* Fixes IC Account Assignment role matcher
Fixes issue where the IC Account Assignment role matcher constructor created
the wrong type of Role Matcher, meaning that the any Account Assignment would match
as long as the account matched, regardless of the Permission set.
* tests
* Add admin rule tab to the role editor
Also tightens some constraints about standard role editor conformance.
* Add a way to delete an admin rule
* Add the options panel to role editor
* Review
* Review
This updates GetByVMID, used by azure joining, to filter by id for
each page of vms instead of filtering after accumulating _all_ vms
in memory first. While this does reduce memory consumption, the listing
process is still suboptimal in that _all_ instances in a subscription
are retrieved in response to _every_ join request.
* chore: restructure vnet for windows support
In preparation for adding Windows support to VNet, I have restructured
the package/file structure a bit in a way that I think makes more sense
and narrows the scope of OS-specific code.
I also unexported some identifiers that did not need to be exported, in
an attempt to make it more clear what is actually called from outside
the vnet package.
This commit does not make any functional changes except for adding the
hidden `tsh vnet` and `tsh vnet-admin-setup` commands on windows that
will just return errors.
* fix renames in comments
* switch reexec to escalate
* fix-imports
When converting to slog there have been various mechanisms used
to include an objects type in a slog attribute to replace %T from
a logrus message. This unifies all type attribute to use
logutils.typeAttr instead of calling reflect/fmt directly. The former
ensures that the type is only calculated if the message is going
to be logged.
One edge case is the `structure.architecture-h2` warning in
`docs/pages/includes/database-access/rds-proxy.mdx`. This is technically
correct, since the "How it works" section is before the "Prerequisites"
section. We can determine whether this is a bug to fix in a separate
change.
* Updating OS Package metadata: license and description
* Adding community license to tarball
* Updating build-package to include license for OSS package metadata
* Fixing some interpolation errors
* Removing unecessary line
* Cleaning up the metadata formatting
* Fix falky TestAgentRolloutController
* switch to real clock + increase Eventually timeout
* Make reconciliation period a parameter + add TELEPORT_UNSTABLE env var
* Update lib/service/service_test.go
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Remove env var
* lint
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
The Teleport package that is installed for RDP access as local
Windows users is not signed by Microsoft and therefore will not
load on systems with LSA protection enabled.
Updates gravitational/teleport.e#5615
* Add admin rule tab to the role editor
Also tightens some constraints about standard role editor conformance.
* Add a way to delete an admin rule
* Review
* auth: fix cluster init deadlock
If the bootstrapped resources are created but a failure occurs later
in the cluster init process subsequent runs of the cluster initialization
will fail due to the existing bootstrap resources.
* add test for new behavior
* add test for cluster init failures recovery
* Update lib/services/local/resource_test.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* reorder assertion values
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* tsh: Print target ports when returning multi-port apps
* Add TCP ports to App message in lib/teleterm
* Connect: Add port selector for multi-port TCP apps
* Add controls to ActionButtons story
* Add control for rendering lots of menu items in ActionButtons story
* Include target port in VNet modals and notifications in Connect
* Empty commit to trigger CI
oss counterpart for
https://github.com/gravitational/teleport.e/pull/5628
This adds some testing to the view as well as the equivalent to the web
solution for Connect. Connect was missing the [recently
added](https://github.com/gravitational/teleport/pull/48536)
`ReviewRequests` field in the user ACL, so I added it here.
Because this is handled in the tsh code, we don't have to worry about
backward compatibility here for Connect right?
* Rewrite MenuList to TypeScript
* Rewrite design/Menu story to TypeScript
* Refactor MenuLogin story
* Add label and separator for MenuItem sections
* Add proper types for anchor and transform origin
* Fix rendering MenuLogin with a long list of items (#49626)
Adds Identity Center Account Assignments to the Unified resource cache
so they can be requested in access requests.
Unfortunately we can't just include an `identitycenterv1.AccountAssignment`
directly in the resource cache ListResources output because the legacy
protobuf codegen used for the authservice and the new codegen used for
identitycenter/v1 produce incompatible serialization code, so resulting
generated code does not compile.
To get around this issue, this change introduces a parallel (and slightly
simplified) definition of an IdentityCenterAccountAssignment in the authservice
protobuf spec to act as the wire format for this type. The cached
`identitycenterv1.AccountAssignment` resources are copied into a
`proto.IdentityCenterAccountAssignment` on a cache read.
Includes:
- adding resources to cache
- adding account assignment paginated resource
- account assignment role condition matching for RBAC
* Add `AddMetadataToRetryableError` to `AuthenticateWebDevice`
* Add a document for web session authorization
* Replace `AuthenticateWebDevice` modal with the document
* Remove dot from anchor
* Move more logic to `authorizeAndCloseDocument`
* Add a comment about `canAuthorize`
* Filter out documents before restoring session
* Add a comment about `processedRedirectUri`
* Restore filtering out documents before saving them on disk
* Fix test
* Refer to Teleport Connect instead of 'the app'
The go tool will automatically remove the toolchain directive if it
happens to be the same as the go directive. This means in order to
reliably get the version of Go that is used to build, we need to first
check the toolchain directive, and fall back to the go directive only
if the toolchain is not specified.
Additionally, the toolchain directive is prefixed with "go", so we
need to strip that to get consistent output.
* Suggest enabling PROXY protocol in DTW troubleshooting
* Mention audit as a source of information for errors
* Mention solutions for both L7 and L4 LBs
* Link X-Forwarded-For to config references
This starts the transition of our SSH servers to use slog. The
regular.Server has been converted to use slog, though there
are still various logs emitted via the srv.ServerContext from the
server which use logrus.
Closes#47156.
All of the tests suffering from issues dialing hosts, and failing
with a `failed to dial target host` error were incorrectly waiting
for nodes to become visible before establishing connections. The
main culprit for most of the failures was `waitForNodesToRegister`,
though a few tests had a very similar hand rolled variant, which
incorrectly returned when the nodes appeard in Auth. However, since
the Proxy is the one performing dialing, they should have waited
for the nodes to appear in the Proxy.
To resolve, `waitForNodesToRegister` and all hand rolled equivalents
have been removed in favor of `(TeleInstance) WaitForNodeCount` which
correctly uses the `CachingAccessPoint` of the RemoteSite instead
of `GetClient`. Additionally, `helpers.WaitForNodeCount` was updated
to validate that the node watcher used for routing in the Proxy
also contained the expected number of nodes.
Replaces the use of go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws
with the tracing support now provided directly by the aws sdk.
See https://github.com/aws/aws-sdk-go-v2/discussions/2810 for more
details.
Some additional aws clients were also updated to include tracing
support.
* Integration Discovery Rules: endpoint that returns all the rules
This PR adds a new endpoint that returns all the discovery rules that
exist for a given Integration.
It will include what was the last time the rule was used to fetch
resources, so that users can see stale rules and act upon it.
The endpoint supports filtering by the resource type to ensure the UI
only requests a subset of the rules, depending on the screen the user is
visiting (eg, EC2, RDS or EKS).
* use discovery rule
* AWS OIDC: add aws account id as label to AWS App
We were not setting any labels in the AWS App when using the Discover
Flow for a given AWS OIDC integration.
This is a bad practice because this means that users must have
`app_labels: *:*` in order to access this particular app.
This is not recommended because it grants access to every app.
This PR changes this so that the account id can be used to gate access.
* fix test
rosstimothy