mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-02 14:59:53 +08:00
Alan Parra
8ef8324b8c
* Expose device verification methods in lib/devicetrust/authz * Set device fields in auth.Context.GetAccessState * Enable role-based device verification for SSH * Enable role-based device verification for DBs * Add TODO for better SSH error messages * Do not override device error on lib/kube/proxy * Run gci
71 lines
2.4 KiB
Go
71 lines
2.4 KiB
Go
/*
|
|
Copyright 2020 Gravitational, Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package common
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/sirupsen/logrus"
|
|
|
|
"github.com/gravitational/teleport/api/types"
|
|
dtauthz "github.com/gravitational/teleport/lib/devicetrust/authz"
|
|
"github.com/gravitational/teleport/lib/services"
|
|
"github.com/gravitational/teleport/lib/tlsca"
|
|
)
|
|
|
|
// Session combines parameters for a database connection session.
|
|
type Session struct {
|
|
// ID is the unique session ID.
|
|
ID string
|
|
// ClusterName is the cluster the database service is a part of.
|
|
ClusterName string
|
|
// HostID is the id of this database server host.
|
|
HostID string
|
|
// Database is the database user is connecting to.
|
|
Database types.Database
|
|
// Identity is the identity of the connecting Teleport user.
|
|
Identity tlsca.Identity
|
|
// Checker is the access checker for the identity.
|
|
Checker services.AccessChecker
|
|
// DatabaseUser is the requested database user.
|
|
DatabaseUser string
|
|
// DatabaseName is the requested database name.
|
|
DatabaseName string
|
|
// StartupParameters define initial connection parameters such as date style.
|
|
StartupParameters map[string]string
|
|
// Log is the logger with session specific fields.
|
|
Log logrus.FieldLogger
|
|
// LockTargets is a list of lock targets applicable to this session.
|
|
LockTargets []types.LockTarget
|
|
}
|
|
|
|
// String returns string representation of the session parameters.
|
|
func (c *Session) String() string {
|
|
return fmt.Sprintf("db[%v] identity[%v] dbUser[%v] dbName[%v]",
|
|
c.Database.GetName(), c.Identity.Username, c.DatabaseUser, c.DatabaseName)
|
|
}
|
|
|
|
// GetAccessState returns the AccessState based on the underlying
|
|
// [services.AccessChecker] and [tlsca.Identity].
|
|
func (c *Session) GetAccessState(authPref types.AuthPreference) services.AccessState {
|
|
state := c.Checker.GetAccessState(authPref)
|
|
state.MFAVerified = c.Identity.MFAVerified != ""
|
|
state.EnableDeviceVerification = true
|
|
state.DeviceVerified = dtauthz.IsTLSDeviceVerified(&c.Identity.DeviceExtensions)
|
|
return state
|
|
}
|