set cluster connector name on signin for first cloud user by JanKaczmarkiewicz · Pull Request #17834 · gravitational/teleport

JanKaczmarkiewicz · 2022-10-26T12:21:56Z

What

Automatically set the passwordless cluster authentication preference for cloud users.

When the first user chooses to sign in with passwordless, cluster_auth_preference.connector_name will be set to "passwordless". This will instruct login and sign-in flow to use passwordless as the default method (the user can still choose another available method).

Testing guide:

checkout to the branch (make sure teleport.e is cloned)
Create a new tenant in the staging sales-center
build a dev version of teleport-ent and use it in the staging tenant (see https://github.com/gravitational/teleport.e/blob/master/dev-deploy.md for exact steps)
If you run into a missing DEB_PATH error you can temporarily restore build.assets/charts/Dockerfile old code before https://github.com/gravitational/teleport/pull/17597/files#diff-3b89b68ec0c7abb15cbf57af77d2f3cced352cbe65159772d3b680ef76f9915e
Go to the invite link created in step 2. and use the passwordless form to authenticate
In Web UI create a second user.
After entering an invite link the second user should see the passwordless form initially instead of the password + TOTP form

Implements RFD: https://github.com/gravitational/cloud/pull/2405
Fixes: https://github.com/gravitational/cloud/issues/2069

…itive case)

codingllama

Looks good, thanks for the updating the PR description too.

Holding out a bit more for:

Tests for clusters with non-"local" connectors and
A resolution to the "NewTestAuthServer" thread

Co-authored-by: Alan Parra <alan.parra@goteleport.com>

…ange custom connector" Co-authored-by: Alan Parra <alan.parra@goteleport.com>

* feat: set cluster connector name on first user signin * perf: move is passwordless enabled before get users * fix: move logic to correct handler * test: test setting default passwordless connector name for cloud (positive case) * test: add negative test cases * refactor: flatten nested code * fix: remove return in case auth preference was not set * fix: run logic only in cloud * docs: typo * fix: run when passwordless * test: move trySettingConnectorNameToPasswordless as separete method * docs: add safety comments * test: rephrase safety comment * refactor: remove space between call and error check * fix: remove unnessesery error log from trySettingConnectorNameToPasswordless * refactor: pass context, rename session context * docs: add description to trySettingConnectorNameToPasswordless * test: add descriptive assertion text Co-authored-by: Alan Parra <alan.parra@goteleport.com> * refactor: simplify error handilng Co-authored-by: Alan Parra <alan.parra@goteleport.com> * fix: check for non default setting Co-authored-by: Alan Parra <alan.parra@goteleport.com> * test: correct RPID * refactor: simplify user creation Co-authored-by: Alan Parra <alan.parra@goteleport.com> * docs: fix typo Co-authored-by: Alan Parra <alan.parra@goteleport.com> * test: reorder name filed in the test cases struct * test: better names for test cases * refactor: generate token instead of hardcoding arbitrary value * test: remove user agent header * fix: check for empty password * docs: add passwordless check description Co-authored-by: Alan Parra <alan.parra@goteleport.com> * test: add "first cloud sign-in does not change custom connector" * test: use correct number of users in "first cloud sign-in does not change custom connector" Co-authored-by: Alan Parra <alan.parra@goteleport.com> * test: remove is cloud check from test helpers, instead use config * refactor: store is_passwordless_registration in variable * test: first cloud sign-in with password does not change connector * refactor: change isPasswordlessRegistration name Co-authored-by: Alan Parra <alan.parra@goteleport.com>

…18445) * feat: set cluster connector name on first user signin * perf: move is passwordless enabled before get users * fix: move logic to correct handler * test: test setting default passwordless connector name for cloud (positive case) * test: add negative test cases * refactor: flatten nested code * fix: remove return in case auth preference was not set * fix: run logic only in cloud * docs: typo * fix: run when passwordless * test: move trySettingConnectorNameToPasswordless as separete method * docs: add safety comments * test: rephrase safety comment * refactor: remove space between call and error check * fix: remove unnessesery error log from trySettingConnectorNameToPasswordless * refactor: pass context, rename session context * docs: add description to trySettingConnectorNameToPasswordless * test: add descriptive assertion text Co-authored-by: Alan Parra <alan.parra@goteleport.com> * refactor: simplify error handilng Co-authored-by: Alan Parra <alan.parra@goteleport.com> * fix: check for non default setting Co-authored-by: Alan Parra <alan.parra@goteleport.com> * test: correct RPID * refactor: simplify user creation Co-authored-by: Alan Parra <alan.parra@goteleport.com> * docs: fix typo Co-authored-by: Alan Parra <alan.parra@goteleport.com> * test: reorder name filed in the test cases struct * test: better names for test cases * refactor: generate token instead of hardcoding arbitrary value * test: remove user agent header * fix: check for empty password * docs: add passwordless check description Co-authored-by: Alan Parra <alan.parra@goteleport.com> * test: add "first cloud sign-in does not change custom connector" * test: use correct number of users in "first cloud sign-in does not change custom connector" Co-authored-by: Alan Parra <alan.parra@goteleport.com> * test: remove is cloud check from test helpers, instead use config * refactor: store is_passwordless_registration in variable * test: first cloud sign-in with password does not change connector * refactor: change isPasswordlessRegistration name Co-authored-by: Alan Parra <alan.parra@goteleport.com> Co-authored-by: Alan Parra <alan.parra@goteleport.com>

Jan Kaczmarkiewicz and others added 6 commits October 26, 2022 14:16

feat: set cluster connector name on first user signin

c8db1c5

Merge branch 'master' into jan/cloud-passwordless-default-preference

a0d54d8

perf: move is passwordless enabled before get users

d60f9b3

fix: move logic to correct handler

5f334de

test: test setting default passwordless connector name for cloud (pos…

b37f47c

…itive case)

Merge branch 'master' into jan/cloud-passwordless-default-preference

eb724ad

JanKaczmarkiewicz requested review from codingllama November 7, 2022 15:47

test: add negative test cases

09ebdb0

JanKaczmarkiewicz requested review from jimbishopp and mcbattirola November 7, 2022 15:49

JanKaczmarkiewicz marked this pull request as ready for review November 7, 2022 15:55

github-actions Bot requested review from Joerger and fspmarshall November 7, 2022 15:56

jimbishopp reviewed Nov 7, 2022

View reviewed changes

Comment thread lib/web/apiserver.go Outdated

Comment thread lib/web/apiserver_test.go Outdated

mcbattirola reviewed Nov 7, 2022

View reviewed changes

Comment thread lib/web/apiserver.go Outdated

Jan Kaczmarkiewicz added 6 commits November 7, 2022 17:18

refactor: flatten nested code

8610483

fix: remove return in case auth preference was not set

ac29535

fix: run logic only in cloud

2b9fa5d

docs: typo

1c09af5

fix: run when passwordless

0926d89

test: move trySettingConnectorNameToPasswordless as separete method

404ada5

JanKaczmarkiewicz removed request for Joerger and fspmarshall November 7, 2022 19:05

Jan Kaczmarkiewicz added 2 commits November 7, 2022 20:28

docs: add safety comments

c839620

test: rephrase safety comment

d04034b

jimbishopp requested a review from nklaassen November 7, 2022 19:51

nklaassen reviewed Nov 8, 2022

View reviewed changes

Comment thread lib/web/apiserver.go Outdated

refactor: remove space between call and error check

dca7fa1

fix: check for empty password

cebfa0f

codingllama reviewed Nov 10, 2022

View reviewed changes

Comment thread lib/auth/helpers.go Outdated

Comment thread lib/web/apiserver.go Outdated

Comment thread lib/web/apiserver_test.go Outdated

codingllama reviewed Nov 10, 2022

View reviewed changes

JanKaczmarkiewicz and others added 2 commits November 10, 2022 21:56

docs: add passwordless check description

b2b637c

Co-authored-by: Alan Parra <alan.parra@goteleport.com>

test: add "first cloud sign-in does not change custom connector"

d338ebb

codingllama reviewed Nov 10, 2022

View reviewed changes

Comment thread lib/web/apiserver_test.go Outdated

JanKaczmarkiewicz and others added 2 commits November 10, 2022 23:08

test: use correct number of users in "first cloud sign-in does not ch…

30ecf20

…ange custom connector" Co-authored-by: Alan Parra <alan.parra@goteleport.com>

test: remove is cloud check from test helpers, instead use config

42e66c4

codingllama approved these changes Nov 10, 2022

View reviewed changes

nklaassen approved these changes Nov 10, 2022

View reviewed changes

JanKaczmarkiewicz and others added 5 commits November 14, 2022 11:34

Merge branch 'master' into jan/cloud-passwordless-default-preference

0b26f76

refactor: store is_passwordless_registration in variable

78f2129

test: first cloud sign-in with password does not change connector

5033ee1

refactor: change isPasswordlessRegistration name

2fa7479

Merge branch 'master' into jan/cloud-passwordless-default-preference

ef1e900

JanKaczmarkiewicz enabled auto-merge (squash) November 14, 2022 14:00

Merge branch 'master' into jan/cloud-passwordless-default-preference

40f23e9

JanKaczmarkiewicz disabled auto-merge November 14, 2022 14:40

JanKaczmarkiewicz enabled auto-merge (squash) November 14, 2022 14:45

JanKaczmarkiewicz disabled auto-merge November 14, 2022 14:50

JanKaczmarkiewicz enabled auto-merge (squash) November 14, 2022 14:50

JanKaczmarkiewicz merged commit 2a9167b into master Nov 14, 2022

JanKaczmarkiewicz mentioned this pull request Nov 14, 2022

[v11] set cluster connector name on signin for first cloud user #18445

Merged

zmb3 deleted the jan/cloud-passwordless-default-preference branch November 14, 2022 17:40

zmb3 mentioned this pull request Jan 31, 2023

[v10] Disable disk-based logging for TestResizeTerminal #20872

Closed

Joerger mentioned this pull request Dec 9, 2023

MFA for Admin Actions: cluster config #35542

Merged

Joerger mentioned this pull request Dec 16, 2023

Move Automatic Cloud Passwordless preference setting to the Auth service #35807

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

set cluster connector name on signin for first cloud user#17834

set cluster connector name on signin for first cloud user#17834
JanKaczmarkiewicz merged 41 commits intomasterfrom
jan/cloud-passwordless-default-preference

JanKaczmarkiewicz commented Oct 26, 2022 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codingllama left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

JanKaczmarkiewicz commented Oct 26, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Testing guide:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codingllama left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

JanKaczmarkiewicz commented Oct 26, 2022 •

edited

Loading