mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-21 14:35:22 +08:00
Dan Upton
4860cf3c6b
* Add `DelegationSessionService` protobuf definition * Implement `GenerateCerts` RPC * Prevent restricted delegation sessions from inheriting administrative privileges Previously, the `resources` list on a delegation session would restrict regular access to resources that weren't explicitly included, but not administrative actions. Now, we explicitly deny all administrative (rule-authorized) actions for delegation sessions unless you include a wildcard in `resources`. * Only permit list/read/readnosecrets for allow-listed resource kinds * Fix reused extension OID * Add a small amount of tolerance for clock skew * Make the "expires must be in the future" message clearer * Fix linter errors * Access to a windows desktop implies access to the desktop service * Add `DelegationSessionID` to the decision package's `SSHIdentity` and `TLSIdentity` * Wrap `ExtractConditionForIdentifier` for delegation sessions too * Prevent calling `GenerateCerts` inside a delegation session * No need for indirection with GenerateUserCerts method now * Fix import ordering * Stop delegation service from returning CA certificates Per @strideynet's request, to avoid replicating existing bad patterns around conflating the user and host CAs. * Error messages should start with lowercase letters * Add `RouteToKubernetes` wrapping message * Replace expires parameter with TTL * Remove unnesasary error check * Fix `AgentScope` extension type assertion