompareAndSwapUser()`
* Remove ModeHint
* Rename Identity.Cert and Identity.XCert
* Add `symlinks` flag to tbot config
The optional symlinks flag for directory destinations allows users to
opt in / out of whichever symlink attack hardening mode is selected
by default.
* Add mostly-working secure implementation of botfs.Create/Write
This adds symlink mode selection (secure, try-secure, insecure) and
Linux `Create()`/`Write()` implementations to open files safely.
* Add configurable ACL modes and verify ACL support in tbot init
* Initialize destinations at startup and test before renewal
This initializes destinations at startup (to create directories if
not using `tbot init`) and tests them to ensure the bot can write
_before_ attempting to renew certificates; this should prevent most
accidental generation counter locks.
* Hide watch for now
* Issue a new identity if a token change is detected
* Warn if identity appears to be expired on startup
* Fully implement ACL Verify and Configure
- Fully implements ACL support for Linux
- Adds bot-side verification support to ensure ACLs are configured
properly at runtime.
- Gracefully falls back to no ACLs if the platform / filesystem
doesn't support them
- Clear up outstanding lints
* Make `tbot init` work without a config file
* Show init instructions in tctl bots add
Also:
- Make --bot-user a flag in init (the tctl instructions were
confusing otherwise)
- Handle IsOwnedBy sanely on unsupported platforms
- Add Bold colorizing support
* Clear some TODOs and rephrase tctl help
* Fix typo
* Fix token hash detection bug
* Actually read and write certs with symlink enforcement
Also, fix a config loading bug where CheckAndSetDefaults() wasn't
being called in all cases with CLI destinations.
* Add workaround for OpenSSH permissions check with ACLs
OpenSSH has an overly-paranoid permissions check that forces key
files to be exclusively owner-readable. Unfortunately, for POSIX
compatibility purposes, when ACLs are set, the ACL mask is set as
the group permissions. This effectively makes any ACL incompatible
with OpenSSH.
However, OpenSSH's check does have an escape hatch: it only applies
if the current user is the owner of the file. Therefore, this change
tweaks the `tbot init` flow to create files as root, owned by a
separate user (either `nobody` or even the bot user), with ACL
permissions granting both the bot and reader user access to the
certificates. This effectively bypasses OpenSSH's permissions check
and should preserve our security boundaries.
* Fix lints
* Fix an improper directory chmod to 0600 if ACL test fails
* First pass of tbot init unit tests
* Add symlink tests and fix bug with resolving the default owner
* Fix err misuse
* Fix an ACL error if the bot or reader user is the owner.
* Fix typo
* Fix missing error case in VerifyACL causing unreadable directories
* Address review feedback
- Rename ACLOn -> ACLRequired
- Simplify fs_linux.Read()
- Add missing fs_other.Read()
- Hoist renewal loop logic into its own function
- A few misc bugfixes
* Apply suggestions from code review
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Address review feedback
- Only log syscall warning once
- Formatting and wording changes
- Improve error handling for `--clean`
* Fix lint error
* Fix imports in fs_other
* Fix possible nil pointer deref if storage is unset
* Use the bot user as default owner
This is more likely to be a safe owner choice than `nobody:nobody`.
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Code review fixes
Co-authored-by: Zac Bergquist <zmb3@users.noreply.github.com>
Co-authored-by: Nic Klaassen <nic@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Disable colorized error formatting on Windows
This disables colorized error formatting on Windows. While recent
versions of Windows can render ANSI sequences, this functionality
needs to be explicitly enabled at runtime and then reset before
exiting. As it stands today, Windows clients see the raw ANSI
escapes, for example:
←[31mERROR: ←[0mfailed connecting to node example [...]
Due to compatibility concerns and `tsh`'s lack of a single exit
point, this just disables ANSI escapes when
`runtime.GOOS == "windows"`. The `ERROR:` text won't be colorized,
but also won't be surrounded by garbage characters.
* Add TODO note about why we disable colors on Windows.
Purpose is to allow users with admin privilege that are able to view audit logs,
to be able to debug SSO login failures from the UI as much as possible
* Return generic error message for sso console login failures to hide
sensitive data from reaching client. Previously errors were returning as
empty messages b/c of a trace bug.
* Remove emit event for createOIDCClient to allow outer caller to
emit event and prevent double emits on error.
* Temporarily direct users to check teleports log on errors that come back
empty to tsh client.
rosstimothy