tbot: add scope support for application services - #69422
Conversation
These guard the implementation of the feature ensuring the outcome is as expected.
This allows GenerateScoped to have the usage set by the caller. This also adds the UsageApp as a valid param, and makes sure all previous calls to GenerateScoped and GenerateScopedFacade now set UsageIdentity (previous hard coded value).
a54a5e3 to
52dc6f4
Compare
Implement the server-side handling for the UsageApp usage in IssueScopedBotCerts. When a scoped bot requests app-routed certificates, the service now: - Validates the requested app scope against the caller's scope pin - Resolves the app via RangeApplicationServersWithName, ensuring it exists in the exact scope claimed - Rejects Identity Center account apps (not routable, no scoped role support for account assignments) - Creates a scoped app session via CreateAppSessionFromReq - Annotates the output certificate with app routing and session info
52dc6f4 to
5d2506d
Compare
5d2506d to
ea96445
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ea9644520b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| databaseCAs, err := s.botAuthClient.GetCertAuthorities(ctx, types.DatabaseCA, false) | ||
| defer clt.Close() | ||
|
|
||
| routeToApp, _, err := getRouteToApp(ctx, s.getBotIdentity(), clt, s.cfg.AppName) |
There was a problem hiding this comment.
When a bot pinned to a parent scope can see two applications with the same app_name in different descendant scopes, this lookup returns both and getApp silently selects apps[0]; the service configuration has no scope field with which to disambiguate them. The generated credentials, tunnel, or proxy can therefore target whichever scoped application happens to be listed first, potentially forwarding production traffic to the wrong application. Require an explicit scope or reject multiple distinct matches before issuing the routed identity.
Useful? React with 👍 / 👎.
| } | ||
|
|
||
| // Create a new session. | ||
| ws, err := s.authServer.CreateAppSessionFromReq(ctx, sessionreq.NewAppSessionRequest{ |
There was a problem hiding this comment.
An authenticated scoped bot can supply a nonempty but malformed TLS or SSH public key and a long TTL: this call first creates and persists a valid app session, then the later outer GenerateUserCerts call fails while parsing the caller-controlled key. The RPC returns an error without deleting the newly stored session, so repeated invalid requests accumulate app-session records until expiry and can exhaust backend capacity. Parse the requested keys before creating the session, or delete the session whenever final certificate generation fails.
Useful? React with 👍 / 👎.
|
@tscolari - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes. |
|
I'm splitting this PR into two to make it easier to review: |
1 participant
closes https://github.com/gravitational/core/issues/57
Changelog: Scoped bots can now issue application-routed certificates through tbot's
application,application-tunnel, andapplication-proxyservices.Request Flow Diagram
Extends tbot's application services (output, tunnel, proxy) to work in scoped mode by adding a UsageApp variant to the IssueScopedBotCerts RPC.
TELEPORT_UNSTABLE_AGENT_SCOPE_PIN.I've created #69429 as something I stumbled upon during this work.
Manual Test Plan
Test Environment
local
Test Cases
Application Output
scoped: true, oneshot:trueand an application output targeting the scoped appApplication Tunnel:
scoped: trueand an application-tunnel service pointing at the scoped appApplication Proxy:
Scope Enforcement