gravitational/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-10-12 02:15:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

message types for new oracle join method (#60855)

Browse Source
This commit is contained in:
Nic Klaassen
2025-11-03 16:22:43 +00:00
committed by GitHub
parent 7ebcc8513d
commit 268d6a63b1
5 changed files with 536 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/gen/proto/go/teleport/join/v1/joinservice.pb.go
+343 -91
View File
@@ -93,7 +93,7 @@ func (x GivingUp_Reason) Number() protoreflect.EnumNumber {
// Deprecated: Use GivingUp_Reason.Descriptor instead.
func (GivingUp_Reason) EnumDescriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{18, 0}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{21, 0}
}
// ClientInit is the first message sent from the client during the join process, it
@@ -1137,6 +1137,186 @@ func (x *EC2Init) GetDocument() []byte {
return nil
}
// OracleInit is sent from the client in response to the ServerInit message for
// the Oracle join method.
//
// The Oracle method join flow is:
// 1. client->server: ClientInit
// 2. client<-server: ServerInit
// 3. client->server: OracleInit
// 4. client<-server: OracleChallenge
// 5. client->server: OracleChallengeSolution
// 6. client<-server: Result
type OracleInit struct {
state protoimpl.MessageState `protogen:"open.v1"`
// ClientParams holds parameters for the specific type of client trying to join.
ClientParams *ClientParams `protobuf:"bytes,1,opt,name=client_params,json=clientParams,proto3" json:"client_params,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *OracleInit) Reset() {
*x = OracleInit{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[17]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *OracleInit) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*OracleInit) ProtoMessage() {}
func (x *OracleInit) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[17]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use OracleInit.ProtoReflect.Descriptor instead.
func (*OracleInit) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{17}
}
func (x *OracleInit) GetClientParams() *ClientParams {
if x != nil {
return x.ClientParams
}
return nil
}
// OracleChallenge is sent from the server in response to the OracleInit message from the client.
// The client is expected to respond with a OracleChallengeSolution.
type OracleChallenge struct {
state protoimpl.MessageState `protogen:"open.v1"`
// Challenge is a a crypto-random string that should be included by the
// client in the OracleChallengeSolution message.
Challenge string `protobuf:"bytes,1,opt,name=challenge,proto3" json:"challenge,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *OracleChallenge) Reset() {
*x = OracleChallenge{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[18]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *OracleChallenge) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*OracleChallenge) ProtoMessage() {}
func (x *OracleChallenge) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[18]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use OracleChallenge.ProtoReflect.Descriptor instead.
func (*OracleChallenge) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{18}
}
func (x *OracleChallenge) GetChallenge() string {
if x != nil {
return x.Challenge
}
return ""
}
// OracleChallengeSolution must be sent from the client in response to the
// OracleChallenge message.
type OracleChallengeSolution struct {
state protoimpl.MessageState `protogen:"open.v1"`
// Cert is the OCI instance identity certificate, an X509 certificate in PEM format.
Cert []byte `protobuf:"bytes,1,opt,name=cert,proto3" json:"cert,omitempty"`
// Intermediate encodes the intermediate CAs that issued the instance
// identity certificate, in PEM format.
Intermediate []byte `protobuf:"bytes,2,opt,name=intermediate,proto3" json:"intermediate,omitempty"`
// Signature is a signature over the challenge, signed by the private key
// matching the instance identity certificate.
Signature []byte `protobuf:"bytes,3,opt,name=signature,proto3" json:"signature,omitempty"`
// SignedRootCaReq is a signed request to the Oracle API for retreiving the
// root CAs that issued the instance identity certificate.
SignedRootCaReq []byte `protobuf:"bytes,4,opt,name=signed_root_ca_req,json=signedRootCaReq,proto3" json:"signed_root_ca_req,omitempty"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
}
func (x *OracleChallengeSolution) Reset() {
*x = OracleChallengeSolution{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[19]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
func (x *OracleChallengeSolution) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*OracleChallengeSolution) ProtoMessage() {}
func (x *OracleChallengeSolution) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[19]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use OracleChallengeSolution.ProtoReflect.Descriptor instead.
func (*OracleChallengeSolution) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{19}
}
func (x *OracleChallengeSolution) GetCert() []byte {
if x != nil {
return x.Cert
}
return nil
}
func (x *OracleChallengeSolution) GetIntermediate() []byte {
if x != nil {
return x.Intermediate
}
return nil
}
func (x *OracleChallengeSolution) GetSignature() []byte {
if x != nil {
return x.Signature
}
return nil
}
func (x *OracleChallengeSolution) GetSignedRootCaReq() []byte {
if x != nil {
return x.SignedRootCaReq
}
return nil
}
// ChallengeSolution holds a solution to a challenge issued by the server.
type ChallengeSolution struct {
state protoimpl.MessageState `protogen:"open.v1"`
@@ -1145,6 +1325,7 @@ type ChallengeSolution struct {
// *ChallengeSolution_BoundKeypairChallengeSolution
// *ChallengeSolution_BoundKeypairRotationResponse
// *ChallengeSolution_IamChallengeSolution
// *ChallengeSolution_OracleChallengeSolution
Payload isChallengeSolution_Payload `protobuf_oneof:"payload"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
@@ -1152,7 +1333,7 @@ type ChallengeSolution struct {
func (x *ChallengeSolution) Reset() {
*x = ChallengeSolution{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[17]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[20]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1164,7 +1345,7 @@ func (x *ChallengeSolution) String() string {
func (*ChallengeSolution) ProtoMessage() {}
func (x *ChallengeSolution) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[17]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[20]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1177,7 +1358,7 @@ func (x *ChallengeSolution) ProtoReflect() protoreflect.Message {
// Deprecated: Use ChallengeSolution.ProtoReflect.Descriptor instead.
func (*ChallengeSolution) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{17}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{20}
}
func (x *ChallengeSolution) GetPayload() isChallengeSolution_Payload {
@@ -1214,6 +1395,15 @@ func (x *ChallengeSolution) GetIamChallengeSolution() *IAMChallengeSolution {
return nil
}
func (x *ChallengeSolution) GetOracleChallengeSolution() *OracleChallengeSolution {
if x != nil {
if x, ok := x.Payload.(*ChallengeSolution_OracleChallengeSolution); ok {
return x.OracleChallengeSolution
}
}
return nil
}
type isChallengeSolution_Payload interface {
isChallengeSolution_Payload()
}
@@ -1230,12 +1420,18 @@ type ChallengeSolution_IamChallengeSolution struct {
IamChallengeSolution *IAMChallengeSolution `protobuf:"bytes,3,opt,name=iam_challenge_solution,json=iamChallengeSolution,proto3,oneof"`
}
type ChallengeSolution_OracleChallengeSolution struct {
OracleChallengeSolution *OracleChallengeSolution `protobuf:"bytes,4,opt,name=oracle_challenge_solution,json=oracleChallengeSolution,proto3,oneof"`
}
func (*ChallengeSolution_BoundKeypairChallengeSolution) isChallengeSolution_Payload() {}
func (*ChallengeSolution_BoundKeypairRotationResponse) isChallengeSolution_Payload() {}
func (*ChallengeSolution_IamChallengeSolution) isChallengeSolution_Payload() {}
func (*ChallengeSolution_OracleChallengeSolution) isChallengeSolution_Payload() {}
// GivingUp should be sent by clients that fail to complete the join flow so
// that the Auth service can log an informative error message.
type GivingUp struct {
@@ -1250,7 +1446,7 @@ type GivingUp struct {
func (x *GivingUp) Reset() {
*x = GivingUp{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[18]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[21]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1262,7 +1458,7 @@ func (x *GivingUp) String() string {
func (*GivingUp) ProtoMessage() {}
func (x *GivingUp) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[18]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[21]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1275,7 +1471,7 @@ func (x *GivingUp) ProtoReflect() protoreflect.Message {
// Deprecated: Use GivingUp.ProtoReflect.Descriptor instead.
func (*GivingUp) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{18}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{21}
}
func (x *GivingUp) GetReason() GivingUp_Reason {
@@ -1305,6 +1501,7 @@ type JoinRequest struct {
// *JoinRequest_GivingUp
// *JoinRequest_Ec2Init
// *JoinRequest_OidcInit
// *JoinRequest_OracleInit
Payload isJoinRequest_Payload `protobuf_oneof:"payload"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
@@ -1312,7 +1509,7 @@ type JoinRequest struct {
func (x *JoinRequest) Reset() {
*x = JoinRequest{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[19]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[22]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1324,7 +1521,7 @@ func (x *JoinRequest) String() string {
func (*JoinRequest) ProtoMessage() {}
func (x *JoinRequest) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[19]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[22]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1337,7 +1534,7 @@ func (x *JoinRequest) ProtoReflect() protoreflect.Message {
// Deprecated: Use JoinRequest.ProtoReflect.Descriptor instead.
func (*JoinRequest) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{19}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{22}
}
func (x *JoinRequest) GetPayload() isJoinRequest_Payload {
@@ -1419,6 +1616,15 @@ func (x *JoinRequest) GetOidcInit() *OIDCInit {
return nil
}
func (x *JoinRequest) GetOracleInit() *OracleInit {
if x != nil {
if x, ok := x.Payload.(*JoinRequest_OracleInit); ok {
return x.OracleInit
}
}
return nil
}
type isJoinRequest_Payload interface {
isJoinRequest_Payload()
}
@@ -1455,6 +1661,10 @@ type JoinRequest_OidcInit struct {
OidcInit *OIDCInit `protobuf:"bytes,8,opt,name=oidc_init,json=oidcInit,proto3,oneof"`
}
type JoinRequest_OracleInit struct {
OracleInit *OracleInit `protobuf:"bytes,9,opt,name=oracle_init,json=oracleInit,proto3,oneof"`
}
func (*JoinRequest_ClientInit) isJoinRequest_Payload() {}
func (*JoinRequest_TokenInit) isJoinRequest_Payload() {}
@@ -1471,6 +1681,8 @@ func (*JoinRequest_Ec2Init) isJoinRequest_Payload() {}
func (*JoinRequest_OidcInit) isJoinRequest_Payload() {}
func (*JoinRequest_OracleInit) isJoinRequest_Payload() {}
// ServerInit is the first message sent from the server in response to the
// ClientInit message.
type ServerInit struct {
@@ -1486,7 +1698,7 @@ type ServerInit struct {
func (x *ServerInit) Reset() {
*x = ServerInit{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[20]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[23]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1498,7 +1710,7 @@ func (x *ServerInit) String() string {
func (*ServerInit) ProtoMessage() {}
func (x *ServerInit) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[20]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[23]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1511,7 +1723,7 @@ func (x *ServerInit) ProtoReflect() protoreflect.Message {
// Deprecated: Use ServerInit.ProtoReflect.Descriptor instead.
func (*ServerInit) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{20}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{23}
}
func (x *ServerInit) GetJoinMethod() string {
@@ -1536,6 +1748,7 @@ type Challenge struct {
// *Challenge_BoundKeypairChallenge
// *Challenge_BoundKeypairRotationRequest
// *Challenge_IamChallenge
// *Challenge_OracleChallenge
Payload isChallenge_Payload `protobuf_oneof:"payload"`
unknownFields protoimpl.UnknownFields
sizeCache protoimpl.SizeCache
@@ -1543,7 +1756,7 @@ type Challenge struct {
func (x *Challenge) Reset() {
*x = Challenge{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[21]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[24]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1555,7 +1768,7 @@ func (x *Challenge) String() string {
func (*Challenge) ProtoMessage() {}
func (x *Challenge) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[21]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[24]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1568,7 +1781,7 @@ func (x *Challenge) ProtoReflect() protoreflect.Message {
// Deprecated: Use Challenge.ProtoReflect.Descriptor instead.
func (*Challenge) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{21}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{24}
}
func (x *Challenge) GetPayload() isChallenge_Payload {
@@ -1605,6 +1818,15 @@ func (x *Challenge) GetIamChallenge() *IAMChallenge {
return nil
}
func (x *Challenge) GetOracleChallenge() *OracleChallenge {
if x != nil {
if x, ok := x.Payload.(*Challenge_OracleChallenge); ok {
return x.OracleChallenge
}
}
return nil
}
type isChallenge_Payload interface {
isChallenge_Payload()
}
@@ -1621,12 +1843,18 @@ type Challenge_IamChallenge struct {
IamChallenge *IAMChallenge `protobuf:"bytes,3,opt,name=iam_challenge,json=iamChallenge,proto3,oneof"`
}
type Challenge_OracleChallenge struct {
OracleChallenge *OracleChallenge `protobuf:"bytes,4,opt,name=oracle_challenge,json=oracleChallenge,proto3,oneof"`
}
func (*Challenge_BoundKeypairChallenge) isChallenge_Payload() {}
func (*Challenge_BoundKeypairRotationRequest) isChallenge_Payload() {}
func (*Challenge_IamChallenge) isChallenge_Payload() {}
func (*Challenge_OracleChallenge) isChallenge_Payload() {}
// Result is the final message sent from the cluster back to the client, it
// contains the result of the joining process including the assigned host ID
// and issued certificates.
@@ -1643,7 +1871,7 @@ type Result struct {
func (x *Result) Reset() {
*x = Result{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[22]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[25]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1655,7 +1883,7 @@ func (x *Result) String() string {
func (*Result) ProtoMessage() {}
func (x *Result) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[22]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[25]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1668,7 +1896,7 @@ func (x *Result) ProtoReflect() protoreflect.Message {
// Deprecated: Use Result.ProtoReflect.Descriptor instead.
func (*Result) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{22}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{25}
}
func (x *Result) GetPayload() isResult_Payload {
@@ -1731,7 +1959,7 @@ type Certificates struct {
func (x *Certificates) Reset() {
*x = Certificates{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[23]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[26]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1743,7 +1971,7 @@ func (x *Certificates) String() string {
func (*Certificates) ProtoMessage() {}
func (x *Certificates) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[23]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[26]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1756,7 +1984,7 @@ func (x *Certificates) ProtoReflect() protoreflect.Message {
// Deprecated: Use Certificates.ProtoReflect.Descriptor instead.
func (*Certificates) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{23}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{26}
}
func (x *Certificates) GetTlsCert() []byte {
@@ -1800,7 +2028,7 @@ type HostResult struct {
func (x *HostResult) Reset() {
*x = HostResult{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[24]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[27]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1812,7 +2040,7 @@ func (x *HostResult) String() string {
func (*HostResult) ProtoMessage() {}
func (x *HostResult) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[24]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[27]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1825,7 +2053,7 @@ func (x *HostResult) ProtoReflect() protoreflect.Message {
// Deprecated: Use HostResult.ProtoReflect.Descriptor instead.
func (*HostResult) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{24}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{27}
}
func (x *HostResult) GetCertificates() *Certificates {
@@ -1855,7 +2083,7 @@ type BotResult struct {
func (x *BotResult) Reset() {
*x = BotResult{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[25]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[28]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1867,7 +2095,7 @@ func (x *BotResult) String() string {
func (*BotResult) ProtoMessage() {}
func (x *BotResult) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[25]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[28]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1880,7 +2108,7 @@ func (x *BotResult) ProtoReflect() protoreflect.Message {
// Deprecated: Use BotResult.ProtoReflect.Descriptor instead.
func (*BotResult) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{25}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{28}
}
func (x *BotResult) GetCertificates() *Certificates {
@@ -1912,7 +2140,7 @@ type JoinResponse struct {
func (x *JoinResponse) Reset() {
*x = JoinResponse{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[26]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[29]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -1924,7 +2152,7 @@ func (x *JoinResponse) String() string {
func (*JoinResponse) ProtoMessage() {}
func (x *JoinResponse) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[26]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[29]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -1937,7 +2165,7 @@ func (x *JoinResponse) ProtoReflect() protoreflect.Message {
// Deprecated: Use JoinResponse.ProtoReflect.Descriptor instead.
func (*JoinResponse) Descriptor() ([]byte, []int) {
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{26}
return file_teleport_join_v1_joinservice_proto_rawDescGZIP(), []int{29}
}
func (x *JoinResponse) GetPayload() isJoinResponse_Payload {
@@ -2020,7 +2248,7 @@ type ClientInit_ProxySuppliedParams struct {
func (x *ClientInit_ProxySuppliedParams) Reset() {
*x = ClientInit_ProxySuppliedParams{}
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[27]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[30]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
@@ -2032,7 +2260,7 @@ func (x *ClientInit_ProxySuppliedParams) String() string {
func (*ClientInit_ProxySuppliedParams) ProtoMessage() {}
func (x *ClientInit_ProxySuppliedParams) ProtoReflect() protoreflect.Message {
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[27]
mi := &file_teleport_join_v1_joinservice_proto_msgTypes[30]
if x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
@@ -2139,11 +2367,22 @@ const file_teleport_join_v1_joinservice_proto_rawDesc = "" +
"\x14sts_identity_request\x18\x01 \x01(\fR\x12stsIdentityRequest\"j\n" +
"\aEC2Init\x12C\n" +
"\rclient_params\x18\x01 \x01(\v2\x1e.teleport.join.v1.ClientParamsR\fclientParams\x12\x1a\n" +
"\bdocument\x18\x02 \x01(\fR\bdocument\"\xf3\x02\n" +
"\bdocument\x18\x02 \x01(\fR\bdocument\"Q\n" +
"\n" +
"OracleInit\x12C\n" +
"\rclient_params\x18\x01 \x01(\v2\x1e.teleport.join.v1.ClientParamsR\fclientParams\"/\n" +
"\x0fOracleChallenge\x12\x1c\n" +
"\tchallenge\x18\x01 \x01(\tR\tchallenge\"\x9c\x01\n" +
"\x17OracleChallengeSolution\x12\x12\n" +
"\x04cert\x18\x01 \x01(\fR\x04cert\x12\"\n" +
"\fintermediate\x18\x02 \x01(\fR\fintermediate\x12\x1c\n" +
"\tsignature\x18\x03 \x01(\fR\tsignature\x12+\n" +
"\x12signed_root_ca_req\x18\x04 \x01(\fR\x0fsignedRootCaReq\"\xdc\x03\n" +
"\x11ChallengeSolution\x12z\n" +
" bound_keypair_challenge_solution\x18\x01 \x01(\v2/.teleport.join.v1.BoundKeypairChallengeSolutionH\x00R\x1dboundKeypairChallengeSolution\x12w\n" +
"\x1fbound_keypair_rotation_response\x18\x02 \x01(\v2..teleport.join.v1.BoundKeypairRotationResponseH\x00R\x1cboundKeypairRotationResponse\x12^\n" +
"\x16iam_challenge_solution\x18\x03 \x01(\v2&.teleport.join.v1.IAMChallengeSolutionH\x00R\x14iamChallengeSolutionB\t\n" +
"\x16iam_challenge_solution\x18\x03 \x01(\v2&.teleport.join.v1.IAMChallengeSolutionH\x00R\x14iamChallengeSolution\x12g\n" +
"\x19oracle_challenge_solution\x18\x04 \x01(\v2).teleport.join.v1.OracleChallengeSolutionH\x00R\x17oracleChallengeSolutionB\t\n" +
"\apayload\"\xe9\x01\n" +
"\bGivingUp\x129\n" +
"\x06reason\x18\x01 \x01(\x0e2!.teleport.join.v1.GivingUp.ReasonR\x06reason\x12\x10\n" +
@@ -2152,7 +2391,7 @@ const file_teleport_join_v1_joinservice_proto_rawDesc = "" +
"\x12REASON_UNSPECIFIED\x10\x00\x12\"\n" +
"\x1eREASON_UNSUPPORTED_JOIN_METHOD\x10\x01\x12#\n" +
"\x1fREASON_UNSUPPORTED_MESSAGE_TYPE\x10\x02\x12$\n" +
" REASON_CHALLENGE_SOLUTION_FAILED\x10\x03\"\x94\x04\n" +
" REASON_CHALLENGE_SOLUTION_FAILED\x10\x03\"\xd5\x04\n" +
"\vJoinRequest\x12?\n" +
"\vclient_init\x18\x01 \x01(\v2\x1c.teleport.join.v1.ClientInitH\x00R\n" +
"clientInit\x12<\n" +
@@ -2163,17 +2402,20 @@ const file_teleport_join_v1_joinservice_proto_rawDesc = "" +
"\biam_init\x18\x05 \x01(\v2\x19.teleport.join.v1.IAMInitH\x00R\aiamInit\x129\n" +
"\tgiving_up\x18\x06 \x01(\v2\x1a.teleport.join.v1.GivingUpH\x00R\bgivingUp\x126\n" +
"\bec2_init\x18\a \x01(\v2\x19.teleport.join.v1.EC2InitH\x00R\aec2Init\x129\n" +
"\toidc_init\x18\b \x01(\v2\x1a.teleport.join.v1.OIDCInitH\x00R\boidcInitB\t\n" +
"\toidc_init\x18\b \x01(\v2\x1a.teleport.join.v1.OIDCInitH\x00R\boidcInit\x12?\n" +
"\voracle_init\x18\t \x01(\v2\x1c.teleport.join.v1.OracleInitH\x00R\n" +
"oracleInitB\t\n" +
"\apayload\"i\n" +
"\n" +
"ServerInit\x12\x1f\n" +
"\vjoin_method\x18\x01 \x01(\tR\n" +
"joinMethod\x12:\n" +
"\x19signature_algorithm_suite\x18\x02 \x01(\tR\x17signatureAlgorithmSuite\"\xb6\x02\n" +
"\x19signature_algorithm_suite\x18\x02 \x01(\tR\x17signatureAlgorithmSuite\"\x86\x03\n" +
"\tChallenge\x12a\n" +
"\x17bound_keypair_challenge\x18\x01 \x01(\v2'.teleport.join.v1.BoundKeypairChallengeH\x00R\x15boundKeypairChallenge\x12t\n" +
"\x1ebound_keypair_rotation_request\x18\x02 \x01(\v2-.teleport.join.v1.BoundKeypairRotationRequestH\x00R\x1bboundKeypairRotationRequest\x12E\n" +
"\riam_challenge\x18\x03 \x01(\v2\x1e.teleport.join.v1.IAMChallengeH\x00R\fiamChallengeB\t\n" +
"\riam_challenge\x18\x03 \x01(\v2\x1e.teleport.join.v1.IAMChallengeH\x00R\fiamChallenge\x12N\n" +
"\x10oracle_challenge\x18\x04 \x01(\v2!.teleport.join.v1.OracleChallengeH\x00R\x0foracleChallengeB\t\n" +
"\apayload\"\x92\x01\n" +
"\x06Result\x12?\n" +
"\vhost_result\x18\x01 \x01(\v2\x1c.teleport.join.v1.HostResultH\x00R\n" +
@@ -2216,7 +2458,7 @@ func file_teleport_join_v1_joinservice_proto_rawDescGZIP() []byte {
}
var file_teleport_join_v1_joinservice_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
var file_teleport_join_v1_joinservice_proto_msgTypes = make([]protoimpl.MessageInfo, 28)
var file_teleport_join_v1_joinservice_proto_msgTypes = make([]protoimpl.MessageInfo, 31)
var file_teleport_join_v1_joinservice_proto_goTypes = []any{
(GivingUp_Reason)(0), // 0: teleport.join.v1.GivingUp.Reason
(*ClientInit)(nil), // 1: teleport.join.v1.ClientInit
@@ -2236,24 +2478,27 @@ var file_teleport_join_v1_joinservice_proto_goTypes = []any{
(*IAMChallenge)(nil), // 15: teleport.join.v1.IAMChallenge
(*IAMChallengeSolution)(nil), // 16: teleport.join.v1.IAMChallengeSolution
(*EC2Init)(nil), // 17: teleport.join.v1.EC2Init
(*ChallengeSolution)(nil), // 18: teleport.join.v1.ChallengeSolution
(*GivingUp)(nil), // 19: teleport.join.v1.GivingUp
(*JoinRequest)(nil), // 20: teleport.join.v1.JoinRequest
(*ServerInit)(nil), // 21: teleport.join.v1.ServerInit
(*Challenge)(nil), // 22: teleport.join.v1.Challenge
(*Result)(nil), // 23: teleport.join.v1.Result
(*Certificates)(nil), // 24: teleport.join.v1.Certificates
(*HostResult)(nil), // 25: teleport.join.v1.HostResult
(*BotResult)(nil), // 26: teleport.join.v1.BotResult
(*JoinResponse)(nil), // 27: teleport.join.v1.JoinResponse
(*ClientInit_ProxySuppliedParams)(nil), // 28: teleport.join.v1.ClientInit.ProxySuppliedParams
(*timestamppb.Timestamp)(nil), // 29: google.protobuf.Timestamp
(*OracleInit)(nil), // 18: teleport.join.v1.OracleInit
(*OracleChallenge)(nil), // 19: teleport.join.v1.OracleChallenge
(*OracleChallengeSolution)(nil), // 20: teleport.join.v1.OracleChallengeSolution
(*ChallengeSolution)(nil), // 21: teleport.join.v1.ChallengeSolution
(*GivingUp)(nil), // 22: teleport.join.v1.GivingUp
(*JoinRequest)(nil), // 23: teleport.join.v1.JoinRequest
(*ServerInit)(nil), // 24: teleport.join.v1.ServerInit
(*Challenge)(nil), // 25: teleport.join.v1.Challenge
(*Result)(nil), // 26: teleport.join.v1.Result
(*Certificates)(nil), // 27: teleport.join.v1.Certificates
(*HostResult)(nil), // 28: teleport.join.v1.HostResult
(*BotResult)(nil), // 29: teleport.join.v1.BotResult
(*JoinResponse)(nil), // 30: teleport.join.v1.JoinResponse
(*ClientInit_ProxySuppliedParams)(nil), // 31: teleport.join.v1.ClientInit.ProxySuppliedParams
(*timestamppb.Timestamp)(nil), // 32: google.protobuf.Timestamp
}
var file_teleport_join_v1_joinservice_proto_depIdxs = []int32{
28, // 0: teleport.join.v1.ClientInit.proxy_supplied_parameters:type_name -> teleport.join.v1.ClientInit.ProxySuppliedParams
31, // 0: teleport.join.v1.ClientInit.proxy_supplied_parameters:type_name -> teleport.join.v1.ClientInit.ProxySuppliedParams
2, // 1: teleport.join.v1.HostParams.public_keys:type_name -> teleport.join.v1.PublicKeys
2, // 2: teleport.join.v1.BotParams.public_keys:type_name -> teleport.join.v1.PublicKeys
29, // 3: teleport.join.v1.BotParams.expires:type_name -> google.protobuf.Timestamp
32, // 3: teleport.join.v1.BotParams.expires:type_name -> google.protobuf.Timestamp
3, // 4: teleport.join.v1.ClientParams.host_params:type_name -> teleport.join.v1.HostParams
4, // 5: teleport.join.v1.ClientParams.bot_params:type_name -> teleport.join.v1.BotParams
5, // 6: teleport.join.v1.TokenInit.client_params:type_name -> teleport.join.v1.ClientParams
@@ -2261,36 +2506,40 @@ var file_teleport_join_v1_joinservice_proto_depIdxs = []int32{
5, // 8: teleport.join.v1.BoundKeypairInit.client_params:type_name -> teleport.join.v1.ClientParams
5, // 9: teleport.join.v1.IAMInit.client_params:type_name -> teleport.join.v1.ClientParams
5, // 10: teleport.join.v1.EC2Init.client_params:type_name -> teleport.join.v1.ClientParams
10, // 11: teleport.join.v1.ChallengeSolution.bound_keypair_challenge_solution:type_name -> teleport.join.v1.BoundKeypairChallengeSolution
12, // 12: teleport.join.v1.ChallengeSolution.bound_keypair_rotation_response:type_name -> teleport.join.v1.BoundKeypairRotationResponse
16, // 13: teleport.join.v1.ChallengeSolution.iam_challenge_solution:type_name -> teleport.join.v1.IAMChallengeSolution
0, // 14: teleport.join.v1.GivingUp.reason:type_name -> teleport.join.v1.GivingUp.Reason
1, // 15: teleport.join.v1.JoinRequest.client_init:type_name -> teleport.join.v1.ClientInit
6, // 16: teleport.join.v1.JoinRequest.token_init:type_name -> teleport.join.v1.TokenInit
8, // 17: teleport.join.v1.JoinRequest.bound_keypair_init:type_name -> teleport.join.v1.BoundKeypairInit
18, // 18: teleport.join.v1.JoinRequest.solution:type_name -> teleport.join.v1.ChallengeSolution
14, // 19: teleport.join.v1.JoinRequest.iam_init:type_name -> teleport.join.v1.IAMInit
19, // 20: teleport.join.v1.JoinRequest.giving_up:type_name -> teleport.join.v1.GivingUp
17, // 21: teleport.join.v1.JoinRequest.ec2_init:type_name -> teleport.join.v1.EC2Init
7, // 22: teleport.join.v1.JoinRequest.oidc_init:type_name -> teleport.join.v1.OIDCInit
9, // 23: teleport.join.v1.Challenge.bound_keypair_challenge:type_name -> teleport.join.v1.BoundKeypairChallenge
11, // 24: teleport.join.v1.Challenge.bound_keypair_rotation_request:type_name -> teleport.join.v1.BoundKeypairRotationRequest
15, // 25: teleport.join.v1.Challenge.iam_challenge:type_name -> teleport.join.v1.IAMChallenge
25, // 26: teleport.join.v1.Result.host_result:type_name -> teleport.join.v1.HostResult
26, // 27: teleport.join.v1.Result.bot_result:type_name -> teleport.join.v1.BotResult
24, // 28: teleport.join.v1.HostResult.certificates:type_name -> teleport.join.v1.Certificates
24, // 29: teleport.join.v1.BotResult.certificates:type_name -> teleport.join.v1.Certificates
13, // 30: teleport.join.v1.BotResult.bound_keypair_result:type_name -> teleport.join.v1.BoundKeypairResult
21, // 31: teleport.join.v1.JoinResponse.init:type_name -> teleport.join.v1.ServerInit
22, // 32: teleport.join.v1.JoinResponse.challenge:type_name -> teleport.join.v1.Challenge
23, // 33: teleport.join.v1.JoinResponse.result:type_name -> teleport.join.v1.Result
20, // 34: teleport.join.v1.JoinService.Join:input_type -> teleport.join.v1.JoinRequest
27, // 35: teleport.join.v1.JoinService.Join:output_type -> teleport.join.v1.JoinResponse
35, // [35:36] is the sub-list for method output_type
34, // [34:35] is the sub-list for method input_type
34, // [34:34] is the sub-list for extension type_name
34, // [34:34] is the sub-list for extension extendee
0, // [0:34] is the sub-list for field type_name
5, // 11: teleport.join.v1.OracleInit.client_params:type_name -> teleport.join.v1.ClientParams
10, // 12: teleport.join.v1.ChallengeSolution.bound_keypair_challenge_solution:type_name -> teleport.join.v1.BoundKeypairChallengeSolution
12, // 13: teleport.join.v1.ChallengeSolution.bound_keypair_rotation_response:type_name -> teleport.join.v1.BoundKeypairRotationResponse
16, // 14: teleport.join.v1.ChallengeSolution.iam_challenge_solution:type_name -> teleport.join.v1.IAMChallengeSolution
20, // 15: teleport.join.v1.ChallengeSolution.oracle_challenge_solution:type_name -> teleport.join.v1.OracleChallengeSolution
0, // 16: teleport.join.v1.GivingUp.reason:type_name -> teleport.join.v1.GivingUp.Reason
1, // 17: teleport.join.v1.JoinRequest.client_init:type_name -> teleport.join.v1.ClientInit
6, // 18: teleport.join.v1.JoinRequest.token_init:type_name -> teleport.join.v1.TokenInit
8, // 19: teleport.join.v1.JoinRequest.bound_keypair_init:type_name -> teleport.join.v1.BoundKeypairInit
21, // 20: teleport.join.v1.JoinRequest.solution:type_name -> teleport.join.v1.ChallengeSolution
14, // 21: teleport.join.v1.JoinRequest.iam_init:type_name -> teleport.join.v1.IAMInit
22, // 22: teleport.join.v1.JoinRequest.giving_up:type_name -> teleport.join.v1.GivingUp
17, // 23: teleport.join.v1.JoinRequest.ec2_init:type_name -> teleport.join.v1.EC2Init
7, // 24: teleport.join.v1.JoinRequest.oidc_init:type_name -> teleport.join.v1.OIDCInit
18, // 25: teleport.join.v1.JoinRequest.oracle_init:type_name -> teleport.join.v1.OracleInit
9, // 26: teleport.join.v1.Challenge.bound_keypair_challenge:type_name -> teleport.join.v1.BoundKeypairChallenge
11, // 27: teleport.join.v1.Challenge.bound_keypair_rotation_request:type_name -> teleport.join.v1.BoundKeypairRotationRequest
15, // 28: teleport.join.v1.Challenge.iam_challenge:type_name -> teleport.join.v1.IAMChallenge
19, // 29: teleport.join.v1.Challenge.oracle_challenge:type_name -> teleport.join.v1.OracleChallenge
28, // 30: teleport.join.v1.Result.host_result:type_name -> teleport.join.v1.HostResult
29, // 31: teleport.join.v1.Result.bot_result:type_name -> teleport.join.v1.BotResult
27, // 32: teleport.join.v1.HostResult.certificates:type_name -> teleport.join.v1.Certificates
27, // 33: teleport.join.v1.BotResult.certificates:type_name -> teleport.join.v1.Certificates
13, // 34: teleport.join.v1.BotResult.bound_keypair_result:type_name -> teleport.join.v1.BoundKeypairResult
24, // 35: teleport.join.v1.JoinResponse.init:type_name -> teleport.join.v1.ServerInit
25, // 36: teleport.join.v1.JoinResponse.challenge:type_name -> teleport.join.v1.Challenge
26, // 37: teleport.join.v1.JoinResponse.result:type_name -> teleport.join.v1.Result
23, // 38: teleport.join.v1.JoinService.Join:input_type -> teleport.join.v1.JoinRequest
30, // 39: teleport.join.v1.JoinService.Join:output_type -> teleport.join.v1.JoinResponse
39, // [39:40] is the sub-list for method output_type
38, // [38:39] is the sub-list for method input_type
38, // [38:38] is the sub-list for extension type_name
38, // [38:38] is the sub-list for extension extendee
0, // [0:38] is the sub-list for field type_name
}
func init() { file_teleport_join_v1_joinservice_proto_init() }
@@ -2304,12 +2553,13 @@ func file_teleport_join_v1_joinservice_proto_init() {
(*ClientParams_HostParams)(nil),
(*ClientParams_BotParams)(nil),
}
file_teleport_join_v1_joinservice_proto_msgTypes[17].OneofWrappers = []any{
file_teleport_join_v1_joinservice_proto_msgTypes[20].OneofWrappers = []any{
(*ChallengeSolution_BoundKeypairChallengeSolution)(nil),
(*ChallengeSolution_BoundKeypairRotationResponse)(nil),
(*ChallengeSolution_IamChallengeSolution)(nil),
(*ChallengeSolution_OracleChallengeSolution)(nil),
}
file_teleport_join_v1_joinservice_proto_msgTypes[19].OneofWrappers = []any{
file_teleport_join_v1_joinservice_proto_msgTypes[22].OneofWrappers = []any{
(*JoinRequest_ClientInit)(nil),
(*JoinRequest_TokenInit)(nil),
(*JoinRequest_BoundKeypairInit)(nil),
@@ -2318,18 +2568,20 @@ func file_teleport_join_v1_joinservice_proto_init() {
(*JoinRequest_GivingUp)(nil),
(*JoinRequest_Ec2Init)(nil),
(*JoinRequest_OidcInit)(nil),
(*JoinRequest_OracleInit)(nil),
}
file_teleport_join_v1_joinservice_proto_msgTypes[21].OneofWrappers = []any{
file_teleport_join_v1_joinservice_proto_msgTypes[24].OneofWrappers = []any{
(*Challenge_BoundKeypairChallenge)(nil),
(*Challenge_BoundKeypairRotationRequest)(nil),
(*Challenge_IamChallenge)(nil),
(*Challenge_OracleChallenge)(nil),
}
file_teleport_join_v1_joinservice_proto_msgTypes[22].OneofWrappers = []any{
file_teleport_join_v1_joinservice_proto_msgTypes[25].OneofWrappers = []any{
(*Result_HostResult)(nil),
(*Result_BotResult)(nil),
}
file_teleport_join_v1_joinservice_proto_msgTypes[25].OneofWrappers = []any{}
file_teleport_join_v1_joinservice_proto_msgTypes[26].OneofWrappers = []any{
file_teleport_join_v1_joinservice_proto_msgTypes[28].OneofWrappers = []any{}
file_teleport_join_v1_joinservice_proto_msgTypes[29].OneofWrappers = []any{
(*JoinResponse_Init)(nil),
(*JoinResponse_Challenge)(nil),
(*JoinResponse_Result)(nil),
@@ -2340,7 +2592,7 @@ func file_teleport_join_v1_joinservice_proto_init() {
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
RawDescriptor: unsafe.Slice(unsafe.StringData(file_teleport_join_v1_joinservice_proto_rawDesc), len(file_teleport_join_v1_joinservice_proto_rawDesc)),
NumEnums: 1,
NumMessages: 28,
NumMessages: 31,
NumExtensions: 0,
NumServices: 1,
},
api/proto/teleport/join/v1/joinservice.proto
+42
View File
@@ -252,12 +252,52 @@ message EC2Init {
bytes document = 2;
}
// OracleInit is sent from the client in response to the ServerInit message for
// the Oracle join method.
//
// The Oracle method join flow is:
// 1. client->server: ClientInit
// 2. client<-server: ServerInit
// 3. client->server: OracleInit
// 4. client<-server: OracleChallenge
// 5. client->server: OracleChallengeSolution
// 6. client<-server: Result
message OracleInit {
// ClientParams holds parameters for the specific type of client trying to join.
ClientParams client_params = 1;
}
// OracleChallenge is sent from the server in response to the OracleInit message from the client.
// The client is expected to respond with a OracleChallengeSolution.
message OracleChallenge {
// Challenge is a a crypto-random string that should be included by the
// client in the OracleChallengeSolution message.
string challenge = 1;
}
// OracleChallengeSolution must be sent from the client in response to the
// OracleChallenge message.
message OracleChallengeSolution {
// Cert is the OCI instance identity certificate, an X509 certificate in PEM format.
bytes cert = 1;
// Intermediate encodes the intermediate CAs that issued the instance
// identity certificate, in PEM format.
bytes intermediate = 2;
// Signature is a signature over the challenge, signed by the private key
// matching the instance identity certificate.
bytes signature = 3;
// SignedRootCaReq is a signed request to the Oracle API for retreiving the
// root CAs that issued the instance identity certificate.
bytes signed_root_ca_req = 4;
}
// ChallengeSolution holds a solution to a challenge issued by the server.
message ChallengeSolution {
oneof payload {
BoundKeypairChallengeSolution bound_keypair_challenge_solution = 1;
BoundKeypairRotationResponse bound_keypair_rotation_response = 2;
IAMChallengeSolution iam_challenge_solution = 3;
OracleChallengeSolution oracle_challenge_solution = 4;
}
}
@@ -295,6 +335,7 @@ message JoinRequest {
GivingUp giving_up = 6;
EC2Init ec2_init = 7;
OIDCInit oidc_init = 8;
OracleInit oracle_init = 9;
}
}
@@ -314,6 +355,7 @@ message Challenge {
BoundKeypairChallenge bound_keypair_challenge = 1;
BoundKeypairRotationRequest bound_keypair_rotation_request = 2;
IAMChallenge iam_challenge = 3;
OracleChallenge oracle_challenge = 4;
}
}
lib/join/internal/messages/messages.go
+45
View File
@@ -358,6 +358,51 @@ type EC2Init struct {
Document []byte
}
// OracleInit is sent from the client in response to the ServerInit message for
// the Oracle join method.
//
// The Oracle method join flow is:
// 1. client->server: ClientInit
// 2. client<-server: ServerInit
// 3. client->server: OracleInit
// 4. client<-server: OracleChallenge
// 5. client->server: OracleChallengeSolution
// 6. client<-server: Result
type OracleInit struct {
embedRequest
// ClientParams holds parameters for the specific type of client trying to join.
ClientParams ClientParams
}
// OracleChallenge is from the server in response to the OracleInit message from the client.
// The client is expected to respond with a OracleChallengeSolution.
type OracleChallenge struct {
embedResponse
// Challenge is a a crypto-random string that should be signed by the
// client and included in the OracleChallengeSolution message.
Challenge string
}
// OracleChallengeSolution must be sent from the client in response to the
// OracleChallenge message.
type OracleChallengeSolution struct {
embedRequest
// Cert is the OCI instance identity certificate, an X509 certificate in PEM format.
Cert []byte
// Intermediate encodes the intermediate CAs that issued the instance
// identity certificate, in PEM format.
Intermediate []byte
// Signature is a signature over the challenge, signed by the private key
// matching the instance identity certificate.
Signature []byte
// SignedRootCaReq is a signed request to the Oracle API for retreiving the
// root CAs that issued the instance identity certificate.
SignedRootCAReq []byte
}
// Response is implemented by all join response messages.
type Response interface {
isResponse()
lib/join/joinv1/messages.go
+32 -2
View File
@@ -40,6 +40,8 @@ func requestToMessage(req *joinv1.JoinRequest) (messages.Request, error) {
return ec2InitToMessage(msg.Ec2Init)
case *joinv1.JoinRequest_OidcInit:
return oidcInitToMessage(msg.OidcInit)
case *joinv1.JoinRequest_OracleInit:
return oracleInitToMessage(msg.OracleInit)
case *joinv1.JoinRequest_Solution:
return challengeSolutionToMessage(msg.Solution)
case *joinv1.JoinRequest_GivingUp:
@@ -109,9 +111,20 @@ func requestFromMessage(msg messages.Request) (*joinv1.JoinRequest, error) {
OidcInit: oidcInit,
},
}, nil
case *messages.OracleInit:
oracleInit, err := oracleInitFromMessage(typedMsg)
if err != nil {
return nil, trace.Wrap(err)
}
return &joinv1.JoinRequest{
Payload: &joinv1.JoinRequest_OracleInit{
OracleInit: oracleInit,
},
}, nil
case *messages.BoundKeypairChallengeSolution,
*messages.BoundKeypairRotationResponse,
*messages.IAMChallengeSolution:
*messages.IAMChallengeSolution,
*messages.OracleChallengeSolution:
solution, err := challengeSolutionFromMessage(typedMsg)
if err != nil {
return nil, trace.Wrap(err)
@@ -275,6 +288,8 @@ func challengeSolutionToMessage(req *joinv1.ChallengeSolution) (messages.Request
return boundKeypairRotationResponseToMessage(payload.BoundKeypairRotationResponse), nil
case *joinv1.ChallengeSolution_IamChallengeSolution:
return iamChallengeSolutionToMessage(payload.IamChallengeSolution), nil
case *joinv1.ChallengeSolution_OracleChallengeSolution:
return oracleChallengeSolutionToMessage(payload.OracleChallengeSolution), nil
default:
return nil, trace.BadParameter("unrecognized challenge solution message type %T", payload)
}
@@ -300,6 +315,12 @@ func challengeSolutionFromMessage(msg messages.Request) (*joinv1.ChallengeSoluti
IamChallengeSolution: iamChallengeSolutionFromMessage(typedMsg),
},
}, nil
case *messages.OracleChallengeSolution:
return &joinv1.ChallengeSolution{
Payload: &joinv1.ChallengeSolution_OracleChallengeSolution{
OracleChallengeSolution: oracleChallengeSolutionFromMessage(typedMsg),
},
}, nil
default:
return nil, trace.BadParameter("unrecognized challenge solution message type %T", msg)
}
@@ -331,7 +352,8 @@ func responseFromMessage(msg messages.Response) (*joinv1.JoinResponse, error) {
}, nil
case *messages.BoundKeypairChallenge,
*messages.BoundKeypairRotationRequest,
*messages.IAMChallenge:
*messages.IAMChallenge,
*messages.OracleChallenge:
challenge, err := challengeFromMessage(msg)
if err != nil {
return nil, trace.Wrap(err)
@@ -392,6 +414,8 @@ func challengeToMessage(resp *joinv1.Challenge) (messages.Response, error) {
return boundKeypairRotationRequestToMessage(payload.BoundKeypairRotationRequest), nil
case *joinv1.Challenge_IamChallenge:
return iamChallengeToMessage(payload.IamChallenge), nil
case *joinv1.Challenge_OracleChallenge:
return oracleChallengeToMessage(payload.OracleChallenge), nil
default:
return nil, trace.BadParameter("unrecognized challenge payload type %T", payload)
}
@@ -417,6 +441,12 @@ func challengeFromMessage(resp messages.Response) (*joinv1.Challenge, error) {
IamChallenge: iamChallengeFromMessage(msg),
},
}, nil
case *messages.OracleChallenge:
return &joinv1.Challenge{
Payload: &joinv1.Challenge_OracleChallenge{
OracleChallenge: oracleChallengeFromMessage(msg),
},
}, nil
default:
return nil, trace.BadParameter("unrecognized challenge message type %T", msg)
}
lib/join/joinv1/messages_oracle.go
+74
View File
@@ -0,0 +1,74 @@
// Teleport
// Copyright (C) 2025 Gravitational, Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see <http://www.gnu.org/licenses/>.
package joinv1
import (
"github.com/gravitational/trace"
joinv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/join/v1"
"github.com/gravitational/teleport/lib/join/internal/messages"
)
func oracleInitToMessage(req *joinv1.OracleInit) (*messages.OracleInit, error) {
clientParams, err := clientParamsToMessage(req.ClientParams)
if err != nil {
return nil, trace.Wrap(err)
}
return &messages.OracleInit{
ClientParams: clientParams,
}, nil
}
func oracleInitFromMessage(msg *messages.OracleInit) (*joinv1.OracleInit, error) {
clientParams, err := clientParamsFromMessage(msg.ClientParams)
if err != nil {
return nil, trace.Wrap(err)
}
return &joinv1.OracleInit{
ClientParams: clientParams,
}, nil
}
func oracleChallengeToMessage(req *joinv1.OracleChallenge) *messages.OracleChallenge {
return &messages.OracleChallenge{
Challenge: req.Challenge,
}
}
func oracleChallengeFromMessage(msg *messages.OracleChallenge) *joinv1.OracleChallenge {
return &joinv1.OracleChallenge{
Challenge: msg.Challenge,
}
}
func oracleChallengeSolutionToMessage(req *joinv1.OracleChallengeSolution) *messages.OracleChallengeSolution {
return &messages.OracleChallengeSolution{
Cert: req.Cert,
Intermediate: req.Intermediate,
Signature: req.Signature,
SignedRootCAReq: req.SignedRootCaReq,
}
}
func oracleChallengeSolutionFromMessage(msg *messages.OracleChallengeSolution) *joinv1.OracleChallengeSolution {
return &joinv1.OracleChallengeSolution{
Cert: msg.Cert,
Intermediate: msg.Intermediate,
Signature: msg.Signature,
SignedRootCaReq: msg.SignedRootCAReq,
}
}