mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 19:12:46 +08:00
Paul Gottschling
c553fa7d66
* Add a guide to writing an Access Request plugin Closes #22227 This guide uses a minimal working example of an Access Request plugin to demonstrate some of the key libraries that Teleport makes available to plugin developers. The guide is based on a 270-line plugin that manages Access Requests using Google Sheets. * Respond to hugoShaka feedback * Respond to zmb3 feedback * Add some minor tweaks - Update the line of code count in the demo program - Mention Machine ID * Respond to alexfornuto PR feedback
56 lines
1.4 KiB
Plaintext
56 lines
1.4 KiB
Plaintext
For the purpose of this guide, we will define an `editor-requester` role, which
|
|
can request the built-in `editor` role, and an `editor-reviewer` role that can
|
|
review requests for the `editor` role.
|
|
|
|
Create a file called `editor-request-rbac.yaml` with the following content:
|
|
|
|
```yaml
|
|
kind: role
|
|
version: v5
|
|
metadata:
|
|
name: editor-reviewer
|
|
spec:
|
|
allow:
|
|
review_requests:
|
|
roles: ['editor']
|
|
---
|
|
kind: role
|
|
version: v5
|
|
metadata:
|
|
name: editor-requester
|
|
spec:
|
|
allow:
|
|
request:
|
|
roles: ['editor']
|
|
thresholds:
|
|
- approve: 1
|
|
deny: 1
|
|
```
|
|
|
|
Create the roles you defined:
|
|
|
|
```code
|
|
$ tctl create -f editor-request-rbac.yaml
|
|
role 'editor-reviewer' has been created
|
|
role 'editor-requester' has been created
|
|
```
|
|
|
|
Allow yourself to review requests by users with the `editor-requester` role by
|
|
assigning yourself the `editor-reviewer` role.
|
|
|
|
(!docs/pages/includes/add-role-to-user.mdx role="editor-reviewer"!)
|
|
|
|
Create a user called `myuser` who has the `editor-requester` role. This user
|
|
cannot edit your cluster configuration unless they request the `editor` role:
|
|
|
|
```code
|
|
$ tctl users add myuser --roles=editor-requester
|
|
```
|
|
|
|
`tctl` will print an invitation URL to your terminal. Visit the URL and log in
|
|
as `myuser` for the first time, registering credentials as configured for your
|
|
Teleport cluster.
|
|
|
|
Later in this guide, you will have `myuser` request the `editor` role so you can
|
|
review the request using the Teleport plugin.
|