* Add DirectoryID to shared directory responses and plumb them through to the RDP client.
* Add 'multidirectory_sharing_supported' advertisement to TDPB ServerHello.
* removed presence check for IntegrationName as this can be empty when the fetcher is using ambient credentials.
* refactor command to support multiple subcommands
* lint fix
* Add client-side version verification to join flow
Check the cluster's minimum client version before client join and stop
reconnect retries when the local version is below that minimum.
* Simplify client version check using cmp.Or
* Clarify version check bypass in checkClientVersionSupported
* Replace ErrClientTooOld var with ClientTooOldError struct for improved error handling
* Add server-too-old check to client join version verification
* Remove testing parameters from production join flow
* Use pointer receivers for client version error types
Help us standardize on, in how-to guides, ensuring that CLI users such
as AI agents can easily follow the steps in the body of each guide. In
four guides, add `aws` commands to create IAM policies and attach them
to principals. While users can likely follow these steps without the
command examples, the commands allow them to do so with less friction
and thought.
This change edits the following guides:
- Guided and manual EC2 instance discovery guides
- Database enrollment getting started guide
- AWS EC2 join method guide
* feat(certs): thread beam_id through identity certificates
Carries the beam identifier from a delegation session's BeamIDLabel into
issued SSH/TLS certificates and back out via the cert extensions/ASN.1 OID,
exposes it on tlsca/sshca Identity and the decision PDP identities, propagates
it through scoped cert reissue (auth_with_roles), and surfaces it on event
UserMetadata for attribution.
* handle missing event cases
* prevent overriding beams_id cert extension with roles cert extensions
* handle code review comment
* Add RPCs for creating and getting EnrollPairing
* Add storage service for EnrollPairing
* `AWAITING_UNAUTHORIZED_CLIENT` -> `AWAITING_DEVICE`
* Mention RFD 32e in the comment for EnrollPairing message
* Use generic service to implement service for `EnrollPairing`
* Remove fake clock from tests
* Use a want object in tests
* Use `ErrorAs` for error-type assertions
* Add workaround for DynamoDB issue
* Capture just clock as a field
* Do not set PageLimit
* Copy fields to `want` rather than adding ignores
* Log and ignore error from GetResource on CreateEnrollPairing
* Update the workaround comment to refer to #68038
* Fix imports
* Add configurable backoff values to Okta sync settings
* Update comments to remove references to values defined elsewhere
* Add updated generated protos
* Update comments to include type
* Make rejected accpets retryable
* Added better test for server behavior on limiter accept errors
* Test for presence rather than absence
* Create callback so listener does not delay on failed IP limit Accept()
---------
Co-authored-by: Maja Cieślak <[email protected]>
* Bump `form-data` to 4.0.5
* Bump `tar` to 7.5.16
* Bump `protobufjs` to 7.6.4
* Bump `js-yaml` to 4.2.0
* Bump `@storybook` to 10.4.6 to get rid of `[email protected].7`
* Bump `esbuild` to 0.28.1
* `pnpm dedupe`
* Shrink the interface needed by GetMembersFor
* Avoid reentrancy in Cache.GetAccessListOwners
* Try deadlocking in TestGetAccessListOwners
* Use a struct for accessListMembersListerStore
Co-authored-by: Marek Smoliński <[email protected]>
---------
Co-authored-by: Marek Smoliński <[email protected]>
* Remove some sources of AI agent friction
Edit widely used partials and the Enroll Servers Getting Started guide
to address situations in which an AI agent ran into friction while
attempting to follow a how-to guide.
- Edit `install-linux.mdx` to add a removal command for existing
binaries before installing Teleport, similar to the Go installation
docs for Linux (https://go.dev/doc/install). This way, an agent
working from a system with Teleport binaries installed (e.g., a beam)
does not encounter an error.
- Edit tctl.mdx to mention Teleport authentiation from a beam.
- Edit start-teleport.mdx to include instructions for environments
without systemd, like a Teleport beam.
- Edit the Enroll Servers Getting Started guide. Step 4 refers to a
label that we didn't introduce earlier in the guide. Fix that by
editing the `configure` command.
* Explain the use of TELEPORT_PROXY in tctl.mdx
Proto changes only. Adds the beam identifier so actions can be attributed
to the beam that initiated them:
- events.UserMetadata.BeamID (audit log attribution)
- decision SSHIdentity/TLSIdentity BeamID (PDP identities)
Includes the regenerated protobuf stubs. The Go wiring that populates and
consumes these fields lands in a follow-up PR.
* Stop swallowing gRPC error in join client
The failure test for a gRPC send was checking the wrong error
value, silently ignoring any send failures.
* add regression test
---------
Co-authored-by: Nic Klaassen <[email protected]>
Prior to this patch, the request body could leak if an error ocurred
in `io.ReadAll()`. Moves the deferred `Close()` call to before the
`ReadAll()` call to ensure the body is closed.
* Move the inactivity event helper to the base recording processor
* Expose per-frame activity signals from the desktop thumbnail generator
* Emit inactivity events for desktop session recordings
* Add a test for a fully inactive desktop session
* Change to defer
* Track changed pixels by region to differentiate between typing and clock
* Avoid marking typing as inactivity
* Add mouse button detection
* Only track inactivity if the decoder is available
* Declare missing peers so pnpm global virtual store works
* Add storybook/react-vite for storybook
* Pin to major versions
* Fix Storybook not working with pnpm virtual store
Fixes a couple of issues discovered the Identity Center resource filtering code:
1. The regex-based filters compile their regexes on every search, rather
than once up front. This is not as bad as it sounds due to Teleport's
regex cache, but it is still not ideal.
2. The filter validation and execution steps behave differently, so that
it is possible for an invalid filter to make in past validation and
only be discovered while the plugin is running.
3. The volume log spam generated by a poorly-formed filter that managed
to make it past validation would *astronomical*.
This patch addresses those issues by
1. Compiling the wire-format, protobuf filter objects from the plugin
spec into a known-good filter at construction time, and using that
as the runtime definition of the filter.
2. Compiling the filter regexes during this construction-time setup
rather than just hoping that they are cached by Teleport
2. Validating the filter stack once during this compilation phase,
rather than forcing the runtime matching code to be super very
defensive. This also removes inconsistent behaviour between the
validation at construction time vs. run time.
* Add initial .swiftformat file with sensible defaults
* Apply swiftformat formatting to all code
* Remove file creation header from VerifyApp.swift
* Move .swiftformat to be near the Xcode project, closer to other iOS-specific configs
* Add .swiftlint configuration with a couple common sense rules and some funky TODO regular expressions
* Apply swiftlint rules and add it as a build plugin
* Remove swiftformat as a package dependency, using the CLI instead
* Remove custom TODO lint rules
* Update .swiftformat rules
Andrew LeFevre