Noah StrideandDan Upton 0fb8f91c29 Workload Identity Revocations Signing (#52353) ...

* Add initial implementation of CRL signing

* Clarify

* Add basic support for streaming signed CRL to `tctl`

* Add log messages

* Start adding CRL support to tbot

* Wire in CRL support to workload-identity-x509

* Wire up crlCache to dependent services

* Fix missing cluster name injectiont

* Run the background goroutine

* FIx notification mechanism

* Add CRL assertions to TestBotWorkloadIdentityX509

* Add appropriate backoff to RevocationService

* Start work on TestRevocationService_CRL

* Change comparison in test

* Finish TestRevocationService_CRL

* Add CRL assertion to TestBotWorkloadIdentityAPI

* Fix linter complaint

* Update lib/tbot/service_workload_identity_api_test.go

Co-authored-by: Dan Upton <daniel.upton@goteleport.com>

* Update lib/tbot/service_workload_identity_api_test.go

Co-authored-by: Dan Upton <daniel.upton@goteleport.com>

* Rename KeyStorer

* Trigger CRL signing every ten minutes

* ADd SVIDCRLPemPath to Describe

---------

Co-authored-by: Dan Upton <daniel.upton@goteleport.com>

2025-02-26 11:03:01 +00:00

..

accessmonitoringrules/accessmonitoringrulesv1

add periodic cleanup for notifications (#40941)

2024-09-20 10:56:41 +00:00

accesspoint

Workload ID: Add WorkloadIdentity local service and cache config (#49942)

2024-12-10 09:22:09 +00:00

authclient

WebAPI: Add state as filter for UserTasks listing endpoint (#52191)

2025-02-20 09:24:06 +00:00

autoupdate/autoupdatev1

Add bootstrap support for AutoUpdateConfig/AutoUpdateVersion resources (#51904)

2025-02-08 03:44:34 +00:00

clusterconfig/clusterconfigv1

Stable UNIX users: storage and auth API (#51102)

2025-01-28 17:08:20 +00:00

crownjewel

Update several admin actions to allow reusable MFA challenges (#49095)

2024-11-19 18:56:32 +00:00

dbobject/dbobjectv1

Update several admin actions to allow reusable MFA challenges (#49095)

2024-11-19 18:56:32 +00:00

dbobjectimportrule/dbobjectimportrulev1

Update several admin actions to allow reusable MFA challenges (#49095)

2024-11-19 18:56:32 +00:00

discoveryconfig/discoveryconfigv1

Convert some lib/auth subpackages to slog (#47477)

2024-10-11 10:00:37 +00:00

dynamicwindows/dynamicwindowsv1

Update several admin actions to allow reusable MFA challenges (#49095)

2024-11-19 18:56:32 +00:00

gitserver/gitserverv1

GitHub proxy part 5: OAuth flow to retrieve GitHub identity (#49849)

2024-12-10 17:31:32 +00:00

integration

GitHub proxy: cleanup git servers when deleting the integration (#52333)

2025-02-21 15:04:01 +00:00

join

feat: Allow non-FIPS endpoints on FIPS binaries (#51924)

2025-02-11 22:45:04 +00:00

keygen

Add host fields and protos for ssh identities (#51024)

2025-01-27 18:51:37 +00:00

keystore

feat: Allow non-FIPS endpoints on FIPS binaries (#51924)

2025-02-11 22:45:04 +00:00

kubewaitingcontainer/kubewaitingcontainerv1

add periodic cleanup for notifications (#40941)

2024-09-20 10:56:41 +00:00

loginrule/loginrulev1

Unify naming and location of auth RPC services (#46559)

2024-09-12 22:34:58 +00:00

machineid

Workload Identity Revocations Signing (#52353)

2025-02-26 11:03:01 +00:00

mfatypes

Use json compatible struct for SSOMFASessionData (#47826)

2024-10-31 19:59:53 +00:00

migration

Convert some lib/auth subpackages to slog (#47477)

2024-10-11 10:00:37 +00:00

mocku2f

feat: Implement the WebAuthn credProps extension (#45252)

2024-08-15 13:28:19 +00:00

notifications/notificationsv1

add access list reminder notification type (#51426)

2025-01-29 05:27:28 +00:00

okta

Update backend.Key to be its own distinct type (#46701)

2024-10-04 14:02:00 +00:00

presence/presencev1

Vendor gravitational/trace/trail in api (#51032)

2025-01-14 21:04:01 +00:00

stableunixusers

Stable UNIX users: functionality (#51200)

2025-01-29 18:15:57 +00:00

state

Prevent auth from starting when an incompatible major upgrade is detected (#43520)

2024-07-12 22:01:21 +00:00

storage

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

test

transition ssh enforcement to sshca.Identity (#51468)

2025-02-04 18:01:53 +00:00

testauthority

Add host fields and protos for ssh identities (#51024)

2025-01-27 18:51:37 +00:00

touchid

Convert lib/auth/touchid to use slog (#50514)

2024-12-20 20:57:41 +00:00

trust/trustv1

verify cluster name of TLS peer certificates (#52128)

2025-02-13 21:25:52 +00:00

userloginstate

record access list review and membership role grant events (#52183)

2025-02-26 00:46:45 +00:00

userpreferences/userpreferencesv1

Convert auth rpc services to use slog (#50513)

2024-12-20 20:28:23 +00:00

userprovisioning/userprovisioningv2

Update several admin actions to allow reusable MFA challenges (#49095)

2024-11-19 18:56:32 +00:00

users/usersv1

update log messages (#50679)

2025-01-02 16:54:07 +00:00

usertasks/usertasksv1

WebAPI: Add state as filter for UserTasks listing endpoint (#52191)

2025-02-20 09:24:06 +00:00

vnetconfig/vnetconfigv1

Update several admin actions to allow reusable MFA challenges (#49095)

2024-11-19 18:56:32 +00:00

webauthn

Don't emit warning log for reusing reusable MFA (#51885)

2025-02-05 20:47:26 +00:00

webauthncli

Convert lib/auth/webauthn* to use slog (#50510)

2024-12-20 19:48:54 +00:00

webauthntypes

Use json compatible struct for SSOMFASessionData (#47826)

2024-10-31 19:59:53 +00:00

webauthnwin

Convert lib/auth/webauthn* to use slog (#50510)

2024-12-20 19:48:54 +00:00

windows

Complete lib/srv conversion to slog (#50124)

2024-12-18 15:09:26 +00:00

access_request_test.go

transition ssh enforcement to sshca.Identity (#51468)

2025-02-04 18:01:53 +00:00

access_test.go

…

access.go

Replace more Logrus usage with Slog (#46757)

2024-09-19 18:37:51 +00:00

accountrecovery_test.go

chore: Bump github.com/jonboulle/clockwork to v0.5.0 (#51434)

2025-01-24 15:22:13 +00:00

accountrecovery.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

apiserver_test.go

Clean up user and login enrichment code for v17 (#47459)

2024-10-10 21:33:49 +00:00

apiserver.go

Restore fake namespace APIs for v17 agents (#51433)

2025-01-24 11:24:14 +00:00

auth_login_test.go

Headless authn support for split SSH/TLS keys (#45646)

2024-08-22 15:38:22 +00:00

auth_test.go

Reduce resource consumption when generating Kubernetes certificates (#52109)

2025-02-13 19:27:19 +00:00

auth_with_roles_okta_rbac_test.go

Clean up user and login enrichment code for v17 (#47459)

2024-10-10 21:33:49 +00:00

auth_with_roles_test.go

Add iterators to unified resource cache (#52103)

2025-02-20 18:35:50 +00:00

auth_with_roles.go

Don't emit audit events for illegitimate SAML/OIDC requests (#52306)

2025-02-19 21:31:58 +00:00

auth.go

Add iterators to unified resource cache (#52103)

2025-02-20 18:35:50 +00:00

aws_certs.go

…

azure_certs_test.go

…

azure_certs.go

…

bot_test.go

Remove aws-sdk-go depdenency in bot tests (#51680)

2025-01-30 22:06:58 +00:00

bot.go

Encode Join Attributes in Bot Certificates (#49426)

2025-01-08 09:59:15 +00:00

client_tls_config_generator.go

verify cluster name of TLS peer certificates (#52128)

2025-02-13 21:25:52 +00:00

db_test.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

db.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

desktop_test.go

Surface Cloud Entitlements (#42394)

2024-06-28 00:22:13 +00:00

desktop.go

Improve troubleshooting for LDAP authentication errors (#42948)

2024-10-16 18:51:26 +00:00

externalauditstorage.go

…

fuzz_test.go

…

github_test.go

chore: Bump github.com/jonboulle/clockwork to v0.5.0 (#51434)

2025-01-24 15:22:13 +00:00

github.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

grpcserver_test.go

chore: Bump github.com/jonboulle/clockwork to v0.5.0 (#51434)

2025-01-24 15:22:13 +00:00

grpcserver.go

Workload Identity Revocations Signing (#52353)

2025-02-26 11:03:01 +00:00

helpers_mfa.go

Prepare for clockwork v0.5.0 (#51292)

2025-01-23 19:38:24 +00:00

helpers.go

Stable UNIX users: storage and auth API (#51102)

2025-01-28 17:08:20 +00:00

init_test.go

verify cluster name of TLS peer certificates (#52128)

2025-02-13 21:25:52 +00:00

init.go

verify cluster name of TLS peer certificates (#52128)

2025-02-13 21:25:52 +00:00

join_azure_test.go

Verify subscription id matches (#51085)

2025-01-22 01:19:58 +00:00

join_azure.go

Support resolving Azure identities from VM scale set for SQL Server connections (#51671)

2025-02-14 02:44:34 +00:00

join_bitbucket_test.go

Machine ID: Add bitbucket join method for Bitbucket Pipelines joining (#48724)

2024-11-21 23:05:58 +00:00

join_bitbucket.go

Machine ID: Add bitbucket join method for Bitbucket Pipelines joining (#48724)

2024-11-21 23:05:58 +00:00

join_circleci_test.go

…

join_circleci.go

…

join_ec2_test.go

Remove the auth namespaces REST API (#50999)

2025-01-15 14:21:23 +00:00

join_ec2.go

feat: Allow non-FIPS endpoints on FIPS binaries (#51924)

2025-02-11 22:45:04 +00:00

join_gcp_test.go

…

join_gcp.go

Convert lib/auth/join* to use slog (#50517)

2024-12-21 02:32:06 +00:00

join_github_test.go

Support for joining Actions in un-reachable GitHub Enterprise Servers via Static JWKS (#48973)

2024-11-15 12:32:55 +00:00

join_github.go

Convert lib/auth/join* to use slog (#50517)

2024-12-21 02:32:06 +00:00

join_gitlab_test.go

…

join_gitlab.go

Convert lib/auth/join* to use slog (#50517)

2024-12-21 02:32:06 +00:00

join_iam_test.go

Convert RegisterUsingToken RPC from HTTP to gRPC (#47853)

2024-10-24 10:54:22 +00:00

join_iam.go

Encode Join Attributes in Bot Certificates (#49426)

2025-01-08 09:59:15 +00:00

join_kubernetes_test.go

Rename lib/kubernetestoken to lib/kube/token (#49554)

2024-12-04 22:39:55 +00:00

join_kubernetes.go

Convert lib/auth/join* to use slog (#50517)

2024-12-21 02:32:06 +00:00

join_oracle_test.go

Add oci join server auth (#51446)

2025-02-07 18:09:44 +00:00

join_oracle.go

Add oci join server auth (#51446)

2025-02-07 18:09:44 +00:00

join_spacelift_test.go

…

join_spacelift.go

Convert lib/auth/join* to use slog (#50517)

2024-12-21 02:32:06 +00:00

join_terraformcloud_test.go

Enable Terraform Cloud joining for Teleport Community Edition (#46419)

2024-09-12 02:37:41 +00:00

join_terraformcloud.go

Convert lib/auth/join* to use slog (#50517)

2024-12-21 02:32:06 +00:00

join_test.go

Update backend.Key to be its own distinct type (#46701)

2024-10-04 14:02:00 +00:00

join_tpm_test.go

Convert RegisterUsingToken RPC from HTTP to gRPC (#47853)

2024-10-24 10:54:22 +00:00

join_tpm.go

Encode Join Attributes in Bot Certificates (#49426)

2025-01-08 09:59:15 +00:00

join.go

Improve instance join error message (#51714)

2025-02-03 16:24:06 +00:00

kube_test.go

Get rid of math/rand in favor of math/rand/v2 (#49294)

2024-11-21 12:57:32 +00:00

kube.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

methods_test.go

…

methods.go

emit user_origin for local login event (#52124)

2025-02-25 20:53:29 +00:00

middleware_test.go

Make rejected connections easier to identify (#45176)

2024-08-08 17:46:31 +00:00

middleware.go

verify cluster name of TLS peer certificates (#52128)

2025-02-13 21:25:52 +00:00

moderated_sessions_test.go

…

notification_test.go

add access list reminder notification type (#51426)

2025-01-29 05:27:28 +00:00

oidc.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

password_test.go

Get rid of math/rand in favor of math/rand/v2 (#49294)

2024-11-21 12:57:32 +00:00

password.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

periodic_test.go

…

periodic.go

…

register.go

chore: update IAM join method to use aws-sdk-go-v2 (#47044)

2024-10-02 00:58:00 +00:00

rotate.go

Fix outdated docs URLs (#50923)

2025-01-16 18:17:35 +00:00

saml.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

server_info_test.go

chore: Bump github.com/jonboulle/clockwork to v0.5.0 (#51434)

2025-01-24 15:22:13 +00:00

server_info.go

Use thread-local RNGs for jitters (#48860)

2024-11-13 16:35:09 +00:00

server_monitor.go

Add monitoring of the servers time drifting (#44489)

2024-11-28 21:18:24 +00:00

session_access_test.go

…

session_access.go

Fix incorrect usages of "it's" (#48252)

2024-10-31 23:35:30 +00:00

sessions_test.go

Test DeviceWebToken creation from CreateWebSessionFromReq (#44818)

2024-07-30 19:34:15 +00:00

sessions.go

Add host fields and protos for ssh identities (#51024)

2025-01-27 18:51:37 +00:00

sso_diag_context_test.go

…

sso_diag_context.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

sso_mfa_test.go

feat: SSO MFA - WebUI backend implementation (#47832)

2024-11-06 01:43:41 +00:00

sso_mfa.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

tls_test.go

verify cluster name of TLS peer certificates (#52128)

2025-02-13 21:25:52 +00:00

transport_credentials_test.go

Update google.golang.org/grpc to 1.68.0 (#49712)

2024-12-03 19:05:35 +00:00

transport_credentials.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

trustedcluster_test.go

verify cluster name of TLS peer certificates (#52128)

2025-02-13 21:25:52 +00:00

trustedcluster.go

verify cluster name of TLS peer certificates (#52128)

2025-02-13 21:25:52 +00:00

usage_test.go

chore: Bump github.com/jonboulle/clockwork to v0.5.0 (#51434)

2025-01-24 15:22:13 +00:00

user.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

usertoken_test.go

chore: Bump github.com/jonboulle/clockwork to v0.5.0 (#51434)

2025-01-24 15:22:13 +00:00

usertoken.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

version.go

Temporary fix major version check for v18 (#49851)

2024-12-06 00:50:29 +00:00