From f9d447b02a7c2e56fc298c4d44a6c8a0a13077a9 Mon Sep 17 00:00:00 2001
From: Michael <michael.myers@goteleport.com>
Date: Thu, 20 Oct 2022 15:21:58 -0500
Subject: [PATCH 1/2] Cherrypick #17497

---
 lib/teleterm/api/proto/v1/cluster.proto       |  10 +
 lib/teleterm/api/proto/v1/service.proto       |   5 +-
 .../api/protogen/golang/v1/cluster.pb.go      | 258 ++++++++++++------
 .../api/protogen/js/v1/cluster_pb.d.ts        |  28 ++
 lib/teleterm/api/protogen/js/v1/cluster_pb.js | 205 +++++++++++++-
 .../api/protogen/js/v1/service_grpc_pb.js     |   5 +-
 .../apiserver/handler/handler_clusters.go     |  14 +-
 lib/teleterm/clusters/cluster.go              |  26 ++
 lib/teleterm/daemon/daemon.go                 |  21 +-
 9 files changed, 478 insertions(+), 94 deletions(-)

diff --git a/lib/teleterm/api/proto/v1/cluster.proto b/lib/teleterm/api/proto/v1/cluster.proto
index b826e7a43165a..81af7d946a376 100644
--- a/lib/teleterm/api/proto/v1/cluster.proto
+++ b/lib/teleterm/api/proto/v1/cluster.proto
@@ -33,6 +33,10 @@ message Cluster {
   bool leaf = 5;
   // User is the cluster access control list of the logged-in user
   LoggedInUser logged_in_user = 7;
+  // features describes the auth servers features
+  // Only present in situations where detailed
+  // information is queried from the auth server.
+  Features features = 8;
 }
 
 // LoggedInUser describes a logged-in user
@@ -90,3 +94,9 @@ message ResourceAccess {
   // delete determines "delete" access
   bool delete = 5;
 }
+
+// Features describes the auth servers features
+message Features {
+  // AdvancedAccessWorkflows enables search-based access requests
+  bool advanced_access_workflows = 1;
+}
diff --git a/lib/teleterm/api/proto/v1/service.proto b/lib/teleterm/api/proto/v1/service.proto
index 677b05fbba2c4..028d51255eafe 100644
--- a/lib/teleterm/api/proto/v1/service.proto
+++ b/lib/teleterm/api/proto/v1/service.proto
@@ -30,8 +30,10 @@ option go_package = "github.com/gravitational/teleport/lib/teleterm/v1";
 // TerminalService describes Teleterm service
 service TerminalService {
   // ListRootClusters lists root clusters
+  // Does not include detailed cluster information that would require a network request.
   rpc ListRootClusters(ListClustersRequest) returns (ListClustersResponse);
   // ListLeafClusters lists leaf clusters
+  // Does not include detailed cluster information that would require a network request.
   rpc ListLeafClusters(ListLeafClustersRequest) returns (ListClustersResponse);
   // GetAllDatabases lists all databases without pagination
   rpc GetAllDatabases(GetAllDatabasesRequest) returns (GetAllDatabasesResponse);
@@ -89,7 +91,8 @@ service TerminalService {
 
   // GetAuthSettings returns cluster auth settigns
   rpc GetAuthSettings(GetAuthSettingsRequest) returns (AuthSettings);
-  // GetCluster returns a cluster
+  // GetCluster returns cluster. Makes a network request and includes detailed
+  // information about enterprise features availabed on the connected auth server
   rpc GetCluster(GetClusterRequest) returns (Cluster);
   // Login logs in a user to a cluster
   rpc Login(LoginRequest) returns (EmptyResponse);
diff --git a/lib/teleterm/api/protogen/golang/v1/cluster.pb.go b/lib/teleterm/api/protogen/golang/v1/cluster.pb.go
index c34e42e885bb1..4857c0622a82e 100644
--- a/lib/teleterm/api/protogen/golang/v1/cluster.pb.go
+++ b/lib/teleterm/api/protogen/golang/v1/cluster.pb.go
@@ -58,6 +58,10 @@ type Cluster struct {
 	Leaf bool `protobuf:"varint,5,opt,name=leaf,proto3" json:"leaf,omitempty"`
 	// User is the cluster access control list of the logged-in user
 	LoggedInUser *LoggedInUser `protobuf:"bytes,7,opt,name=logged_in_user,json=loggedInUser,proto3" json:"logged_in_user,omitempty"`
+	// features describes the auth servers features
+	// Only present in situations where detailed
+	// information is queried from the auth server.
+	Features *Features `protobuf:"bytes,8,opt,name=features,proto3" json:"features,omitempty"`
 }
 
 func (x *Cluster) Reset() {
@@ -134,6 +138,13 @@ func (x *Cluster) GetLoggedInUser() *LoggedInUser {
 	return nil
 }
 
+func (x *Cluster) GetFeatures() *Features {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
 // LoggedInUser describes a logged-in user
 type LoggedInUser struct {
 	state         protoimpl.MessageState
@@ -452,12 +463,61 @@ func (x *ResourceAccess) GetDelete() bool {
 	return false
 }
 
+// Features describes the auth servers features
+type Features struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// AdvancedAccessWorkflows enables search-based access requests
+	AdvancedAccessWorkflows bool `protobuf:"varint,1,opt,name=advanced_access_workflows,json=advancedAccessWorkflows,proto3" json:"advanced_access_workflows,omitempty"`
+}
+
+func (x *Features) Reset() {
+	*x = Features{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_v1_cluster_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Features) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Features) ProtoMessage() {}
+
+func (x *Features) ProtoReflect() protoreflect.Message {
+	mi := &file_v1_cluster_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Features.ProtoReflect.Descriptor instead.
+func (*Features) Descriptor() ([]byte, []int) {
+	return file_v1_cluster_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *Features) GetAdvancedAccessWorkflows() bool {
+	if x != nil {
+		return x.AdvancedAccessWorkflows
+	}
+	return false
+}
+
 var File_v1_cluster_proto protoreflect.FileDescriptor
 
 var file_v1_cluster_proto_rawDesc = []byte{
 	0x0a, 0x10, 0x76, 0x31, 0x2f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x12, 0x14, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72,
-	0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x22, 0xca, 0x01, 0x0a, 0x07, 0x43, 0x6c, 0x75,
+	0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x22, 0x86, 0x02, 0x0a, 0x07, 0x43, 0x6c, 0x75,
 	0x73, 0x74, 0x65, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28,
 	0x09, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02,
 	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72,
@@ -470,80 +530,88 @@ var file_v1_cluster_proto_rawDesc = []byte{
 	0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74,
 	0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x67, 0x67, 0x65,
 	0x64, 0x49, 0x6e, 0x55, 0x73, 0x65, 0x72, 0x52, 0x0c, 0x6c, 0x6f, 0x67, 0x67, 0x65, 0x64, 0x49,
-	0x6e, 0x55, 0x73, 0x65, 0x72, 0x22, 0xad, 0x01, 0x0a, 0x0c, 0x4c, 0x6f, 0x67, 0x67, 0x65, 0x64,
-	0x49, 0x6e, 0x55, 0x73, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x72, 0x6f,
-	0x6c, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73,
-	0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x73, 0x68, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x73, 0x18, 0x03,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x73, 0x73, 0x68, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x73, 0x12,
-	0x2b, 0x0a, 0x03, 0x61, 0x63, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x74,
-	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c,
-	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x43, 0x4c, 0x52, 0x03, 0x61, 0x63, 0x6c, 0x12, 0x27, 0x0a, 0x0f,
-	0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18,
-	0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x73, 0x22, 0xa4, 0x06, 0x0a, 0x03, 0x41, 0x43, 0x4c, 0x12, 0x40, 0x0a,
-	0x08, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69,
-	0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41,
-	0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x08, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12,
-	0x4d, 0x0a, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f,
-	0x72, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6e, 0x55, 0x73, 0x65, 0x72, 0x12, 0x3a, 0x0a, 0x08, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65,
+	0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x46,
+	0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x52, 0x08, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65,
+	0x73, 0x22, 0xad, 0x01, 0x0a, 0x0c, 0x4c, 0x6f, 0x67, 0x67, 0x65, 0x64, 0x49, 0x6e, 0x55, 0x73,
+	0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x12, 0x1d, 0x0a, 0x0a,
+	0x73, 0x73, 0x68, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x09, 0x73, 0x73, 0x68, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x73, 0x12, 0x2b, 0x0a, 0x03, 0x61,
+	0x63, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
 	0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0e,
-	0x61, 0x75, 0x74, 0x68, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x12, 0x3a,
-	0x0a, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61,
-	0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63,
-	0x65, 0x73, 0x73, 0x52, 0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x05, 0x75, 0x73,
-	0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x41, 0x43, 0x4c, 0x52, 0x03, 0x61, 0x63, 0x6c, 0x12, 0x27, 0x0a, 0x0f, 0x61, 0x63, 0x74, 0x69,
+	0x76, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x73, 0x22, 0xa4, 0x06, 0x0a, 0x03, 0x41, 0x43, 0x4c, 0x12, 0x40, 0x0a, 0x08, 0x73, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e,
+	0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x52, 0x08, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x4d, 0x0a, 0x0f, 0x61,
+	0x75, 0x74, 0x68, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
+	0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x12, 0x3a, 0x0a, 0x05, 0x72, 0x6f,
+	0x6c, 0x65, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65,
 	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31,
 	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52,
-	0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x12, 0x4f, 0x0a, 0x10, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65,
-	0x64, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d,
-	0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x43,
-	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x12, 0x3c, 0x0a, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74,
-	0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
-	0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x06, 0x65,
-	0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x3c, 0x0a, 0x06, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x05, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
 	0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x06, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x73, 0x12, 0x3e, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x08,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
-	0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x73, 0x12, 0x38, 0x0a, 0x04, 0x61, 0x70, 0x70, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x05, 0x75, 0x73, 0x65,
+	0x72, 0x73, 0x12, 0x4f, 0x0a, 0x10, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x63, 0x6c,
+	0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74,
+	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c,
+	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x52, 0x0f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x65, 0x64, 0x43, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x73, 0x12, 0x3c, 0x0a, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74,
+	0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74,
+	0x73, 0x12, 0x3c, 0x0a, 0x06, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28,
 	0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72,
 	0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x04, 0x61, 0x70, 0x70, 0x73, 0x12, 0x36, 0x0a,
-	0x03, 0x64, 0x62, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76,
-	0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x52, 0x03, 0x64, 0x62, 0x73, 0x12, 0x46, 0x0a, 0x0b, 0x6b, 0x75, 0x62, 0x65, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76,
-	0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x52, 0x0b, 0x6b, 0x75, 0x62, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x4d, 0x0a,
-	0x0f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73,
-	0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x06, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12,
+	0x3e, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d,
+	0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12,
+	0x38, 0x0a, 0x04, 0x61, 0x70, 0x70, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e,
+	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61,
+	0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x52, 0x04, 0x61, 0x70, 0x70, 0x73, 0x12, 0x36, 0x0a, 0x03, 0x64, 0x62, 0x73,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
 	0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0e, 0x61, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x22, 0x7c, 0x0a, 0x0e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x12,
-	0x0a, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x6c, 0x69,
-	0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x65, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x04, 0x72, 0x65, 0x61, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x65, 0x64, 0x69, 0x74, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x65, 0x64, 0x69, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x63, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x63, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x06, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x42, 0x33, 0x5a, 0x31, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f,
-	0x6c, 0x69, 0x62, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2f, 0x76, 0x31, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x03, 0x64, 0x62,
+	0x73, 0x12, 0x46, 0x0a, 0x0b, 0x6b, 0x75, 0x62, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
+	0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0b, 0x6b, 0x75,
+	0x62, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x4d, 0x0a, 0x0f, 0x61, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x0c, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x24, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x74, 0x65,
+	0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x0e, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x22, 0x7c, 0x0a, 0x0e, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6c, 0x69,
+	0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x12, 0x12,
+	0x0a, 0x04, 0x72, 0x65, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x72, 0x65,
+	0x61, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x65, 0x64, 0x69, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x04, 0x65, 0x64, 0x69, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x16,
+	0x0a, 0x06, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06,
+	0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x22, 0x46, 0x0a, 0x08, 0x46, 0x65, 0x61, 0x74, 0x75, 0x72,
+	0x65, 0x73, 0x12, 0x3a, 0x0a, 0x19, 0x61, 0x64, 0x76, 0x61, 0x6e, 0x63, 0x65, 0x64, 0x5f, 0x61,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x73, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x17, 0x61, 0x64, 0x76, 0x61, 0x6e, 0x63, 0x65, 0x64, 0x41,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x57, 0x6f, 0x72, 0x6b, 0x66, 0x6c, 0x6f, 0x77, 0x73, 0x42, 0x33,
+	0x5a, 0x31, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61,
+	0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x2f, 0x6c, 0x69, 0x62, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d,
+	0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -558,33 +626,35 @@ func file_v1_cluster_proto_rawDescGZIP() []byte {
 	return file_v1_cluster_proto_rawDescData
 }
 
-var file_v1_cluster_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_v1_cluster_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
 var file_v1_cluster_proto_goTypes = []interface{}{
 	(*Cluster)(nil),        // 0: teleport.terminal.v1.Cluster
 	(*LoggedInUser)(nil),   // 1: teleport.terminal.v1.LoggedInUser
 	(*ACL)(nil),            // 2: teleport.terminal.v1.ACL
 	(*ResourceAccess)(nil), // 3: teleport.terminal.v1.ResourceAccess
+	(*Features)(nil),       // 4: teleport.terminal.v1.Features
 }
 var file_v1_cluster_proto_depIdxs = []int32{
 	1,  // 0: teleport.terminal.v1.Cluster.logged_in_user:type_name -> teleport.terminal.v1.LoggedInUser
-	2,  // 1: teleport.terminal.v1.LoggedInUser.acl:type_name -> teleport.terminal.v1.ACL
-	3,  // 2: teleport.terminal.v1.ACL.sessions:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 3: teleport.terminal.v1.ACL.auth_connectors:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 4: teleport.terminal.v1.ACL.roles:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 5: teleport.terminal.v1.ACL.users:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 6: teleport.terminal.v1.ACL.trusted_clusters:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 7: teleport.terminal.v1.ACL.events:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 8: teleport.terminal.v1.ACL.tokens:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 9: teleport.terminal.v1.ACL.servers:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 10: teleport.terminal.v1.ACL.apps:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 11: teleport.terminal.v1.ACL.dbs:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 12: teleport.terminal.v1.ACL.kubeservers:type_name -> teleport.terminal.v1.ResourceAccess
-	3,  // 13: teleport.terminal.v1.ACL.access_requests:type_name -> teleport.terminal.v1.ResourceAccess
-	14, // [14:14] is the sub-list for method output_type
-	14, // [14:14] is the sub-list for method input_type
-	14, // [14:14] is the sub-list for extension type_name
-	14, // [14:14] is the sub-list for extension extendee
-	0,  // [0:14] is the sub-list for field type_name
+	4,  // 1: teleport.terminal.v1.Cluster.features:type_name -> teleport.terminal.v1.Features
+	2,  // 2: teleport.terminal.v1.LoggedInUser.acl:type_name -> teleport.terminal.v1.ACL
+	3,  // 3: teleport.terminal.v1.ACL.sessions:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 4: teleport.terminal.v1.ACL.auth_connectors:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 5: teleport.terminal.v1.ACL.roles:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 6: teleport.terminal.v1.ACL.users:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 7: teleport.terminal.v1.ACL.trusted_clusters:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 8: teleport.terminal.v1.ACL.events:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 9: teleport.terminal.v1.ACL.tokens:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 10: teleport.terminal.v1.ACL.servers:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 11: teleport.terminal.v1.ACL.apps:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 12: teleport.terminal.v1.ACL.dbs:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 13: teleport.terminal.v1.ACL.kubeservers:type_name -> teleport.terminal.v1.ResourceAccess
+	3,  // 14: teleport.terminal.v1.ACL.access_requests:type_name -> teleport.terminal.v1.ResourceAccess
+	15, // [15:15] is the sub-list for method output_type
+	15, // [15:15] is the sub-list for method input_type
+	15, // [15:15] is the sub-list for extension type_name
+	15, // [15:15] is the sub-list for extension extendee
+	0,  // [0:15] is the sub-list for field type_name
 }
 
 func init() { file_v1_cluster_proto_init() }
@@ -641,6 +711,18 @@ func file_v1_cluster_proto_init() {
 				return nil
 			}
 		}
+		file_v1_cluster_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Features); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -648,7 +730,7 @@ func file_v1_cluster_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_v1_cluster_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   4,
+			NumMessages:   5,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/lib/teleterm/api/protogen/js/v1/cluster_pb.d.ts b/lib/teleterm/api/protogen/js/v1/cluster_pb.d.ts
index df5006cfbebb8..43674de59b855 100644
--- a/lib/teleterm/api/protogen/js/v1/cluster_pb.d.ts
+++ b/lib/teleterm/api/protogen/js/v1/cluster_pb.d.ts
@@ -29,6 +29,12 @@ export class Cluster extends jspb.Message {
     setLoggedInUser(value?: LoggedInUser): Cluster;
 
 
+    hasFeatures(): boolean;
+    clearFeatures(): void;
+    getFeatures(): Features | undefined;
+    setFeatures(value?: Features): Cluster;
+
+
     serializeBinary(): Uint8Array;
     toObject(includeInstance?: boolean): Cluster.AsObject;
     static toObject(includeInstance: boolean, msg: Cluster): Cluster.AsObject;
@@ -47,6 +53,7 @@ export namespace Cluster {
         connected: boolean,
         leaf: boolean,
         loggedInUser?: LoggedInUser.AsObject,
+        features?: Features.AsObject,
     }
 }
 
@@ -233,3 +240,24 @@ export namespace ResourceAccess {
         pb_delete: boolean,
     }
 }
+
+export class Features extends jspb.Message { 
+    getAdvancedAccessWorkflows(): boolean;
+    setAdvancedAccessWorkflows(value: boolean): Features;
+
+
+    serializeBinary(): Uint8Array;
+    toObject(includeInstance?: boolean): Features.AsObject;
+    static toObject(includeInstance: boolean, msg: Features): Features.AsObject;
+    static extensions: {[key: number]: jspb.ExtensionFieldInfo<jspb.Message>};
+    static extensionsBinary: {[key: number]: jspb.ExtensionFieldBinaryInfo<jspb.Message>};
+    static serializeBinaryToWriter(message: Features, writer: jspb.BinaryWriter): void;
+    static deserializeBinary(bytes: Uint8Array): Features;
+    static deserializeBinaryFromReader(message: Features, reader: jspb.BinaryReader): Features;
+}
+
+export namespace Features {
+    export type AsObject = {
+        advancedAccessWorkflows: boolean,
+    }
+}
diff --git a/lib/teleterm/api/protogen/js/v1/cluster_pb.js b/lib/teleterm/api/protogen/js/v1/cluster_pb.js
index 4e88512edca43..c8f481c31d198 100644
--- a/lib/teleterm/api/protogen/js/v1/cluster_pb.js
+++ b/lib/teleterm/api/protogen/js/v1/cluster_pb.js
@@ -17,6 +17,7 @@ var global = (function() { return this || window || global || self || Function('
 
 goog.exportSymbol('proto.teleport.terminal.v1.ACL', null, global);
 goog.exportSymbol('proto.teleport.terminal.v1.Cluster', null, global);
+goog.exportSymbol('proto.teleport.terminal.v1.Features', null, global);
 goog.exportSymbol('proto.teleport.terminal.v1.LoggedInUser', null, global);
 goog.exportSymbol('proto.teleport.terminal.v1.ResourceAccess', null, global);
 /**
@@ -103,6 +104,27 @@ if (goog.DEBUG && !COMPILED) {
    */
   proto.teleport.terminal.v1.ResourceAccess.displayName = 'proto.teleport.terminal.v1.ResourceAccess';
 }
+/**
+ * Generated by JsPbCodeGenerator.
+ * @param {Array=} opt_data Optional initial data array, typically from a
+ * server response, or constructed directly in Javascript. The array is used
+ * in place and becomes part of the constructed object. It is not cloned.
+ * If no data is provided, the constructed object will be empty, but still
+ * valid.
+ * @extends {jspb.Message}
+ * @constructor
+ */
+proto.teleport.terminal.v1.Features = function(opt_data) {
+  jspb.Message.initialize(this, opt_data, 0, -1, null, null);
+};
+goog.inherits(proto.teleport.terminal.v1.Features, jspb.Message);
+if (goog.DEBUG && !COMPILED) {
+  /**
+   * @public
+   * @override
+   */
+  proto.teleport.terminal.v1.Features.displayName = 'proto.teleport.terminal.v1.Features';
+}
 
 
 
@@ -140,7 +162,8 @@ proto.teleport.terminal.v1.Cluster.toObject = function(includeInstance, msg) {
     proxyHost: jspb.Message.getFieldWithDefault(msg, 3, ""),
     connected: jspb.Message.getBooleanFieldWithDefault(msg, 4, false),
     leaf: jspb.Message.getBooleanFieldWithDefault(msg, 5, false),
-    loggedInUser: (f = msg.getLoggedInUser()) && proto.teleport.terminal.v1.LoggedInUser.toObject(includeInstance, f)
+    loggedInUser: (f = msg.getLoggedInUser()) && proto.teleport.terminal.v1.LoggedInUser.toObject(includeInstance, f),
+    features: (f = msg.getFeatures()) && proto.teleport.terminal.v1.Features.toObject(includeInstance, f)
   };
 
   if (includeInstance) {
@@ -202,6 +225,11 @@ proto.teleport.terminal.v1.Cluster.deserializeBinaryFromReader = function(msg, r
       reader.readMessage(value,proto.teleport.terminal.v1.LoggedInUser.deserializeBinaryFromReader);
       msg.setLoggedInUser(value);
       break;
+    case 8:
+      var value = new proto.teleport.terminal.v1.Features;
+      reader.readMessage(value,proto.teleport.terminal.v1.Features.deserializeBinaryFromReader);
+      msg.setFeatures(value);
+      break;
     default:
       reader.skipField();
       break;
@@ -274,6 +302,14 @@ proto.teleport.terminal.v1.Cluster.serializeBinaryToWriter = function(message, w
       proto.teleport.terminal.v1.LoggedInUser.serializeBinaryToWriter
     );
   }
+  f = message.getFeatures();
+  if (f != null) {
+    writer.writeMessage(
+      8,
+      f,
+      proto.teleport.terminal.v1.Features.serializeBinaryToWriter
+    );
+  }
 };
 
 
@@ -404,6 +440,43 @@ proto.teleport.terminal.v1.Cluster.prototype.hasLoggedInUser = function() {
 };
 
 
+/**
+ * optional Features features = 8;
+ * @return {?proto.teleport.terminal.v1.Features}
+ */
+proto.teleport.terminal.v1.Cluster.prototype.getFeatures = function() {
+  return /** @type{?proto.teleport.terminal.v1.Features} */ (
+    jspb.Message.getWrapperField(this, proto.teleport.terminal.v1.Features, 8));
+};
+
+
+/**
+ * @param {?proto.teleport.terminal.v1.Features|undefined} value
+ * @return {!proto.teleport.terminal.v1.Cluster} returns this
+*/
+proto.teleport.terminal.v1.Cluster.prototype.setFeatures = function(value) {
+  return jspb.Message.setWrapperField(this, 8, value);
+};
+
+
+/**
+ * Clears the message field making it undefined.
+ * @return {!proto.teleport.terminal.v1.Cluster} returns this
+ */
+proto.teleport.terminal.v1.Cluster.prototype.clearFeatures = function() {
+  return this.setFeatures(undefined);
+};
+
+
+/**
+ * Returns whether this field is set.
+ * @return {boolean}
+ */
+proto.teleport.terminal.v1.Cluster.prototype.hasFeatures = function() {
+  return jspb.Message.getField(this, 8) != null;
+};
+
+
 
 /**
  * List of repeated fields within this message type.
@@ -1701,4 +1774,134 @@ proto.teleport.terminal.v1.ResourceAccess.prototype.setDelete = function(value)
 };
 
 
+
+
+
+if (jspb.Message.GENERATE_TO_OBJECT) {
+/**
+ * Creates an object representation of this proto.
+ * Field names that are reserved in JavaScript and will be renamed to pb_name.
+ * Optional fields that are not set will be set to undefined.
+ * To access a reserved field use, foo.pb_<name>, eg, foo.pb_default.
+ * For the list of reserved names please see:
+ *     net/proto2/compiler/js/internal/generator.cc#kKeyword.
+ * @param {boolean=} opt_includeInstance Deprecated. whether to include the
+ *     JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @return {!Object}
+ */
+proto.teleport.terminal.v1.Features.prototype.toObject = function(opt_includeInstance) {
+  return proto.teleport.terminal.v1.Features.toObject(opt_includeInstance, this);
+};
+
+
+/**
+ * Static version of the {@see toObject} method.
+ * @param {boolean|undefined} includeInstance Deprecated. Whether to include
+ *     the JSPB instance for transitional soy proto support:
+ *     http://goto/soy-param-migration
+ * @param {!proto.teleport.terminal.v1.Features} msg The msg instance to transform.
+ * @return {!Object}
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.teleport.terminal.v1.Features.toObject = function(includeInstance, msg) {
+  var f, obj = {
+    advancedAccessWorkflows: jspb.Message.getBooleanFieldWithDefault(msg, 1, false)
+  };
+
+  if (includeInstance) {
+    obj.$jspbMessageInstance = msg;
+  }
+  return obj;
+};
+}
+
+
+/**
+ * Deserializes binary data (in protobuf wire format).
+ * @param {jspb.ByteSource} bytes The bytes to deserialize.
+ * @return {!proto.teleport.terminal.v1.Features}
+ */
+proto.teleport.terminal.v1.Features.deserializeBinary = function(bytes) {
+  var reader = new jspb.BinaryReader(bytes);
+  var msg = new proto.teleport.terminal.v1.Features;
+  return proto.teleport.terminal.v1.Features.deserializeBinaryFromReader(msg, reader);
+};
+
+
+/**
+ * Deserializes binary data (in protobuf wire format) from the
+ * given reader into the given message object.
+ * @param {!proto.teleport.terminal.v1.Features} msg The message object to deserialize into.
+ * @param {!jspb.BinaryReader} reader The BinaryReader to use.
+ * @return {!proto.teleport.terminal.v1.Features}
+ */
+proto.teleport.terminal.v1.Features.deserializeBinaryFromReader = function(msg, reader) {
+  while (reader.nextField()) {
+    if (reader.isEndGroup()) {
+      break;
+    }
+    var field = reader.getFieldNumber();
+    switch (field) {
+    case 1:
+      var value = /** @type {boolean} */ (reader.readBool());
+      msg.setAdvancedAccessWorkflows(value);
+      break;
+    default:
+      reader.skipField();
+      break;
+    }
+  }
+  return msg;
+};
+
+
+/**
+ * Serializes the message to binary data (in protobuf wire format).
+ * @return {!Uint8Array}
+ */
+proto.teleport.terminal.v1.Features.prototype.serializeBinary = function() {
+  var writer = new jspb.BinaryWriter();
+  proto.teleport.terminal.v1.Features.serializeBinaryToWriter(this, writer);
+  return writer.getResultBuffer();
+};
+
+
+/**
+ * Serializes the given message to binary data (in protobuf wire
+ * format), writing to the given BinaryWriter.
+ * @param {!proto.teleport.terminal.v1.Features} message
+ * @param {!jspb.BinaryWriter} writer
+ * @suppress {unusedLocalVariables} f is only used for nested messages
+ */
+proto.teleport.terminal.v1.Features.serializeBinaryToWriter = function(message, writer) {
+  var f = undefined;
+  f = message.getAdvancedAccessWorkflows();
+  if (f) {
+    writer.writeBool(
+      1,
+      f
+    );
+  }
+};
+
+
+/**
+ * optional bool advanced_access_workflows = 1;
+ * @return {boolean}
+ */
+proto.teleport.terminal.v1.Features.prototype.getAdvancedAccessWorkflows = function() {
+  return /** @type {boolean} */ (jspb.Message.getBooleanFieldWithDefault(this, 1, false));
+};
+
+
+/**
+ * @param {boolean} value
+ * @return {!proto.teleport.terminal.v1.Features} returns this
+ */
+proto.teleport.terminal.v1.Features.prototype.setAdvancedAccessWorkflows = function(value) {
+  return jspb.Message.setProto3BooleanField(this, 1, value);
+};
+
+
 goog.object.extend(exports, proto.teleport.terminal.v1);
diff --git a/lib/teleterm/api/protogen/js/v1/service_grpc_pb.js b/lib/teleterm/api/protogen/js/v1/service_grpc_pb.js
index 16721498c7e3a..96bab62366f8f 100644
--- a/lib/teleterm/api/protogen/js/v1/service_grpc_pb.js
+++ b/lib/teleterm/api/protogen/js/v1/service_grpc_pb.js
@@ -603,6 +603,7 @@ function deserialize_teleport_terminal_v1_SetGatewayTargetSubresourceNameRequest
 // TerminalService describes Teleterm service
 var TerminalServiceService = exports.TerminalServiceService = {
   // ListRootClusters lists root clusters
+// Does not include detailed cluster information that would require a network request.
 listRootClusters: {
     path: '/teleport.terminal.v1.TerminalService/ListRootClusters',
     requestStream: false,
@@ -615,6 +616,7 @@ listRootClusters: {
     responseDeserialize: deserialize_teleport_terminal_v1_ListClustersResponse,
   },
   // ListLeafClusters lists leaf clusters
+// Does not include detailed cluster information that would require a network request.
 listLeafClusters: {
     path: '/teleport.terminal.v1.TerminalService/ListLeafClusters',
     requestStream: false,
@@ -920,7 +922,8 @@ getAuthSettings: {
     responseSerialize: serialize_teleport_terminal_v1_AuthSettings,
     responseDeserialize: deserialize_teleport_terminal_v1_AuthSettings,
   },
-  // GetCluster returns a cluster
+  // GetCluster returns cluster. Makes a network request and includes detailed
+// information about enterprise features availabed on the connected auth server
 getCluster: {
     path: '/teleport.terminal.v1.TerminalService/GetCluster',
     requestStream: false,
diff --git a/lib/teleterm/apiserver/handler/handler_clusters.go b/lib/teleterm/apiserver/handler/handler_clusters.go
index a192e49f018dc..e234201a1a16f 100644
--- a/lib/teleterm/apiserver/handler/handler_clusters.go
+++ b/lib/teleterm/apiserver/handler/handler_clusters.go
@@ -76,7 +76,7 @@ func (s *Handler) RemoveCluster(ctx context.Context, req *api.RemoveClusterReque
 
 // GetCluster returns a cluster
 func (s *Handler) GetCluster(ctx context.Context, req *api.GetClusterRequest) (*api.Cluster, error) {
-	cluster, err := s.DaemonService.ResolveCluster(req.ClusterUri)
+	cluster, err := s.DaemonService.GetCluster(ctx, req.ClusterUri)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -86,7 +86,7 @@ func (s *Handler) GetCluster(ctx context.Context, req *api.GetClusterRequest) (*
 
 func newAPIRootCluster(cluster *clusters.Cluster) *api.Cluster {
 	loggedInUser := cluster.GetLoggedInUser()
-	return &api.Cluster{
+	apiCluster := &api.Cluster{
 		Uri:       cluster.URI.String(),
 		Name:      cluster.Name,
 		ProxyHost: cluster.GetProxyHost(),
@@ -98,6 +98,16 @@ func newAPIRootCluster(cluster *clusters.Cluster) *api.Cluster {
 			ActiveRequests: loggedInUser.ActiveRequests,
 		},
 	}
+
+	// Only include features in the api response if they
+	// exist on the supplied cluster
+	if cluster.Features != nil {
+		apiCluster.Features = &api.Features{
+			AdvancedAccessWorkflows: cluster.Features.GetAdvancedAccessWorkflows(),
+		}
+	}
+
+	return apiCluster
 }
 
 func newAPILeafCluster(leaf clusters.LeafCluster) *api.Cluster {
diff --git a/lib/teleterm/clusters/cluster.go b/lib/teleterm/clusters/cluster.go
index e91bea59ec5d2..6a20c2c618681 100644
--- a/lib/teleterm/clusters/cluster.go
+++ b/lib/teleterm/clusters/cluster.go
@@ -19,6 +19,7 @@ package clusters
 import (
 	"context"
 
+	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/client"
@@ -50,6 +51,10 @@ type Cluster struct {
 	clusterClient *client.TeleportClient
 	// clock is a clock for time-related operations
 	clock clockwork.Clock
+	// Auth server features
+	// only present where the auth client can be queried
+	// and set with GetClusterFeatures
+	Features *proto.Features
 }
 
 // Connected indicates if connection to the cluster can be established
@@ -57,6 +62,27 @@ func (c *Cluster) Connected() bool {
 	return c.status.Name != "" && !c.status.IsExpired(c.clock)
 }
 
+// GetClusterFeatures returns a list of features enabled/disabled by the auth server
+func (c *Cluster) GetClusterFeatures(ctx context.Context) (*proto.Features, error) {
+	var authPingResponse proto.PingResponse
+
+	err := addMetadataToRetryableError(ctx, func() error {
+		proxyClient, err := c.clusterClient.ConnectToProxy(ctx)
+		if err != nil {
+			return trace.Wrap(err)
+		}
+		defer proxyClient.Close()
+
+		authPingResponse, err = proxyClient.CurrentCluster().Ping(ctx)
+		return trace.Wrap(err)
+	})
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return authPingResponse.ServerFeatures, nil
+}
+
 // GetRoles returns currently logged-in user roles
 func (c *Cluster) GetRoles(ctx context.Context) ([]*types.Role, error) {
 	var roles []*types.Role
diff --git a/lib/teleterm/daemon/daemon.go b/lib/teleterm/daemon/daemon.go
index 0024afc9385aa..95cc25f693f8d 100644
--- a/lib/teleterm/daemon/daemon.go
+++ b/lib/teleterm/daemon/daemon.go
@@ -99,7 +99,9 @@ func (s *Service) RemoveCluster(ctx context.Context, uri string) error {
 	return nil
 }
 
-// ResolveCluster resolves a cluster by URI
+// ResolveCluster resolves a cluster by URI and returns
+// information stored in the profile along with a TeleportClient.
+// It will not include detailed information returned from the web/auth servers
 func (s *Service) ResolveCluster(uri string) (*clusters.Cluster, error) {
 	cluster, err := s.cfg.Storage.GetByResourceURI(uri)
 	if err != nil {
@@ -109,6 +111,23 @@ func (s *Service) ResolveCluster(uri string) (*clusters.Cluster, error) {
 	return cluster, nil
 }
 
+// GetCluster returns cluster information
+func (s *Service) GetCluster(ctx context.Context, uri string) (*clusters.Cluster, error) {
+	cluster, err := s.ResolveCluster(uri)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	features, err := cluster.GetClusterFeatures(ctx)
+	if err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	cluster.Features = features
+
+	return cluster, nil
+}
+
 // ClusterLogout logs a user out from the cluster
 func (s *Service) ClusterLogout(ctx context.Context, uri string) error {
 	cluster, err := s.ResolveCluster(uri)

From c78559dcf1cf4200612e8a2c64c99e63ca16dedf Mon Sep 17 00:00:00 2001
From: Michael Myers <michael.myers@goteleport.com>
Date: Thu, 20 Oct 2022 15:33:43 -0500
Subject: [PATCH 2/2] Update protofiles

---
 .../api/protogen/golang/v1/access_request.pb.go        |  7 ++++++-
 lib/teleterm/api/protogen/golang/v1/service.pb.go      | 10 ++++++++--
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/lib/teleterm/api/protogen/golang/v1/access_request.pb.go b/lib/teleterm/api/protogen/golang/v1/access_request.pb.go
index fd0c158ec1c00..0dd24322409cd 100644
--- a/lib/teleterm/api/protogen/golang/v1/access_request.pb.go
+++ b/lib/teleterm/api/protogen/golang/v1/access_request.pb.go
@@ -14,13 +14,14 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.23.0
 // 	protoc        (unknown)
 // source: v1/access_request.proto
 
 package v1
 
 import (
+	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
@@ -35,6 +36,10 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+// This is a compile-time assertion that a sufficiently up-to-date version
+// of the legacy proto package is being used.
+const _ = proto.ProtoPackageIsVersion4
+
 type AccessRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
diff --git a/lib/teleterm/api/protogen/golang/v1/service.pb.go b/lib/teleterm/api/protogen/golang/v1/service.pb.go
index 90123ff6e36e6..575ea4f72e7f6 100644
--- a/lib/teleterm/api/protogen/golang/v1/service.pb.go
+++ b/lib/teleterm/api/protogen/golang/v1/service.pb.go
@@ -4721,8 +4721,10 @@ const _ = grpc.SupportPackageIsVersion6
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
 type TerminalServiceClient interface {
 	// ListRootClusters lists root clusters
+	// Does not include detailed cluster information that would require a network request.
 	ListRootClusters(ctx context.Context, in *ListClustersRequest, opts ...grpc.CallOption) (*ListClustersResponse, error)
 	// ListLeafClusters lists leaf clusters
+	// Does not include detailed cluster information that would require a network request.
 	ListLeafClusters(ctx context.Context, in *ListLeafClustersRequest, opts ...grpc.CallOption) (*ListClustersResponse, error)
 	// GetAllDatabases lists all databases without pagination
 	GetAllDatabases(ctx context.Context, in *GetAllDatabasesRequest, opts ...grpc.CallOption) (*GetAllDatabasesResponse, error)
@@ -4778,7 +4780,8 @@ type TerminalServiceClient interface {
 	SetGatewayLocalPort(ctx context.Context, in *SetGatewayLocalPortRequest, opts ...grpc.CallOption) (*Gateway, error)
 	// GetAuthSettings returns cluster auth settigns
 	GetAuthSettings(ctx context.Context, in *GetAuthSettingsRequest, opts ...grpc.CallOption) (*AuthSettings, error)
-	// GetCluster returns a cluster
+	// GetCluster returns cluster. Makes a network request and includes detailed
+	// information about enterprise features availabed on the connected auth server
 	GetCluster(ctx context.Context, in *GetClusterRequest, opts ...grpc.CallOption) (*Cluster, error)
 	// Login logs in a user to a cluster
 	Login(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*EmptyResponse, error)
@@ -5140,8 +5143,10 @@ func (x *terminalServiceTransferFileClient) Recv() (*FileTransferProgress, error
 // TerminalServiceServer is the server API for TerminalService service.
 type TerminalServiceServer interface {
 	// ListRootClusters lists root clusters
+	// Does not include detailed cluster information that would require a network request.
 	ListRootClusters(context.Context, *ListClustersRequest) (*ListClustersResponse, error)
 	// ListLeafClusters lists leaf clusters
+	// Does not include detailed cluster information that would require a network request.
 	ListLeafClusters(context.Context, *ListLeafClustersRequest) (*ListClustersResponse, error)
 	// GetAllDatabases lists all databases without pagination
 	GetAllDatabases(context.Context, *GetAllDatabasesRequest) (*GetAllDatabasesResponse, error)
@@ -5197,7 +5202,8 @@ type TerminalServiceServer interface {
 	SetGatewayLocalPort(context.Context, *SetGatewayLocalPortRequest) (*Gateway, error)
 	// GetAuthSettings returns cluster auth settigns
 	GetAuthSettings(context.Context, *GetAuthSettingsRequest) (*AuthSettings, error)
-	// GetCluster returns a cluster
+	// GetCluster returns cluster. Makes a network request and includes detailed
+	// information about enterprise features availabed on the connected auth server
 	GetCluster(context.Context, *GetClusterRequest) (*Cluster, error)
 	// Login logs in a user to a cluster
 	Login(context.Context, *LoginRequest) (*EmptyResponse, error)