mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 02:21:02 +08:00
Michael Wilsonandalexfornuto
48daeff5bd
* SAML identity provider docs. SAML IdP documentation has been added. * formatting * spelling * Zac's and Roman's feedback. * Valid config.json. * Linting updates. * usr Var component Adding as a unique commit in case it's not desired * align output with object name * Roman's feedback, add in a section for disabling the IdP. * copy edits * SAML Grafana guide (#22545) * init Grafana SAML guide * respond to review feedback * Correct entity provider to identity provider. * Note that HSM is not currently supported. * Fix link. --------- Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
347 lines
16 KiB
Plaintext
347 lines
16 KiB
Plaintext
```yaml
|
||
kind: role
|
||
version: v6
|
||
metadata:
|
||
name: example
|
||
spec:
|
||
# options specify connection, in case if user has multiple non-default
|
||
# conflicting options, teleport chooses the least permissive value.
|
||
options:
|
||
# max_session_ttl defines the TTL (time to live) of certificates
|
||
# issued to the users with this role.
|
||
max_session_ttl: 8h
|
||
# forward_agent controls whether SSH agent forwarding is allowed
|
||
forward_agent: true
|
||
# port_forwarding controls whether TCP port forwarding is allowed for SSH
|
||
port_forwarding: true
|
||
# ssh_file_copy controls whether file copying (SCP/SFTP) is allowed.
|
||
# Defaults to true.
|
||
ssh_file_copy: false
|
||
# client_idle_timeout determines if SSH sessions to cluster nodes are
|
||
# forcefully terminated after no activity from a client (idle client).
|
||
# it overrides the global cluster setting. examples: "30m", "1h" or "1h30m"
|
||
client_idle_timeout: never
|
||
# Determines if the clients will be forcefully disconnected when their
|
||
# certificates expire in the middle of an active session.
|
||
# It overrides the global cluster setting.
|
||
disconnect_expired_cert: no
|
||
# max_sessions is total number of session channels that can be established
|
||
# across a single connection. Setting it to 10 matches OpenSSH default behavior.
|
||
max_sessions: 10
|
||
# Defines which events are recorded by the BPF-based session recorder.
|
||
enhanced_recording:
|
||
- command
|
||
- disk
|
||
- network
|
||
# permit_x11_forwarding allows users to use X11 forwarding with openssh
|
||
# clients and servers through the proxy
|
||
permit_x11_forwarding: true
|
||
# device_trust_mode enforces authenticated device access for the owner of this role.
|
||
device_trust_mode: optional|required|off
|
||
# require_session_mfa require per-session MFA for any owner of this role
|
||
require_session_mfa: true
|
||
# lock sets locking mode for user of this role,
|
||
# valid values are "strict" or "best_effort"
|
||
lock: strict
|
||
# enterprise-only request_access field is either 'always' or 'reason'. If set to always, it instructs
|
||
# tsh or the web UI clients to always create an Access Request on login. If it is
|
||
# set to 'reason', the user will be required to indicate why they are
|
||
# generating the Access Request.
|
||
request_access: reason
|
||
# the `request_prompt` field can be used to tell the user what should
|
||
# be supplied in the request reason field.
|
||
request_prompt: Please provide your ticket ID
|
||
# enterprise-only max_connections field sets a limit of concurrent sessions within a
|
||
# cluster. This setting slows down Teleport performance because it has to track
|
||
# connections cluster-wide.
|
||
max_connections: 2
|
||
# limit number of concurrent Kubernetes sessions per user
|
||
max_kubernetes_connections: 1
|
||
# Define how Teleport deals with session recording failures, such as a full
|
||
# disk error. The value can be set to either `best_effort` or `strict`. If
|
||
# set to `strict`, the session will terminate immediately. If set to
|
||
# `best_effort`, the session won’t be terminated, and the recording will be
|
||
# disabled. The configuration is done per service (currently, only `ssh` is
|
||
# supported).
|
||
record_session:
|
||
# Specify whether or not to record the user's desktop sessions.
|
||
# Desktop session recording is enabled if one or more of the user's
|
||
# roles has enabled recording. Defaults to true if unspecified.
|
||
# Desktop sessions will never be recorded if auth_service.session_recording
|
||
# is set to 'off' in teleport.yaml (Auth Service) or if the cluster's
|
||
# session_recording_config resource has set 'mode: off'.
|
||
desktop: true
|
||
# Optional: the default session recording mode to use when a
|
||
# protocol-specific mode is not set.
|
||
default: best_effort|strict
|
||
# Optional: Session recording mode for SSH sessions (Teleport Server
|
||
# Access). If not set, the value set on default will be used.
|
||
ssh: best_effort|strict
|
||
# Specify whether clipboard sharing should be allowed with the
|
||
# remote desktop (requires a supported browser). Defaults to true
|
||
# if unspecified. If one or more of the user's roles has disabled
|
||
# the clipboard, then it will be disabled.
|
||
desktop_clipboard: true
|
||
# enterprise-only: when enabled, the source IP that was used to log in is embedded in the SSH
|
||
# certificate, preventing a compromised certificate from being used on other
|
||
# devices. The default is false.
|
||
# Note: Source IP pinning is currently in Preview mode.
|
||
pin_source_ip: true
|
||
# Specify a list of names and associated values to be included in user SSH keys.
|
||
# The key type can only be "ssh" and the mode can only be "extension".
|
||
# The name and value fields can be arbitrary strings and the value field
|
||
# supports variable interpolation.
|
||
cert_extensions:
|
||
- type: ssh
|
||
mode: extension
|
||
name: login@github.com
|
||
value: "{{ external.github_login }}"
|
||
# Controls whether this role supports auto provisioning of users.
|
||
create_host_user: true
|
||
# Specifies role specific options for identity provider access.
|
||
idp:
|
||
# Specifies role specific options for SAML identity provider access.
|
||
saml:
|
||
# Specifies whether this role has access to the SAML identity provider.
|
||
# Defaults to true.
|
||
enabled: true
|
||
|
||
# The allow section declares a list of resource/verb combinations that are
|
||
# allowed for the users of this role. By default, nothing is allowed.
|
||
allow:
|
||
# The logins array defines the OS/UNIX logins a user is allowed to use.
|
||
# both strings and template variables are supported in this field
|
||
logins: [root, '{{internal.logins}}']
|
||
|
||
# Windows logins a user is allowed to use for desktop sessions.
|
||
windows_desktop_logins: [Administrator, '{{internal.logins}}']
|
||
|
||
# node_labels: a user with this role will be allowed to connect to
|
||
# SSH nodes, which labels match expressions below.
|
||
node_labels:
|
||
# literal strings:
|
||
'env': 'test'
|
||
# the wildcard ('*') means "any node"
|
||
'*': '*'
|
||
# a list of alternative options:
|
||
'region': ['us-west-1', 'eu-central-1']
|
||
# regular expressions start with ^ and end with $
|
||
# Teleport uses golang regexp syntax.
|
||
# of the list example above can be expressed as:
|
||
'reg': '^us-west-1|eu-central-1$'
|
||
|
||
# kubernetes_groups specifies Kubernetes groups a user with this role will assume.
|
||
# You can refer to a SAML/OIDC trait via the "external" property bag.
|
||
# This allows you to specify Kubernetes group membership in an identity manager:
|
||
kubernetes_groups: ["system:masters", "{{external.trait_name}}"]
|
||
|
||
# kubernetes_users is an optional field that specifies kubernetes users
|
||
# this role can assume.
|
||
kubernetes_users: ['IAM#{{external.foo}};']
|
||
|
||
# kubernetes_labels: a user with this role will be allowed to connect to
|
||
# k8s clusters, which labels match expressions below.
|
||
kubernetes_labels:
|
||
# A user can only access prod environments
|
||
'env': 'prod'
|
||
# User can access any region in us-west, e.g us-west-1, us-west-2
|
||
'region': 'us-west-*'
|
||
# regular expressions start with ^ and ending with $
|
||
# Teleport uses golang regexp syntax.
|
||
'cluster_name': '^us.*\.example\.com$'
|
||
|
||
# kubernetes_resources indicates the Kubernetes resources that a user with
|
||
# this role is allowed to access.
|
||
kubernetes_resources:
|
||
# The resource kind. Teleport currently only supports "pod".
|
||
- kind: pod
|
||
# The name of the Kubernetes namespace in which to allow access the
|
||
# resources you specify with "name" and "kind".
|
||
# The wildcard character "*" matches any sequence of characters.
|
||
# If the value begins with "^" and ends with "$", the Kubernetes
|
||
# Service will treat it as a regular expression.
|
||
namespace: "*"
|
||
# The name of the resource to allow access to.
|
||
# The wildcard character "*" matches any sequence of characters.
|
||
# If the value begins with "^" and ends with "$", the Kubernetes
|
||
# Service will treat it as a regular expression.
|
||
name: "^nginx-[a-z0-9-]+$"
|
||
|
||
# Functions transform variables.
|
||
db_users: ['{{email.local(external.email)}}']
|
||
db_names: ['{{external.db_names}}']
|
||
db_labels:
|
||
'env': '{{regexp.replace(external.access["env"], "^(staging)$", "$1")}}'
|
||
|
||
# app_labels: a user with this role will be allowed to connect to
|
||
# applications, which labels match expressions below.
|
||
app_labels:
|
||
# A user can only access prod environments
|
||
'env': 'prod'
|
||
# User can access any region in us-west, e.g us-west-1, us-west-2
|
||
'region': 'us-west-*'
|
||
# Regular expressions start with ^ and end with $.
|
||
# Teleport uses Go's regular expression syntax:
|
||
# https://github.com/google/re2/wiki/Syntax
|
||
# The list example above can be expressed as:
|
||
# 'region': '^us-west-1|eu-central-1$'
|
||
'cluster_name': '^us.*\.example\.com$'
|
||
|
||
# aws_role_arns allows a user with this role to assume AWS roles when
|
||
# accessing AWS console using UI or AWS API using CLI
|
||
aws_role_arns:
|
||
- 'arn:aws:iam::1234567890:role/ec2-read-only'
|
||
- 'arn:aws:iam::1234567890:role/ec2-full-access'
|
||
- 'arn:aws:iam::0987654321:role/example-role'
|
||
|
||
# impersonate allows a user with this role to issue certificates on behalf
|
||
# of other users and roles matching expressions below
|
||
impersonate:
|
||
users: ['*']
|
||
roles: ['jenkins']
|
||
# where is an optional where condition
|
||
# further limiting the scope for matching users and roles
|
||
where: >
|
||
contains(user.spec.traits["group"], impersonate_role.metadata.labels["group"]) &&
|
||
contains(user.spec.traits["group"], impersonate_user.metadata.labels["group"])
|
||
|
||
# review_requests allows a user holding this role
|
||
# to approve or deny Access Requests
|
||
review_requests:
|
||
# the reviewer can view and approve or deny access requests for any roles
|
||
# listed here
|
||
roles: ['dbadmin']
|
||
# the reviewer can preview details about resources accessible by any roles
|
||
# listed in preview_as_roles when reviewing Resource Access Requests
|
||
preview_as_roles: ['dbadmin']
|
||
|
||
# request allows a user user request roles matching
|
||
# expressions below
|
||
request:
|
||
# the `roles` list can be a mixture of literals and wildcard matchers
|
||
roles: ['common', 'dev-*']
|
||
|
||
# `search_as_roles` allows users to search for and request access to
|
||
# resources accessible by the listed roles
|
||
search_as_roles: ['access']
|
||
|
||
# thresholds specifies minimum amount of approvers and deniers,
|
||
# defaults to 1 for both
|
||
thresholds:
|
||
# requires at least two qualifying approvers and at least one denier.
|
||
- approve: 2
|
||
deny: 1
|
||
|
||
# the `claims_to_roles` mapping works the same as it does in
|
||
# the OIDC connector, with the added benefit that the roles being mapped to
|
||
# can also be matchers. the below mapping says that users with
|
||
# the claims `groups: admins` can request any role in the system.
|
||
claims_to_roles:
|
||
- claim: 'projects'
|
||
# matches all group names with a leading 'product-'
|
||
value: '^product-(.*)$'
|
||
# generates a role name from the value capture
|
||
roles: ['$1-admin']
|
||
|
||
# Teleport can attach annotations to pending Access Requests. these
|
||
# annotations may be literals, or be variable interpolation expressions,
|
||
# effectively creating a means for propagating selected claims from an
|
||
# external identity provider to the plugin system.
|
||
annotations:
|
||
foo: ['bar']
|
||
groups: ['{{external.groups}}']
|
||
|
||
# Moderated Sessions policy that dictates requirements for starting a session.
|
||
require_session_join:
|
||
# Defines the name of the policy. The name serves only as an
|
||
# identifier in logs and for organisation/categorisation.
|
||
- name: Auditor oversight
|
||
# Specifies an RBAC predicate that is used to define
|
||
# which users count against the required user count of the policy.
|
||
filter: 'contains(user.spec.roles, "auditor")'
|
||
# The different session kinds this policy applies to.
|
||
kinds: ['k8s', 'ssh']
|
||
# A list of session participant modes that a participant must have
|
||
# one of in order to count against the policy.
|
||
modes: ['moderator']
|
||
# The minimum amount of users that need to match the filter expression
|
||
# in order to satisfy the policy.
|
||
count: 1
|
||
# The action to take if a moderator leaves a session, causing the policy to no longer be satisfied.
|
||
# This may be either "terminate" or "pause". An empty or unknown value will default to "terminate".
|
||
on_leave: "terminate"
|
||
|
||
# Moderated Sessions policy that dictates the ability to join sessions
|
||
join_sessions:
|
||
# Defines the name of the policy. The name serves only as an
|
||
# identifier in logs and for organisation/categorisation.
|
||
- name: Auditor oversight
|
||
# Allows one to join sessions created by other users with these roles
|
||
roles : ['prod-access']
|
||
# The different session kinds this policy applies to.
|
||
kinds: ['k8s', 'ssh']
|
||
# The list of session participant modes the role may join the session as.
|
||
modes: ['moderator', 'observer']
|
||
|
||
# rules allow a user holding this role to modify other resources
|
||
# matching the expressions below
|
||
# supported resources:
|
||
# role - role resource
|
||
# user - user resource
|
||
#
|
||
# auth_connector - any auth connector resource
|
||
# oidc - OIDC connector resource
|
||
# saml - connector resource
|
||
# github - GitHub connector resource
|
||
#
|
||
# trusted_cluster - Trusted Cluster resource
|
||
# remote_cluster - remote cluster resource
|
||
#
|
||
# access_request - Access Request resource
|
||
# access_plugin_data - allows modifying Access Request plugin data
|
||
#
|
||
# session - session playback records
|
||
# ssh_session - an active SSH session
|
||
# event - structured audit logging event
|
||
#
|
||
#
|
||
# lock - lock resource.
|
||
# network_restrictions - restrictions for SSH sessions
|
||
#
|
||
# auth_server - Auth Service resource
|
||
# proxy - Proxy Service resource
|
||
# node - SSH node resource
|
||
# app - application resource
|
||
# db - database resource
|
||
# kube_cluster - Kubernetes cluster resource
|
||
# token - provisioning token resource
|
||
# cert_authority - certificate authority resource
|
||
#
|
||
# cluster_name - resource that contains the cluster name.
|
||
# cluster_config - resource that holds cluster level config
|
||
# cluster_auth_preference - type of authentication for this cluster
|
||
# session_recording_config - resource for session recording config
|
||
# cluster_audit_config - resource that holds cluster audit config
|
||
# cluster_networking_config - resource that holds cluster networking config
|
||
|
||
rules:
|
||
- resources: [role]
|
||
verbs: [list, create, read, update, delete]
|
||
- resources: [auth_connector]
|
||
verbs: [list, create, read, update, delete]
|
||
- resources: [session]
|
||
verbs: [list, read]
|
||
- resources: [trusted_cluster]
|
||
verbs: [list, create, read, update, delete]
|
||
- resources: [event]
|
||
verbs: [list, read]
|
||
- resources: [user]
|
||
verbs: [list, create, read, update, delete]
|
||
- resources: [token]
|
||
verbs: [list, create, read, update, delete]
|
||
|
||
# The deny section uses the identical format as the 'allow' section.
|
||
# The deny rules always override allow rules.
|
||
deny: {}
|
||
```
|