mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-19 01:58:44 +08:00
Tim Buckley
edabc9f89c
* MWI: Support scoped join tokens in the bound keypair join method * Bot fields for scoped tokens * Check bot scope * Allow bound keypair tokens to pass scope validation * Support bots * Fix outstanding references to ProvisionTokenV2 * Zero check on MustRegisterBefore due to proto impl differences * Properly pass through nil must_register_before * Also fix nil timestamps in bound keypair status * And fix rotate_after * Add BotInternal certificate field * Add 'bot' TokenUsageMode value and require for bot joins * Fix mutator execution for scoped bound keypair joining * Implement more ScopedToken StrongValidateToken checks for bots Adds a few more of the bot-specific RFD validation checks for bots. * Improve bot join checks for scoped joining * Fix build after rebase and add additional RFD checks This fixes builds after upstream updates and implements a few more validations required by the RFD: - AssignedScope field for bots must be empty - Moved original AssignedScope check to validateNonBot() since it was checked unconditionally before. - BotScope must be a presumably-valid scope at creation time * Use scope-aware access checker for initial bot certs * Fix WeakValidateToken() for scoped tokens for bots WeakValidateToken() was not updated to match the new checks in StrongValidateToken(); this adds minimal bot-related exemptions around `assigned_scope` for bots to allow it to be read without error. * Add tests for scoped bot tokens, fix role bug This adds a set of additional token tests for scoped bot tokens, and fixes an issue where WeakValidateToken() was erroneously rejecting invalid system roles. * Properly initialize bound keypair scoped tokens on creation/upsert We weren't applying the same initialization logic for scoped tokens that we did for ProvisionTokenV2; this is required for registration secrets to work properly. * Update CRDs * Fix failing test * Specify types for bound keypair timestamp fields * Update terraform resources * Fix lint * Include bot scope in BotJoin audit events This includes the bot scope in audit events. It includes the user label bot scope for successful joins where the user has been fetched, and otherwise includes the bot scope configured on the token. * Reject `token` join method for scoped bot tokens Bot joining should use `bound_keypair`, so reject scoped bot tokens that attempt to join with the traditional `token` join method. * Fix failing test due to BotInternal cert parameter TestRegisterBotInstance wasn't updated to include the BotInternal flag on initial identity, so this includes it. * Actually include Scope in bot audit events * Mutate correct token status in `patchToken` The mutate result was discarded because the wrong status object was passed to `mutateScopedToken`. * Use ScopedAuthorizer in join/Server.authenticate() `authenticate()` currently rejects scoped identities which prevented clients from reauthenticating with an existing identity, which is important for bot renewal and bound keypair joining. * Pass `BoundHostID` through properly in `GetBoundKeypairStatus()` * Add basic TestJoinBoundKeypair_ScopedToken test * Fix lint * Update join server comments, add note about feature flag edge case * Target correct provision token for standard token mutations * Return correct mutated token in patchToken() * Hide bound keypair registration secrets when `WithSecrets` is unset * Avoid possible nil pointer dereference * Address proto comment suggestion from review * Deduplicate bound keypair mutator validation logic Validation logic has been pulled out into a `validate()` interface function and unified for both token types; scoped token bound keypair fields are converted to their equivalent ProvisionTokenV2 variant using existing helper logic. * Nil check in consumeRecoveryMutator.validate() * Simplify lastRotatedAtMutator This removes the confusing switch with fallthroughs in favor of 2 simple ifs and a helper function. * Ensure bound keypair status is non-nil before mutating * Note non-nil requirement for new lastRotatedAt value * Update generated operator resources * Also nil-check status for standard tokens * Mirror secret censoring for bound keypair secrets in tctl This mirrors the existing secret censoring in tctl. It doesn't actually work since the conditional can never be true. * Use StrongValidate() on BotScope in token StrongValidate() `validateBotToken()` was incorrectly calling `scopes.WeakValidate()` on the bot scope. This changes it to call `scopes.StrongValidate()` instead. * Mark scoped token bound keypair registration_secret field as sensitive * Make lastRotatedAtMutator's `mutateScopedToken` nil-safe * Tag mutator validation errors with a unique name of the mutator Errors are tagged with the primary field that mutator modifies to help identify the failing mutator without necessarily identifying the specific failing check. * Address code review feedback * Wait for ScopedRoleAssignment to become available SRAs don't always propagate immediately, so adds a `require.EventuallyWithT()` check to ensure it exists before continuing. * Add test for scoped bot joining via kubernetes * Fix formatting