[v11] Don't prematurely close context in app service.

[mdwn]

The app service was prematurely closing the context for the AWS signer handler, causing tsh aws requests to fail with a context cancel. This only affects v11.

[r0mant]

Has this regressed recently? Do we know where it broke and why it wasn't caught by unit tests (and can we add test coverage here)?

[mdwn]

Has this regressed recently? Do we know where it broke and why it wasn't caught by unit tests (and can we add test coverage here)?

Yes, this is a recent regression. The code here has changed recently due to the Azure CLI changes and some of this code was backported to v11 to make future backports easier, but it got a little clobbered in the process.

This is a little tough to introduce tests for because the issue doesn't even crop up until attempting to use the AWS signer handler, which we don't have any integration tests for. IMO in order to catch something like this we'd need a test that actually deploys a Teleport cluster to AWS and attempts to run tsh aws commands against it.

One of my biggest worries with app access is the need for more black box testing that uses Teleport as a user would. It's going to be increasingly hard to mimic these sorts of environments as app access grows more complex.

We could introduce tests in here that query the context for each sub-handler for app access, but it feels like the wrong way to go about detecting this problem IMO.

[r0mant]

@capnspacehook @rosstimothy Could one of you take a look as well when you get a chance? We should release this quickly in a patch release, combined with the other AWS access fix Mike has.