mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-02 14:59:53 +08:00
45 lines
1.3 KiB
Markdown
45 lines
1.3 KiB
Markdown
## Example workflows plugin
|
|
|
|
This example plugin demonstrates how to create a workflows plugin to automatically approve/deny new access requests based on a simple Allow List.
|
|
|
|
## Demo
|
|
|
|
This demo can be used to quickly get the example plugin up and running.
|
|
|
|
### Create resources
|
|
|
|
```console
|
|
# create the access-plugin user and role
|
|
$ tctl create -f access-plugin.yaml
|
|
# generate an identity file for the access-plugin
|
|
$ tctl auth sign --ttl=8760h --format=file --user=access-plugin --out=access-plugin-identity
|
|
```
|
|
|
|
### Edit the config file
|
|
|
|
Open `config.toml` and replace the `addr` with your own Auth or Proxy server address.
|
|
|
|
### Run the plugin
|
|
|
|
Start up the plugin and keep it running.
|
|
|
|
```console
|
|
$ go run main.go
|
|
```
|
|
|
|
### Make an access request
|
|
|
|
Open another terminal and execute the following commands to make a new access request.
|
|
|
|
```console
|
|
# create the requester role
|
|
$ tctl create -f requester.yaml
|
|
# create a new user named alice using this role
|
|
$ tctl users add alice --roles=requester
|
|
# login as alice
|
|
$ tsh --proxy=proxy.example.com login --user=alice
|
|
# request the admin role as alice
|
|
$ tsh --proxy=proxy.example.com request new --roles=admin
|
|
```
|
|
|
|
Since `alice` is on the Allow List in `cofig.toml` with allowed role `requester`, the request should be automatically approved by the plugin. |