* Add ui interaction event protos
* make grpc
* Add userEventService method
* Fix signature
* Fix username field
it would have been logging the hash of ""
* Migrate from mfa v1 to v2.
Signed-off-by: Chris Thach <[email protected]>
* Set deprecated proto option and update migration comment.
Signed-off-by: Chris Thach <[email protected]>
* Reduce nolint directives.
Signed-off-by: Chris Thach <[email protected]>
* Tag Ryan for the Desktop TODO.
---------
Signed-off-by: Chris Thach <[email protected]>
* Change 'EndOfFile' property to int64 from uint32
* Plumb the new int64 'EndOfFile' field through the rest of the backend and client
* Switch 'size' field of truncate requests to uint64 instead of int64
* Update everything downstream of the new uint64 'size' field
* Update lib/srv/desktop/tdp/protocol/tdpb/translate.go
Co-authored-by: Przemko Robakowski <[email protected]>
---------
Co-authored-by: Przemko Robakowski <[email protected]>
* feat: added vnet support for database
* feat: handling some edge cases with db key
* minor improvements and tests
* feat: improve database certificate reissuance and enhance error handling in notifications
* splitting out teleport connect changes to separate pr
* refactor for DRY
* feat: added enforcement to get db-user from wire protocol for supported group of dbs
* added tests
* feat: added vnet filter logic to filter on vnet dns hash from status
* chore: removed db username as not supporting it now
* chore: added protocol validation
* chore: updating on pr comments
* chore: streamline fqdn resoluiont for db and better logging on db name conflict
* chore: simplify db resolution logic by handling multiple matches
Adds a `SearchMode` enum to session search protos, allowing clients to choose the search mode that best fits their keywords.
Some searches perform better with embeddings only, while others work better with strict keyword matching. This change lets clients opt into their preferred search method, while keeping hybrid search as the default.
Signed-off-by: Tiago Silva <[email protected]>
Teleport Auth server allows clients that do not present a certificate to access parts of its API. This deliberate bypass exists to support joining methods or password logins where a user or server does not have a certificate yet but has a secret that can be exchanged for a certificate.
In order to keep the system compatible and reduce the permutations required, Teleport assigned these unauthenticated connections a role called `Nop`. This role has no permissions and the only reason why it exists is so we can still build a context and checker.
This role was historically embedded in a structure called `BuiltinRole`. This struct implements the `Identity` interface and by its documentation is used by teleport services that belong to this particular cluster.
Some of the Auth server handlers are restricted to server identities and the check consists in something like:
```go
authCtx, err := s.authorizer.Authorize(ctx)
if err != nil {
return nil, trace.Wrap(err)
}
if b, ok := authCtx.Identity.(authz.BuiltinRole); !ok || !b.IsServer() {
return nil, trace.AccessDenied("only server identities can verify validated MFA challenges")
}
```
As seen above, part of the verification consists in type asserting the `authCtx.Identity` to confirm it belongs to a local server and then we check if the role belongs to an actual server.
In our codebase, we have a function called `IsLocalOrRemoteService` with the following body:
```go
// IsLocalOrRemoteService checks if the identity is either a local or remote service.
func IsLocalOrRemoteService(authContext Context) bool {
switch authContext.UnmappedIdentity.(type) {
case BuiltinRole, RemoteBuiltinRole:
return true
default:
return false
}
}
```
Given that unauthenticated users were wrapped in `BuiltinRole`, this function would return true for them. This caused the encrypted recordings service to authorize unauthenticated clients to access the upload handlers. This was the only access check applied, so the bug allowed any client to upload and replace files in the backend storage.
This change fixes that by enforcing proper RBAC checks in the encrypted recordings `CreateUpload`, `UploadPart` and `CompleteUpload` handlers. It also forbids `RemoteBuiltinRole` (remote/leaf cluster identity) from uploading files to root clusters.
This change also moves RoleNop out of the `SystemRole` type and into a new distinct type, `UnauthenticatedRole`, so the compiler prevents it from being used anywhere a real authenticated system role is expected. As a defence-in-depth measure, the middleware now rejects any TLS certificate that claims the Nop role in its Groups or SystemRoles fields.
This PR fixes a separate issue on top of the existing one where certificate rotation of encrypted sessions was available to unauthenticated users.
The protection introduced was `authCtx.AuthorizeAdminAction()`, which verifies if someone has completed the MFA challenge (if required). That was the intended idea, but given how Teleport handles unauthenticated users, they were marked with AdminActionAuthNotRequired, which bypassed MFA checks. Because of that, any client - authenticated or unauthenticated - with the ability to complete the MFA challenge (or if MFA was not required) could rotate the encryption keys for session recordings.
This doesn't significantly affect Teleport since the private keys are never exposed externally and previous keys always remain in the backend object, allowing old recordings to still be decrypted. The main concern is if the keys were rotated so many times that the backend item size exceeds the 400KB limit on DynamoDB. While this would cause the rotation to fail beforehand, it would also prevent any further rotations from succeeding.
This PR introduces proper RBAC for modifying types.KindRecordingEncryption and ensures that unauthenticated users are always assigned AdminActionAuthNotRequired.
Fixes https://github.com/gravitational/teleport-private/issues/2430
Fixes https://github.com/gravitational/teleport-private/issues/2429
Signed-off-by: Tiago Silva <[email protected]>
* sessionsearch[13]: Add telemetry for session summary searches with filters
This adds session summary search events to Prehog and extends the
aggregated user activity report to capture both total search query
counts and how many of those queries were submitted with filters. It
also wires the new fields through anonymization, aggregation, generated
protobufs, and the related tests.
Signed-off-by: Tiago Silva <[email protected]>
* handle review feedback
---------
Signed-off-by: Tiago Silva <[email protected]>
* Add support for removing shared directories to Windows Desktop Service (TDPB only)
* Advertise support for shared directory removal
* Gracefully handle unknown device errors when removing RDPDR devices, but log a warning as this is probably caused by a bug.
Adds two proto files that together define the session summary search
feature.
proto/accessgraph/v1/session_search.proto — internal, Auth->Access Graph
Used exclusively by the Auth server. Defines SessionRecordingService
with two RPCs:
- SearchSessionSummaries: a bidirectional streaming RPC the Auth
server uses to paginate through session summaries stored in the
Access Graph. The Auth server sends search_params on the first
message, receives batches of SessionSummary results each
terminated by a PageComplete, and sends FetchMore to advance pages.
Each SessionSummary includes session_end_event — the raw audit
event the Auth server evaluates against the requesting user's RBAC
permissions before deciding whether to forward the result to client.
- StoreSessionSummary: used by the summarizer pipeline to persist
session summaries and their vector embeddings to the Access Graph.
api/proto/teleport/sessionsearch/v1/session_search.proto — public, Client->Auth
Used by Teleport clients (tsh, web UI handler, etc.). Defines
SessionSearchService.SearchSessionSummaries as a unary-request /
server-streaming RPC. The Auth server implements this service: it
receives the client's filter criteria, fans out to the Access Graph
via the internal bidi stream above (handling all pagination
internally), filters each result using session_end_event, and streams
only the permitted SessionSummary results back. Clients see a single
continuous stream with no pagination mechanics exposed to them.
Signed-off-by: Tiago Silva <[email protected]>
Adds cache support for all summarizer resources (InferenceModel,
InferenceSecret, InferencePolicy, and RetrievalModel) by implementing
event parsers, cache collections, and read-through methods.
Part of https://github.com/gravitational/teleport.e/pull/8046
Signed-off-by: Tiago Silva <[email protected]>
* proto/prehog: Sync from cloud repo for access graph usage
Sync the `prehog.v1` proto package sfrom the cloud
repo to bring in the changes for access graph usage events.
* proto/accessgraph: Extend EventsStreamV2 response for usage events
Extend the EventsStreamV2 response to allow usage events to be sent back
to teleport.
The usage events that can be sent back are currently all defined in the
`prehog.v1alpha` protobuf package. As this does not have a `go_package`
statement, we need to add a `M` flag to the buf config for generating
the Go code. There is no canonical package for the generated code as the
protos live and are generated in two repos (cloud and teleport).
* proto: Regenerate proto/grpc code for access graph usage events
Regenerate the generated proto code to include the changes for access
graph usage events. This includes the following packages:
- `prehog.v1` (Go and Typescript)
- `accessgraph.v1alpha` (Go)
The contents of this commit were auto-generated with:
make grpc/host
* usagereporter: Add anonymizer for identity security events
Add types compatible with `Anonymizer` for the two identity security
events:
* `prehogv1a.IdentitySecurityGraphSizeEvent`
* `prehogv1a.IdentitySecurityAuditLogsIngestedEvent`
These events are directly transformed as they contain no anonymizable
data.
* usage: Aggregate access graph queries per user
Extend `aggregating.Reporter` to aggregate the number of access graph
queries per user so we can generate monthly user active reports of
access graph usage for self-hosted Teleport customers.
* aggregating: Rename some identitySecurity -> sessionSummary
Rename some variables and functions in the aggregating reporter to more
tightly scope the naming, using "sessionSummary" instead of
"identitySecurity". Another report is to be added named
"identitySecurity" as an aggregation of more general data about the
product.
The existing report defined in the proto -
`IdentitySecuritySummariesGeneratedReport` has been retained as that is
a larger change to make across repositories and with "Summaries" in the
name, is scoped enough to differentiate it from the upcoming report.
* aggregating: Aggregate identity security events into new report
Aggregate the `IdentitySecurityGraphSizeEvent` and
`IdentitySecurityAuditLogsIngestedEvent` events into the
`IdentitySecurityReport` aggregated report.
Aggregation for the graph size events is simply taking the last size of
each provider, as these are essentially guages reporting the size at a
point in time. Aggregation for the audit log events are an accumulation
by provider giving a total count over the report window.
* Define new access list UI related events
* Web: add access list related events
* Fix lint and review
* Address CR
* Address CR
- Added condition to check integrate is always defined for integrate event
- Added nil checks
* fix: optimizing api call and allow searching db users with no-wildcards for db users
* chore: addressing pr comments on renaming var and updating comments
* chore: updated based on pr comments to add more tests
* chore: refactor connct button dropdown state rendering
* chore: using t.context() directly in the test
* chore: cleaner refactor of ActionButtons logic
* chore: updated unifiedresoruces test to re-use the existing mock auth client
* chore: removing fallback as not needed for connect
* chore: remove unused api
* chore: reworked test and updated no wildcard logic
* chore: remove unused GetAllowedDatabaseUsers method
* fix: put back test that verifies correct logins are returned for a leaf cluster with access request
* fix: updated parameterpicket to account for allowOnlySuggestions when filtering
* Add `VERSION_MISMATCH` status to `WindowsServiceStatus`
* Show error in UI
* Verify service compatibility with client
* Fix outdated comment
* Remove unnecessary stories
* Move `VerifyServiceInstalledAndMatchesClient` to separate file
* Add `message_of_the_day` to `AuthSettings`, remove unused `has_message_of_the_day`
* Support passing `whiteSpace` to `Text`
* Show MOTD before login
* Add tests and stories
* Remove `minHeight={0}`
* Move `MessageOfTheDay` to `ClusterLogin`
* Minor code style fix
* feat: added support for db roles for auto user provisioning for teleport connect
* chore: added unit tests for the auto provisioned user support changes
* chore: added storybook tests
* chore: reflecting on pr comments
* fix: fixed loosing db roles on cert re-issue
* chore: add oneOf support for db roles in proto
* chore: udpated to do user transform in backend
* chore: updated to group auto provisioning fields together
* chore: updating to preset db user in search bar for auto user provisioning
* chore: making autoUserProvisioning type required to prevent future misses of setting it
* chore: updated to reflect on pr comments
* chore: updating to minimize new interface declaration
Adds a new `summaries_generated` field to the `SessionSummariesGeneratedRecord`
proto message to track the number of session summaries generated per session
type and resource combination, in addition to the existing token counts.
Updates the reporter to increment this counter for each processed
summary event.
Signed-off-by: Tiago Silva <[email protected]>
* proto/prehog: Sync with source of truth in cloud repo
Sync the prehog proto files from the cloud repo as they are the source
of truth. These have diverged a little, largely in non-functional ways.
The CTA enum was missing `CTA_USAGE_REPORT`, now added. The rest is just
comments and some ordering.
This makes it easier to keep in sync in future as the files can just be
copied without needing to manually move changes across.
* proto/prehog: Regenerate Go/TS proto code
Regenerate the Go / Typescript code from the prehog proto from the
resync changes. Performed with:
make grpc/host
Improve comments
grpc, lint, test fix
Update tf docs
Update tf integration
Fix login test
Address comments
Fix test
Move ValidateBrowserMFAChallenge rpc to MFA service
Fix service test
Address comments
Don't materialise browser authentication
Remove browser auth materialisation in test
Convert validate browser mfa to complete browser mfa
* Replace `GetDownloadBaseUrl` RPC with `GetConfig`
* Implement reading ToolsVersion and CdnBaseUrl from system registry
* Read values from `getConfig()` instead of `getDownloadBaseUrl` and `process.env`
* Use UAC updater when app is configured with env vars
* Fix typos
* Handle tools version being 'off'
* Safely read values from `GetConfigResponse`
* Fix ordering in proto
* Non-official -> Unofficial
* Add TODO about docs
* Use switch-case instead of if-else
* Bring back if-else
* Switch installer to dual-mode
* Customize NSIS updater to disallow attempts to update per-machine installations if update is triggered from per-user instance
* Make `assertTshInProgramFiles` more strict
Reading Program Files path should be done using Windows API instead of env var that can be overridden.
* Add RPC to check if VNet service is installed
* Show warning and disable auto-start if there is no VNet service
* `GetWindowsSystemService` -> `CheckPreRunRequirements`
* `CheckPreRunRequirements` -> `CheckInstallTimeRequirements`
* Customize `forAll` option with VNet message
* Check for per-machine installation in system registry
* Fix vars with PreRun in the name
* Link to source file from the electron-builder repo, add commit hash
* Read per-machine location from Go instead of via PowerShell
* `IsPerMachineInstallResponse` -> `GetInstallationMetadataResponse`
* Define `GetInstallationMetadata` handler in separate file
* Fix tests failing on "updates not wrapped into act"
This change adds tracking for AI-generated session summaries so we can monitor feature usage and token costs.
Two new events are introduced:
- `SessionSummaryAccessEvent` tracks when users view AI summaries and which session types and resources are accessed.
- `SessionSummaryCreateEvent` tracks when summaries are generated, including input and output token counts for cost and capacity planning.
Events are aggregated in 15-minute windows by session type (SSH, Kubernetes, database, desktop) and resource name.
User access data is added to `UserActivityReport` via a new `SessionSummariesAccessedRecord`. AI generation metrics are reported in a new `IdentitySecuritySummariesGeneratedReport`, which tracks token usage per resource.
All resource names are anonymized with HMAC-SHA-256 before submission.
Signed-off-by: Tiago Silva <[email protected]>
* saving progress
* Proxy working with legacy web client
* a bit of cleanup and refactoring. Removed unecessary 'WriteTo' implementations on TDP/TDPB messages.
* Refactoring and code cleanup around tdpb message handling and translation
* Get translation set up
* A bit more cleanup
* Update TDP MFA util to utilize new MFA service protos
* Remove MFA messages from translation interceptors. They're not needed since MFA is handled before we start proxying the connection.
* Add 'PingerFunc' adapter to latency monitor
* More cleanup and refactoring around TDP setup and translation.
* Added tests for desktop proxy with each permutation of client/server dialects.
* Remove redundant and/or dead code.
* More refactoring
* Advertise TDPB as a subprotocol when handling websocket upgrade requests
* Fixes from integration testing
* Update usage of LatencyStats after renaming some fields
* Add a few more TDPB unit tests
* Remove comment
* Add a couple tests for 'handshakeData'
* Light cleanup
* * Remove unnecessary warning logs from MFA flow
* Add test case for TDPB MFA flow
* Remove obsolete 'tdpMFACodec'
* Update Go TDPB implementation after protobuf 'oneof' refactor.
* more cleanup
* Proxy alpn and username fixes
* The great refactor
* refactor aftermath
* Add explicit strict/permissive TDPB Decode implementations and fix test case that validates permissive decoding
* Missed recording_export during refactor
* not yet
* Fix a few refactor typos
* Cleanup TDP/TDPB proxy handler by refactoring disparate TDP/TDPB client handling.
* last bit of cleanup
* Clean up tdp/tdpb translation
* Remove commented out code
* Attempt to reduce some noise by refactoring package aliases.
* update comment
* fix lint errors
* more lint fixes
* last lint fixes
* Fix race in test setup
* Add license headers to new files
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <[email protected]>
* Rename wsAdapter and re-implement it's 'ReadMessage' method with a re-usable buffer
* Move TDP/TDPB MFA ceremony implementations to tdp/tdpb/legacy packages.
* Improved godocs in tdpb package
* Address the lighter PR feedback.
* Drop tdp/legacy import aliasing
* fix unnecessary conversion
* Fix license
* Apply suggestions from code review
Co-authored-by: Przemko Robakowski <[email protected]>
Co-authored-by: Zac Bergquist <[email protected]>
* Fix ping/pong matching
* * Rename 'isMFAResponse' to 'asMFAResponse'
* Fix surrounding comments
* fix comment
* Do not send empty error messages to client
* Fix some TDPB/TDP translation layer oversights
* Fix incorrect protobuf representation of MouseWheel's 'delta'. Should be int32, not uint32.
* Fix quoting in error string
---------
Co-authored-by: Zac Bergquist <[email protected]>
Co-authored-by: Przemko Robakowski <[email protected]>
* Add `sub_kind` and `permission_sets` to `App` message
* Allow launching AWS IAM IC
* Add AWS domain to allowlist
* Fix makeApp helper
* Add story
* Validate path and host parts, add test
* Support US gov partition addresses
* Update proto message
* Use more realistic publicAddr in test
---------
Co-authored-by: Rafał Cieślak <[email protected]>
Updates the RegisterRequest proto to support multiple Host CA certificates
by introducing a new host_ca_pems repeated field while maintaining backwards
compatibility by deprecating the existing host_ca_pem field. This enables
proper authentication during Host CA rotation and HSM scenarios where
multiple certificates may be active simultaneously.
Signed-off-by: Tiago Silva <[email protected]>
* Add protobuf definitions for tdpb
* * Re-add separate announce/acknowledge shared directory messages
* Add missing 'bytes_written' field to 'SharedDirectoryResponse'
* Use new MFA service protos in MFA messages which will bring in fewer dependencies
* Add typescript generation of TDPB protos
* Refactor legacy/types.proto by pulling 'Metadata' and various MFA device messages definitions into their own files. This eliminates the new MFA service's dependency on legacy/types.proto and drastically reduces the transitive dependencies of tdpb.proto.
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <[email protected]>
Co-authored-by: Dan Share <[email protected]>
* Add '_ms' suffix to latency stats message.
* Update/add license headers
* Refresh protos and regenerate terraform docs
* Remove use of custom type option and 'MessageType' enums in favor of an 'Envelope' message utilizing oneof.
Follow the same approach for SharedDirectory request and response messages.
---------
Co-authored-by: Zac Bergquist <[email protected]>
Co-authored-by: Dan Share <[email protected]>
The scope of the certificate presented by agents to the reversetunnel
server is now tracked and stored with the remoteConn. Dial requests,
both local and via peers, are now populated with the scope the user
is logged into which the reversetunnel server uses to enforce that
dials for hosts are only honored if the target scope matches.
STeve (Xin) Huang