* don't allow empty database names or user names for Postgres connections
* adopt postgres behavior when the database name is empty
---------
Co-authored-by: Andrew LeFevre <Andrew LeFevre>
During the recent button redesign we intended to make the top right
button a border button as it's not the single primary action on the
page. We missed a few cases where we used wrapper components.
In addition, use title case consistently for these buttons.
* Adding flags for benchmarks in unit test CI
* Upping timeout for unit tests to accomodate benchmarks
* Fixing a typo
* Run benchmarks once
* Adding a makefile target for ci bench test
* Removing a stray quotation
* Compacting workflow
* Benchmarks now with nicer output
* Benchmarks back to their own step
* With error messages
* Adding pipefail to preserve exit code
* Using bash
* Simpler command and including e
* Separating benchmarks into its own workflow
* Fixing benchmarks workflow name
* Ignoring benchmarks that require root
* Updating to account for root and nonroot bench
* Cleaning up the benchmark workflows
* Bench requires test log dir to be created
* Excluding all BenchmarkRoot benchmarks from running
* Bumping benchGetNodes timeout duration to account for some jitter
* Fixing multiplexer benchmark by mirroring unit tests
* Remembered that skip exists
* Skipping BenchmarkGetMaxNodes due to flake
* Fixing formatting of summary
* Actually fixing summary
* Adding another newline
* Simplifying setup for mux listener
* Excluding BenchmarkRootExecCommand
* Mention modifying the role when configuring Workload Identity IP/DNS SANs
* Uncapitalize `role`
Co-authored-by: Paul Gottschling <[email protected]>
* Add more instructions about modifying the role
---------
Co-authored-by: Paul Gottschling <[email protected]>
The changelog contains a number of inconsistencies with the rest of the
Teleport documentation. For example, while we have moved away from using
"Application Access", "Database Access" and so on in favor of describing
Teleport Access in a more integrated way, the changelog still uses the
outdated phrasing throughout. The changelog also fails to capitalize
Teleport capabilities such as Access Requests and Device Trust.
This change fixes prose linter errors in the changelog to make it more
consistent with the rest of the docs.
The Support component is the only Web UI component that renders docs
links that include the `/ver/` path segment. This change removes the
`/ver/` path segment from these links so they point to the default
version of the docs. The user can use the version dropdown within the
docs site to adjust the version. This change does not alter UTM
parameters.
With this change, we only need to manage redirects in the default
version of the docs site. This makes it less likely that users will
encounter 404 errors. And since the docs site only displays the current
version and previous two versions, link targets with the `/ver/` segment
will 404 in EOL Teleport versions. This change also prevents that
scenario.
Closes#45368
Include instructions to generate a Teleport config that enables the SSH
Service, which is the service that the guide assumes a user has enabled.
* Show `ExternalLinkIcon` on unguided discover resource tiles to make more evident they link out to docs
* Make guided discover resource tiles buttons, add focus styling
- Rename misleadingly named pages related to managing Login Rules with
IaC tools.
- Organize guides into thematic subdirectories. Currently, the
Infrastructure as Code section includes all guides on one level, which
makes it difficult to navigate.
At some point, we started looking for certs hard-coded locations
and stopped respecting the VITE_HTTPS_CERT and VITE_HTTPS_KEY
variables.
This commit restores the original behavior as documented in
web/README.md.
* docs: include k8s in session_tracker reference
* docs: update session.participants verbiage
* docs: update verbiage for session_tracker.participants
---------
Co-authored-by: Steven Martin <[email protected]>
* Start hacking on Workload Identity SDS API support
* Actually generate from SVIDs/Trustbundle
* Support for envoy "special meaning" resource names
* Add minimum version enforcement
* Simplify handling of clustername
* Start working on StreamSecrets RPC
* Extract response generation helper
* Log request
* Implemnt SDS versioning/nonce checking
* Handle renewal of SDS certs
* Refactor for ease of testing
* Start writing tests for SDS functionality
* Add E2E tests
* Fix test
* go mod tidy
* Appease linter
* Update go.mod
* Fix test with characters that windows dislikes
- Rename "hostname" to target, which now includes the OS-user for SSH
sessions and a more accurate description of the target for other
kinds of sessions.
- Remove the "login" column, as this info is now included in the
"target" column.
- Humanize the created time rather than showing a UTC timestamp.
The tsh sessions ls command is most commonly used to get the ID
of a session you want to join, so people are looking for clues
as to which session is the right one, they don't need precise UTC
timestamps.
- Remove the "command" column, as it's typically only set for
non-interactive sessions. Note: the command will be placed in
the "address" column for kube sessions.
Closes#42253
* Add networking subprocess for port and agent forwarding.
* Remove extraneous x11 forwarding logic.
* Add x11 forwarding to the networking subprocess.
* Fix lint.
* Try create host user before starting networking process.
* Resolve comments
* Fix networking process memory leak.
* Run networking subprocess as root but change to user login after PAM call.
* Update agent forwarding socket dir permissions.
* Handle networking requests synchronously to maintain the current PAM context.
* Use user environment in networking process.
* Fix issue with PAM thread state being locked to the main goroutine; Clean up homeDir logic; Fix PAM thread state for xauth commands.
* Selectively handle some networking requests in goroutines.
* Address comments.
* Use an interrupt signal to trigger graceful exit in the networking subprocess.
* Cleanup unix sockets from the child namespace.
* Address comments.
* Remove extraneous network forwarding socket validation.
* Fix tests and lint.
* Re-add networking process done channel to avoid deadlocks on reading unix sockets passed to a dead process.
* Remove broken test.
* Address comments.
* Cleanup; remove unused child error file.
* - Explicility list file paths to clean up at the end of the networking process.
- Use terminate FD instead of interrupt to signal the process to exit.
- Log errors from the parent process.
- Read networking request response without goroutine.
* Cleanup.
* Make request socket a stream.
* Remove extraneious Chmod.
* Send request level error to request conn.
* Don't unlink unix sockets from the parent process.
* Read full error message from stream.
* Remove remaining logs in child process.
* Fix typos.
* web: support SAML resource deletion in unified resources view (#44311)
* update SAML app edit mechanism to accomodate both edit and delete functions
* use user saml idp access to disable menu actions
* add comment to ResourceActionButton props
* refactor: SamlAppActionContext to edit and delete Saml application
* address review comments
* Add networking process tests to replace old tests.
* Don't close remote file descriptor before the child process has a chance to connect to it.
* Fix lint; skip broken test.
* Disable broken test and restore older test to cover for it.
* Remove unused agent forwarding test.
* Fix lint, replace broken test.
* Fix old test that used testify/require in goroutine.
* Close request context immediately to avoid deadlock (extended timeout) on reading from the closed process.
---------
Co-authored-by: Sakshyam Shah <[email protected]>
* Populate tls.Config.NextProtos for teleport specific ALPNs
Any alpnproxy.HandlerDesc that forwards TLS or provides its own
tls.Config is responsible for setting the tls.Config.NextProtos so
that the negotiated ALPN is returned to clients. In all other cases
the proxy web tls.Config is used which populates the next protos
with _all_ supported ALPN protocols. All of the existing places
that the default tls.Config was being overridden were supplying
the NextProtos. This updates them to populate the NextProtos with
the correct values and updates the commentary on alpnproxy.HandlerDecs
to indicate that NextProtos should be set if not using the default
tls.Config.
Fixes#41500.
* fix: add test that validates negotiated protocols
This was causing permissions problem, integration didn't have required "eks:DescribeAccessEntry" permissions that
was used to setup access entry. But we don't need it in case of integration-based auto-discovery.
It looks like the guide intends for you to set up two Okta groups
(okta-dev and okta-admin) that map to Teleport roles.
The Teleport roles that the guide refers to are incorrect though.
For the okta-dev group, the guide has to create a "dev" role, but
then configures an SSO connector to assign you the preset "access"
role and the "dev" role goes unused.
Additionally, the okta-admin group refers to an "admin" role, but the
SSO connector that you set up maps users to the "editor" role.
Correct the guide to properly use the "dev" role that it asks you to
create and to replace mentions of "admin" with "editor".
Closes#28660
* `MeetsVersion` -> `MeetsMinVersion`
* Add `MeetsMaxVersion`
* Show a warning if tsh version is newer than server
* Replace new usages of `utils.CheckVersion` with `utils.CheckMinVersion`
