Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add reset/passwd capability for local users #3287

Merged
merged 9 commits into from
Feb 4, 2020

Conversation

alex-kovoy
Copy link
Contributor

@alex-kovoy alex-kovoy commented Jan 16, 2020

This PR contains the following changes:

  1. Replaces SignupToken and SignupTokenData with resources UserToken and UserTokenSecrets.
  2. Implements tctl users reset <username> command.
  3. Adds new AudtEvent to capture UserToken creation.

Note, this PR is against alexey/webapps branch.

Fixes #3265

@alex-kovoy
Copy link
Contributor Author

Once this PR reviewed, I will send another with E changes.

@@ -0,0 +1,84 @@
/*
Copyright 2015 Gravitational, Inc.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI, new_web_user.go has been renamed to user.go. No code changes in regards to user functions.

Copy link
Contributor

@fspmarshall fspmarshall left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

None of the APIs being removed affect compatibility between teleport instances of different versions, right? Just UI and tctl stuff?

lib/defaults/defaults.go Outdated Show resolved Hide resolved
lib/auth/password.go Outdated Show resolved Hide resolved
@alex-kovoy
Copy link
Contributor Author

None of the APIs being removed affect compatibility between teleport instances of different versions, right? Just UI and tctl stuff?

Only proxy and auth should be upgraded to the same version. Given upcoming UI redesign changes, I do not see a way how we can keep 2 UI APIs versions compatible. It does not impact node instances.

@benarent
Copy link
Contributor

RE:

Given upcoming UI redesign changes, I do not see a way how we can keep 2 UI APIs versions compatible. It does not impact node instances.

This falls into the world of #3278 and I'm a little anxious of breaking compatibility. I chatted with @russjones and if we do, we need to plan accordingly. I'm going to write up risks and benefits of this approach into a doc and setup a meeting to review with the team.

@alex-kovoy
Copy link
Contributor Author

On a second thought, most of the old web ui will work fine with the new auth version. Only the signup flow will be broken.

lib/auth/apiserver.go Show resolved Hide resolved
lib/auth/apiserver.go Outdated Show resolved Hide resolved
lib/auth/auth_with_roles.go Show resolved Hide resolved
lib/auth/auth_with_roles.go Outdated Show resolved Hide resolved
lib/auth/password.go Show resolved Hide resolved
lib/services/usertoken.go Outdated Show resolved Hide resolved
lib/services/usertokensecrets.go Outdated Show resolved Hide resolved
lib/web/apiserver.go Outdated Show resolved Hide resolved
lib/web/apiserver.go Outdated Show resolved Hide resolved
tool/tctl/common/user_command.go Show resolved Hide resolved
@benarent benarent added this to the 5.0 - "Oceanside" milestone Jan 22, 2020
lib/services/types.proto Outdated Show resolved Hide resolved
lib/web/apiserver.go Outdated Show resolved Hide resolved
lib/auth/apiserver.go Outdated Show resolved Hide resolved
lib/auth/grpcserver.go Show resolved Hide resolved
lib/auth/grpcserver.go Outdated Show resolved Hide resolved
lib/auth/grpcserver.go Outdated Show resolved Hide resolved
lib/services/resetpasswordtoken.go Outdated Show resolved Hide resolved
@alex-kovoy alex-kovoy force-pushed the alexey/webapps-usertokens branch 2 times, most recently from 9ae0c15 to ebe42c2 Compare January 29, 2020 00:45
@alex-kovoy alex-kovoy merged commit 8f0e967 into alexey/webapps Feb 4, 2020
@alex-kovoy alex-kovoy deleted the alexey/webapps-usertokens branch February 12, 2020 20:18
alex-kovoy added a commit that referenced this pull request Mar 12, 2020
* Add UserTokens to allow password resets

* Pass context down through ChangePasswordWithToken

* Rename UserToken to ResetPasswordToken

* Add auto formatting for proto files

* Add common Marshaller interfaces to reset password token
alex-kovoy added a commit that referenced this pull request Apr 14, 2020
* Add UserTokens to allow password resets

* Pass context down through ChangePasswordWithToken

* Rename UserToken to ResetPasswordToken

* Add auto formatting for proto files

* Add common Marshaller interfaces to reset password token
alex-kovoy added a commit that referenced this pull request Apr 15, 2020
* Add UserTokens to allow password resets

* Pass context down through ChangePasswordWithToken

* Rename UserToken to ResetPasswordToken

* Add auto formatting for proto files

* Add common Marshaller interfaces to reset password token
alex-kovoy added a commit that referenced this pull request Apr 15, 2020
* Add monorepo

* Add reset/passwd capability for local users (#3287)

* Add UserTokens to allow password resets

* Pass context down through ChangePasswordWithToken

* Rename UserToken to ResetPasswordToken

* Add auto formatting for proto files

* Add common Marshaller interfaces to reset password token

* Allow enterprise "tctl" reuse OSS user methods (#3344)

* Pass localAuthEnabled flag to UI (#3412)

* Added LocalAuthEnabled prop to WebConfigAuthSetting struct in webconfig.go
* Added LocalAuthEnabled state as part of webCfg in  apiserver.go

* update e-refs

* Fix a regression bug after merge

* Update tctl CLI output msgs (#3442)

* Use local user client when resolving user roles

* Update webapps ref

* Add and retrieve fields from Cluster struct (#3476)

* Set Teleport versions for node, auth, proxy init heartbeat
* Add and retrieve fields NodeCount, PublicURL, AuthVersion from Clusters
* Remove debug logging to avoid log pollution when getting public_addr of proxy
* Create helper func GuessProxyHost to get the public_addr of a proxy host
* Refactor newResetPasswordToken to use GuessProxyHost and remove publicUrl func

* Remove webapps submodule

* Add webassets submodule

* Replace webapps sub-module reference with webassets

* Update webassets path in Makefile

* Update webassets

1b11b26 Simplify and clean up Makefile (#62) gravitational/webapps@1b11b26

* Retrieve cluster details for user context (#3515)

* Let GuessProxyHost also return proxy's version
* Unit test GuessProxyHostAndVersion & GetClusterDetails

* Update webassets

4dfef4e Fix build pipeline (#66) gravitational/webapps@4dfef4e

* Update e-ref

* Update webassets

0647568 Fix OSS redirects gravitational/webapps@0647568

* update e-ref

* Update webassets

e0f4189 Address security audit warnings Updates  "minimist" package which is used by 7y old "optimist". gravitational/webapps@e0f4189

* Add new attr to Session struct (#3574)

* Add fields ServerHostname and ServerAddr
* Set these fields on newSession

* Ensure webassets submodule during build

* Update e-ref

* Ensure webassets before running unit-tests

* Update E-ref

Co-authored-by: Lisa Kim <lisa@gravitational.com>
Co-authored-by: Pierre Beaucamp <pierre@gravitational.com>
Co-authored-by: Jenkins <jenkins@gravitational.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants