Skip to content

Commit 41b0717

Browse files
GavinFrazarGavinFrazar
authored
Merge branch 'branch/v17' into bot/backport-50605-branch/v17
2 parents 3458505 + 8c154d4 commit 41b0717

File tree

48 files changed

+2570
-2140
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+2570
-2140
lines changed

‎.github/ISSUE_TEMPLATE/webtestplan.md

Lines changed: 41 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -125,10 +125,9 @@ All actions should require re-authn with a webauthn device.
125125
For each, test the invite, reset, and login flows
126126

127127
- [ ] Verify that input fields validates
128-
- [ ] Verify with `second_factor` type to `off`
129-
- [ ] Verify with `second_factor` type to `otp`, requires otp
130-
- [ ] Verify with `second_factor` type to `webauthn`, requires hardware key
131-
- [ ] Verify with `second_factor` type to `on`, requires a MFA device
128+
- [ ] Verify with `second_factors` set to `["otp"]`, requires otp
129+
- [ ] Verify with `second_factors` set to `["webauthn"]`, requires hardware key
130+
- [ ] Verify with `second_factors` set to `["webauthn", "otp"]`, requires a MFA device
132131
- [ ] Verify that error message is shown if an invite/reset is expired/invalid
133132
- [ ] Verify that account is locked after several unsuccessful login attempts
134133

@@ -275,23 +274,23 @@ make an API request to the backend app at its teleport public_addr
275274
```go
276275
package main
277276

278-
import (
279-
"encoding/json"
280-
"fmt"
281-
"log"
282-
"net/http"
283-
)
284-
285-
// change to your cluster addr
286-
const clusterName = "avatus.sh"
287-
288-
func main() {
289-
// handler for the html page. this is the "client".
290-
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
291-
html := fmt.Sprintf(html, clusterName)
292-
w.Header().Set("Content-Type", "text/html")
293-
w.Write([]byte(html))
294-
})
277+
import (
278+
"encoding/json"
279+
"fmt"
280+
"log"
281+
"net/http"
282+
)
283+
284+
// change to your cluster addr
285+
const clusterName = "avatus.sh"
286+
287+
func main() {
288+
// handler for the html page. this is the "client".
289+
http.HandleFunc("/", func(w http.ResponseWriter, r \*http.Request) {
290+
html := fmt.Sprintf(html, clusterName)
291+
w.Header().Set("Content-Type", "text/html")
292+
w.Write([]byte(html))
293+
})
295294

296295
// Handler for the API endpoint
297296
http.HandleFunc("/api/data", func(w http.ResponseWriter, r *http.Request) {
@@ -304,9 +303,11 @@ make an API request to the backend app at its teleport public_addr
304303

305304
log.Println("Server starting on http://localhost:8080")
306305
log.Fatal(http.ListenAndServe(":8080", nil))
307-
}
308306

309-
const html = `
307+
}
308+
309+
const html = `
310+
310311
<!DOCTYPE html>
311312
<html lang="en">
312313
<head>
@@ -332,6 +333,7 @@ make an API request to the backend app at its teleport public_addr
332333
</details>
333334

334335
Update your app service to serve the apps like this (update your public addr to what makes sense for your cluster)
336+
335337
```
336338
app_service:
337339
enabled: "yes"
@@ -755,20 +757,16 @@ Add the following to enable read access to trusted clusters
755757
- Auth methods
756758
- Verify that the app supports clusters using different auth settings
757759
(`auth_service.authentication` in the cluster config):
758-
- [ ] `type: local`, `second_factor: "off"`
759-
- [ ] `type: local`, `second_factor: "otp"`
760+
- [ ] `type: local`, `second_factors: ["otp"]`
760761
- [ ] Test per-session MFA items listed later in the test plan.
761-
- [ ] `type: local`, `second_factor: "webauthn"`,
762+
- [ ] `type: local`, `second_factors: ["webauthn"]`,
762763
- [ ] Test per-session MFA items listed later in the test plan.
763-
- [ ] `type: local`, `second_factor: "webauthn"`, log in passwordlessly with hardware key
764-
- [ ] `type: local`, `second_factor: "webauthn"`, log in passwordlessly with touch ID
765-
- [ ] `type: local`, `second_factor: "optional"`, log in without MFA
766-
- [ ] `type: local`, `second_factor: "optional"`, log in with OTP
767-
- [ ] `type: local`, `second_factor: "optional"`, log in with hardware key
768-
- [ ] `type: local`, `second_factor: "on"`, log in with OTP
764+
- [ ] `type: local`, `second_factors: ["webauthn"]`, log in passwordlessly with hardware key
765+
- [ ] `type: local`, `second_factors: ["webauthn"]`, log in passwordlessly with touch ID
766+
- [ ] `type: local`, `second_factors: ["webauthn", "otp"]`, log in with OTP
769767
- [ ] Test per-session MFA items listed later in the test plan.
770-
- [ ] `type: local`, `second_factor: "on"`, log in with hardware key
771-
- [ ] `type: local`, `second_factor: "on"`, log in with passwordless auth
768+
- [ ] `type: local`, `second_factors: ["webauthn", "otp"]`, log in with hardware key
769+
- [ ] `type: local`, `second_factors: ["webauthn", "otp"]`, log in with passwordless auth
772770
- [ ] Verify that the passwordless credential picker works.
773771
- To make the picker show up, you need to add the same MFA device with passwordless
774772
capabilities to multiple users.
@@ -985,21 +983,21 @@ Add the following to enable read access to trusted clusters
985983
- **Creating Access Requests (Role Based)**
986984
- To setup a test environment, follow the steps laid out in `Creating Access Requests (Role Based)` from the Web UI testplan and then verify the tasks below.
987985
- [ ] Verify that under requestable roles, only `allow-roles-and-nodes` and
988-
`allow-users-with-short-ttl` are listed
986+
`allow-users-with-short-ttl` are listed
989987
- [ ] Verify you can select/input/modify reviewers
990988
- [ ] Verify you can view the request you created from request list (should be in a pending
991-
state)
989+
state)
992990
- [ ] Verify there is list of reviewers you selected (empty list if none selected AND
993-
suggested_reviewers wasn't defined)
991+
suggested_reviewers wasn't defined)
994992
- [ ] Verify you can't review own requests
995993
- **Creating Access Requests (Search Based)**
996994
- To setup a test environment, follow the steps laid out in `Creating Access Requests (Resource Based)` from the Web UI testplan and then verify the tasks below.
997995
- [ ] Verify that a user can see resources based on the `searcheable-resources` rules
998996
- [ ] Verify you can select/input/modify reviewers
999997
- [ ] Verify you can view the request you created from request list (should be in a pending
1000-
state)
998+
state)
1001999
- [ ] Verify there is list of reviewers you selected (empty list if none selected AND
1002-
suggested_reviewers wasn't defined)
1000+
suggested_reviewers wasn't defined)
10031001
- [ ] Verify you can't review own requests
10041002
- [ ] Verify that you can mix adding resources from the root and leaf clusters.
10051003
- [ ] Verify that you can't mix roles and resources into the same request.
@@ -1067,7 +1065,8 @@ Add the following to enable read access to trusted clusters
10671065
verify that Kube access is working with MFA.
10681066
- [ ] Verify that Connect prompts for MFA during Connect My Computer setup.
10691067
- Hardware key support
1070-
- You will need a YubiKey 4.3+ and Teleport Enterprise.
1068+
1069+
- You will need a YubiKey 4.3+ and Teleport Enterprise.
10711070
The easiest way to test it is to enable [cluster-wide hardware keys enforcement](https://goteleport.com/docs/admin-guides/access-controls/guides/hardware-key-support/#step-12-enforce-hardware-key-support)
10721071
(set `require_session_mfa: hardware_key_touch_and_pin` to get both touch and PIN prompts).
10731072
- [ ] Log in. Verify that you were asked for both PIN and touch.
@@ -1127,8 +1126,8 @@ Add the following to enable read access to trusted clusters
11271126
authtrampoline → bash → tsh. Then just `sudo kill -s KILL <tsh pid>`.
11281127
- [ ] The VNet panel shows an unexpected shutdown of VNet and an in-app notification is shown.
11291128
- [ ] The admin process _leaves_ files in `/etc/resolver`. However, it's possible to start
1130-
VNet again, connect to a TCP app, then shut VNet down and it results in the files being
1131-
cleaned up.
1129+
VNet again, connect to a TCP app, then shut VNet down and it results in the files being
1130+
cleaned up.
11321131
- Misc
11331132
- [ ] Verify that logs are collected for all processes (main, renderer, shared, tshd) under
11341133
`~/Library/Application\ Support/Teleport\ Connect/logs`.

‎api/proto/teleport/legacy/types/types.proto

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2097,7 +2097,9 @@ message AuthPreferenceSpecV2 {
20972097
string Type = 1 [(gogoproto.jsontag) = "type"];
20982098

20992099
// SecondFactor is the type of mult-factor.
2100+
// Deprecated: Prefer using SecondFactors instead.
21002101
string SecondFactor = 2 [
2102+
deprecated = true,
21012103
(gogoproto.jsontag) = "second_factor,omitempty",
21022104
(gogoproto.casttype) = "github.com/gravitational/teleport/api/constants.SecondFactorType"
21032105
];
@@ -2196,7 +2198,9 @@ message AuthPreferenceSpecV2 {
21962198
// 1 is "legacy", 2 is "balanced-v1", 3 is "fips-v1", 4 is "hsm-v1".
21972199
SignatureAlgorithmSuite signature_algorithm_suite = 20;
21982200

2199-
// SecondFactors is a list of supported second factor types.
2201+
// SecondFactors is a list of supported multi-factor types.
2202+
// 1 is "otp", 2 is "webauthn", 3 is "sso",
2203+
// If unspecified, the current default value is [1], or ["otp"].
22002204
repeated SecondFactorType SecondFactors = 21 [(gogoproto.jsontag) = "second_factors,omitempty"];
22012205
}
22022206

0 commit comments

Comments
 (0)