mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-02 06:08:23 +08:00
Zac Bergquist
2a7c138e63
In the original releases of desktop access (circa Teleport 8), Teleport itself authenticated to LDAP with a password. As a result, Teleport could publish its own certificate authority to the Windows NTAuth store, which made one less step for the user to do when setting up Teleport. Some time later, we removed the password authentication, and Teleport started using a Teleport-issued certificate to connect to LDAP. A side effect of this change was that Teleport could no longer authenticate to LDAP and publish its own CA, because the cert-based authentication could not succeed until the CA was already trusted. At this time, it became necessary to write Teleport's CA to the NTAuth store at installation time. Ever since then, Teleport has been periodically publishing its CA to NTAuth, even though it's guaranteed to be there already. This commit removes the periodic write operation and updates the docs to use more restrictive permissions on the Teleport service account. The installation process remains exactly the same.