mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-31 03:27:49 +08:00
Tim Buckley
0756c34c8e
* MWI: Issue and verify join state documents This adds join state document issuance and verification to the bound keypair joining process. This is described in more detail in the [RFD], but in short, this adds a mechanism similar to the generation counter to verify bound keypair recovery events. Each time a recovery is performed, the join counter (stored in the token's status field) is incremented. This value is embedded in a JWT and signed by Auth, and the result is passed to the client alongside their cert bundle. This document effectively gives clients permission to lock themselves out in the future: if another client attempts to use their credentials, the original client will eventually present an outdated join state document, and trigger a lockout. [RFD]: https://github.com/gravitational/teleport/blob/rfd/0205-improved-onprem-joining/rfd/0205-improved-onprem-joining.md * Allow selecting all recovery modes * Remove TODO and debug log * Add tests for join state issuance and verification * Add join state tests for RegisterUsingBoundKeypairMethod Adds some minor error message and comment fixes caught while writing tests. * Fix imports * Fix lints * Fix failing unit test * Add notes about lack of expiry field in join state JWTs