Closes#16046
In each SSO guide that instructs the user to provide a redirect URL with
the Proxy Service address, indicate that, if there is more than one
Proxy Service address configured in `public_addr`, the user must use the
first address listed.
Move the `lint-ui.yaml` workflow into the common `lint.yaml` workflow so
we can use the existing setup with the `dorny/paths-filter` action. This
allows us to remove the bypass workflow and fixes the `merge_group`
trigger to also use paths. The original workflow had paths specified for
the `merge_group` event, but that even does not take a `paths` field.
This fixes a bug where the lint-ui workflow does not run on a PR, but
does run in the merge queue, even if none of the UI workflow files
changed.
This is the first in a series of changes to migrate the identity
center APIs away from `lib/utils/pagination` with the end goal
of removing the pagination package entirely.
## Why?
Pagination bugs have been a major problem historically. Having
multiple implementations for iterating pages of resources increases
the chances of a bug. By consolidating our pagination APIs to a
single shape, we can reduce the number of hand rolled implementations
to consume an entire set of pages.
https://github.com/gravitational/teleport/pull/56418 and
https://github.com/gravitational/teleport/pull/56581 have recently
consolidated _most_ consumption of pagination APIs to a single
helper in `api/utils/clientutils`. However, due to the use of
the pagination.NextKey by the Identity Center APIs they need either
special cases, or their own special implementation.
The IdentityCenterAccount and IdentityCenterAccountAssignment wrapper
types are exposed outside of where they are required. They were
added solely for the unified resource cache, and should not have
been included in the APIs for the resources. The unified resource
cache no longer uses the wrappers but they cannot be removed until
the APIs no longer reference them.
## How?
These APIs are consumed in both OSS and Enterprise code which means
they cannot be changed directly without breaking builds. The plan
is to provide equivalent methods with different signatures to allow
the transition to occur over a series of changes.
`func (*TeleportProcess) GetIdentityForTesting` was the only place
consuming test symbols outside of tests. It existed to allow
`integration.TestInstanceCertReissue` to assert the identity after
certificate reissuance. To avoid this, TestInstanceCertReissue
was moved from integration into lib/service so that it could make
use of the private `(*TeleportProcess) getIdentity` and allow the
`GetIdentityForTesting` to be removed.
Updates #51023.
Use `make ensure-wasm-deps` to install wasm-pack and wasm-bindgen as
wasm-pack often fails to build wasm-bindgen due to it not using
`--locked`. If we pre-install the correct versions, wasm-pack does not
try to build wasm-bindgen.
Make sure the workflow runs if the workflow itself is changed.
* Add methods to upload session summaries to the upload handler
* Fix gcshandler and its tests
* Fix the UploadHandler interface
* Build fix for external audit storage integration test
* review
* Add "How it works" sections to 16 docs guides
In the Teleport documentation, we are standardizing our how-to guides on
including a "How it works" section after the introduction and before the
prerequisites. This ensures that each guide includes an architectural
overview, which allows the reader to form a mental model of the
instructions before following them.
This change adds "How it works" sections to 16 docs guides related to
access controls, infrastructure as code, and Helm deployments.
* Respond to hugoShaka feedback
- Correct the "How it works" section in the Headless WebAuthn guide.
- Expand the "How it Works" section in the EKS, AKS, and GKE deployment
guides.
- Add a clarification to the "How it works" section of the agentless SSH
guide.
* Device Trust: add `required-human` mode
* Add `device_trust.mode=required-human` to the test plan
* Add `IsBot` methods to TLS and SSH identities
* Fix `required-human` mode on roles
* Rename mode to `required-for-humans` for clarity
* Undo premature changes to device trust guides
* Default `deviceVerificationPassed` false to avoid accidents when adding new modes
* Handle `BotName` and `BotInstanceID` in `lib/auth/authtest`
* Fix stray reference in test
* Fix reference to `config.DestinationMemory`
* Handle empty device trust mode
* Configuration resources for the session summarizer
* Review
* OSS layer of the session summarizer
- The backend service
- A stub gRPC service which communicates that the feature is only
available in Enterprise
- e_imports statement that adds an OpenAI client that will be used by
the enterprise build
- Necessary wiring that allows `ProtoStream` instances to notify
listeners about upload completion; the accompanying enterprise change
will use it for triggering summarization
* review
* review
* Rename the resources
* Rename the resources
* Review
* go mod tidy
* lint
* Add response messages
* Add return types to the gRPC server
* Split out the resources gRPC service from summarizer
* Fix CI issues
* Add some comments, fix existing ones
* Remove unnecessary e/ change
* Fix broken lint
* Replace summarizer wrapper with summarizer provider
This fixes a minor race condition, adds some missing unit tests, and
hopefully reduces confusion about the entire concept.
* Fix license and import order
* review
* Clean up tests
* Review
Move code around, switch from atomic pointer to a mutex in the
summarizer provider.
* Fix stream_test
* Review
* Narrow down the number of event types accepted by Summarizer
* Fix tests
* Review
* Review: some renamings
* Update RFD 0201
Updates the automatic review RFD with details of resource based
requests.
* Match by label instead of ID
* Add a few more predicate expressions
- Replace has_labels with all_has_labels and some_has_labels.
- Add access_request.spec.requested_resources.length.
* Use union and intersection approach
* Add warning about inclusion of Root CA in chain
* Use equality of RawSubject/RawIssuer rather than string
Co-authored-by: Edoardo Spadolini <[email protected]>
---------
Co-authored-by: Edoardo Spadolini <[email protected]>
* Fix imports
* Move `FileDescription` to bot package
* Move `WorkloadIdentitySelector` to bot package
* Move AWS RA service to separate package
* Add TODO comment on incorrect file descriptions
* Use `LoggerForService` in AWS RA service
* Remove unessasary `else`
* Fix stray import
* Remove unessasary `bytes.NewBuffer`
* Add OTP fallback for SSHAgentMFAWebSessionLogin
In the case Teleport `second_factor` is set to `on`,
it is possible for a user to only have OTP configured.
Prior to this commit this would result in a auth fail
as the created challenge only supported TOTP.
Server side would recieve an incomplete `AuthenticateWebUserRequest`
object, which fails validation via `CheckAndSetDefaults` and
as such only a failed login audit event was emitted with no
additional logs.
This mode of failure can be reproduced with
`tsh bench -d web sessions --auth=local`.
changelog: Fixed fallback for web login when second factor is set to `on` but only OTP is configured.
* improve errors for unsupported web login mfa challenge
* Update lib/client/weblogin.go
Co-authored-by: Edoardo Spadolini <[email protected]>
* Update lib/client/weblogin.go
Co-authored-by: Edoardo Spadolini <[email protected]>
* unexport SSHAgentMFAWebSessionLogin and SSHAgentLoginWeb
* update sshAgentLoginWebCreateSession signature
---------
Co-authored-by: Edoardo Spadolini <[email protected]>
This PR changes the `listprofiles` endpoint to return all the profiles
at once.
This list is limited to a max of 250 items as described in the AWS Roles
Anywhere quotas:
https://docs.aws.amazon.com/rolesanywhere/latest/userguide/quotas.html
Pagination will be implemented client side.
* AWS IAM Roles Anywhere: implement filters for Profile sync and lister
* move client out of request
* improve godoc for the ListRolesAnywhereProfiles api
* Move core bot logic to `bot.Bot`
* Add godoc comments for the TrustBundleCacheFacade and CRLCacheFacade
* Ensure any stray goroutines terminate when Run and OneShot exit
* Prevent bot from running more than once
* Remove duplicate closer call
* Add a `LoggerForService` convenience method
* Fix imports
* Fix broken test
* Remove duplicate import
Przemko Robakowski