diff --git a/api/go.mod b/api/go.mod index c2d324e33f2c7..3843f5362e9c7 100644 --- a/api/go.mod +++ b/api/go.mod @@ -6,7 +6,7 @@ require ( github.com/go-piv/piv-go v1.10.0 github.com/gogo/protobuf v1.3.2 github.com/google/go-cmp v0.5.9 - github.com/gravitational/trace v1.1.19 + github.com/gravitational/trace v1.2.0 github.com/jonboulle/clockwork v0.3.0 github.com/russellhaering/gosaml2 v0.8.1 github.com/sirupsen/logrus v1.9.0 diff --git a/api/go.sum b/api/go.sum index 13514da027de9..fac566230982b 100644 --- a/api/go.sum +++ b/api/go.sum @@ -136,8 +136,8 @@ github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm4 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk= -github.com/gravitational/trace v1.1.19 h1:MHxfSvqHRNyOGF2440JILYrLdseAhCMErenSkg+i8+s= -github.com/gravitational/trace v1.1.19/go.mod h1:n0ijrq6psJY0sOI/NzLp+xdd8xl79jjwzVOFHDY6+kQ= +github.com/gravitational/trace v1.2.0 h1:ODrkITHAmumFOTgCLb2zScMRCT2VQVXyIzDpN2CyN6s= +github.com/gravitational/trace v1.2.0/go.mod h1:n0ijrq6psJY0sOI/NzLp+xdd8xl79jjwzVOFHDY6+kQ= github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw= github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 h1:BZHcxBETFHIdVyhyEfOvn/RdU/QGdLI4y34qQGjGWO0= github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks= diff --git a/go.mod b/go.mod index 89268fea9d89d..6ba489fb0f1b5 100644 --- a/go.mod +++ b/go.mod @@ -67,7 +67,7 @@ require ( github.com/gravitational/reporting v0.0.0-20210923183620-237377721140 github.com/gravitational/roundtrip v1.0.2 github.com/gravitational/teleport/api v0.0.0 - github.com/gravitational/trace v1.1.19 + github.com/gravitational/trace v1.2.0 github.com/gravitational/ttlmap v0.0.0-20171116003245-91fd36b9004c github.com/grpc-ecosystem/go-grpc-middleware/providers/openmetrics/v2 v2.0.0-20220714234348-5d0f5fedefc0 github.com/hashicorp/golang-lru v0.5.4 diff --git a/go.sum b/go.sum index a7e3c0cc33d6c..08e6205097654 100644 --- a/go.sum +++ b/go.sum @@ -737,8 +737,8 @@ github.com/gravitational/roundtrip v1.0.2 h1:eOCY0NEKKaB0ksJmvhO6lPMFz1pIIef+vyP github.com/gravitational/roundtrip v1.0.2/go.mod h1:fuI1booM2hLRA/B/m5MRAPOU6mBZNYcNycono2UuTw0= github.com/gravitational/sftp v1.13.6-0.20220927202521-0e74d42f8055 h1:iUQqKNaW1lywWSVZkeCQX0vygPfJ63UGx6Ng94e2t1o= github.com/gravitational/sftp v1.13.6-0.20220927202521-0e74d42f8055/go.mod h1:wHDZ0IZX6JcBYRK1TH9bcVq8G7TLpVHYIGJRFnmPfxg= -github.com/gravitational/trace v1.1.19 h1:MHxfSvqHRNyOGF2440JILYrLdseAhCMErenSkg+i8+s= -github.com/gravitational/trace v1.1.19/go.mod h1:n0ijrq6psJY0sOI/NzLp+xdd8xl79jjwzVOFHDY6+kQ= +github.com/gravitational/trace v1.2.0 h1:ODrkITHAmumFOTgCLb2zScMRCT2VQVXyIzDpN2CyN6s= +github.com/gravitational/trace v1.2.0/go.mod h1:n0ijrq6psJY0sOI/NzLp+xdd8xl79jjwzVOFHDY6+kQ= github.com/gravitational/ttlmap v0.0.0-20171116003245-91fd36b9004c h1:C2iWDiod8vQ3YnOiCdMP9qYeg2UifQ8KSk36r0NswSE= github.com/gravitational/ttlmap v0.0.0-20171116003245-91fd36b9004c/go.mod h1:erKVikttPjeHKDCQZcqowEqiccy23cJAqPadZgfjNm8= github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 h1:pdN6V1QBWetyv/0+wjACpqVH+eVULgEjkurDLq3goeM= diff --git a/lib/auth/auth.go b/lib/auth/auth.go index 0300dbb917693..43823a7db5bc6 100644 --- a/lib/auth/auth.go +++ b/lib/auth/auth.go @@ -1563,16 +1563,14 @@ func (a *Server) WithUserLock(username string, authenticateFn func() error) erro user.GetName(), defaults.MaxAccountRecoveryAttempts, apiutils.HumanTimeFormat(status.RecoveryAttemptLockExpires)) err := trace.AccessDenied(MaxFailedAttemptsErrMsg) - err.AddField(ErrFieldKeyUserMaxedAttempts, true) - return err + return trace.WithField(err, ErrFieldKeyUserMaxedAttempts, true) } if status.LockExpires.After(a.clock.Now().UTC()) { log.Debugf("%v exceeds %v failed login attempts, locked until %v", user.GetName(), defaults.MaxLoginAttempts, apiutils.HumanTimeFormat(status.LockExpires)) err := trace.AccessDenied(MaxFailedAttemptsErrMsg) - err.AddField(ErrFieldKeyUserMaxedAttempts, true) - return err + return trace.WithField(err, ErrFieldKeyUserMaxedAttempts, true) } } fnErr := authenticateFn() @@ -1616,8 +1614,7 @@ func (a *Server) WithUserLock(username string, authenticateFn func() error) erro } retErr := trace.AccessDenied(MaxFailedAttemptsErrMsg) - retErr.AddField(ErrFieldKeyUserMaxedAttempts, true) - return retErr + return trace.WithField(retErr, ErrFieldKeyUserMaxedAttempts, true) } // PreAuthenticatedSignIn is for MFA authentication methods where the password diff --git a/lib/auth/github.go b/lib/auth/github.go index fff417a1d1a8e..92ff368191da4 100644 --- a/lib/auth/github.go +++ b/lib/auth/github.go @@ -506,19 +506,20 @@ func (a *Server) validateGithubAuthCallback(ctx context.Context, diagCtx *ssoDia // optional parameter: error_description errDesc := q.Get("error_description") - return nil, trace.OAuth2(oauth2.ErrorInvalidRequest, errParam, q).AddUserMessage("Github returned error: %v [%v]", errDesc, errParam) + oauthErr := trace.OAuth2(oauth2.ErrorInvalidRequest, errParam, q) + return nil, trace.WithUserMessage(oauthErr, "Github returned error: %v [%v]", errDesc, errParam) } code := q.Get("code") if code == "" { - return nil, trace.OAuth2(oauth2.ErrorInvalidRequest, - "code query param must be set", q).AddUserMessage("Invalid parameters received from Github.") + oauthErr := trace.OAuth2(oauth2.ErrorInvalidRequest, "code query param must be set", q) + return nil, trace.WithUserMessage(oauthErr, "Invalid parameters received from Github.") } stateToken := q.Get("state") if stateToken == "" { - return nil, trace.OAuth2(oauth2.ErrorInvalidRequest, - "missing state query param", q).AddUserMessage("Invalid parameters received from Github.") + oauthErr := trace.OAuth2(oauth2.ErrorInvalidRequest, "missing state query param", q) + return nil, trace.WithUserMessage(oauthErr, "Invalid parameters received from Github.") } diagCtx.requestID = stateToken diff --git a/lib/auth/oidc.go b/lib/auth/oidc.go index d8b72828bf29d..ff7e621b8b39a 100644 --- a/lib/auth/oidc.go +++ b/lib/auth/oidc.go @@ -412,19 +412,20 @@ func (a *Server) validateOIDCAuthCallback(ctx context.Context, diagCtx *ssoDiagC // optional parameter: error_description errDesc := q.Get("error_description") - return nil, trace.OAuth2(oauth2.ErrorInvalidRequest, errParam, q).AddUserMessage("OIDC provider returned error: %v [%v]", errDesc, errParam) + oidcErr := trace.OAuth2(oauth2.ErrorInvalidRequest, errParam, q) + return nil, trace.WithUserMessage(oidcErr, "OIDC provider returned error: %v [%v]", errDesc, errParam) } code := q.Get("code") if code == "" { - return nil, trace.OAuth2( - oauth2.ErrorInvalidRequest, "code query param must be set", q).AddUserMessage("Invalid parameters received from OIDC provider.") + oidcErr := trace.OAuth2(oauth2.ErrorInvalidRequest, "code query param must be set", q) + return nil, trace.WithUserMessage(oidcErr, "Invalid parameters received from OIDC provider.") } stateToken := q.Get("state") if stateToken == "" { - return nil, trace.OAuth2( - oauth2.ErrorInvalidRequest, "missing state query param", q).AddUserMessage("Invalid parameters received from OIDC provider.") + oidcErr := trace.OAuth2(oauth2.ErrorInvalidRequest, "missing state query param", q) + return nil, trace.WithUserMessage(oidcErr, "Invalid parameters received from OIDC provider.") } diagCtx.requestID = stateToken @@ -486,8 +487,8 @@ func (a *Server) validateOIDCAuthCallback(ctx context.Context, diagCtx *ssoDiagC log.Debugf("OIDC user %q expires at: %v.", ident.Email, ident.ExpiresAt) if len(connector.GetClaimsToRoles()) == 0 { - return nil, trace.BadParameter("no claims to roles mapping, check connector documentation"). - AddUserMessage("Claims-to-roles mapping is empty, SSO user will never have any roles.") + oidcErr := trace.BadParameter("no claims to roles mapping, check connector documentation") + return nil, trace.WithUserMessage(oidcErr, "Claims-to-roles mapping is empty, SSO user will never have any roles.") } log.Debugf("Applying %v OIDC claims to roles mappings.", len(connector.GetClaimsToRoles())) diagCtx.info.OIDCClaimsToRoles = connector.GetClaimsToRoles() diff --git a/lib/auth/saml.go b/lib/auth/saml.go index 700cab4d42cb1..b4aa374aefe09 100644 --- a/lib/auth/saml.go +++ b/lib/auth/saml.go @@ -504,7 +504,8 @@ func (a *Server) validateSAMLResponse(ctx context.Context, diagCtx *ssoDiagConte assertionInfo, err := provider.RetrieveAssertionInfo(samlResponse) if err != nil { - return nil, trace.AccessDenied("received response with incorrect or missing attribute statements, please check the identity provider configuration to make sure that mappings for claims/attribute statements are set up correctly. , failed to retrieve SAML assertion info from response: %v.", err).AddUserMessage("Failed to retrieve assertion info. This may indicate IdP configuration error.") + samlErr := trace.AccessDenied("received response with incorrect or missing attribute statements, please check the identity provider configuration to make sure that mappings for claims/attribute statements are set up correctly. , failed to retrieve SAML assertion info from response: %v.", err) + return nil, trace.WithUserMessage(samlErr, "Failed to retrieve assertion info. This may indicate IdP configuration error.") } if assertionInfo != nil { @@ -522,11 +523,13 @@ func (a *Server) validateSAMLResponse(ctx context.Context, diagCtx *ssoDiagConte } if assertionInfo.WarningInfo.InvalidTime { - return nil, trace.AccessDenied("invalid time in SAML assertion info").AddUserMessage("SAML assertion info contained warning: invalid time.") + samlErr := trace.AccessDenied("invalid time in SAML assertion info") + return nil, trace.WithUserMessage(samlErr, "SAML assertion info contained warning: invalid time.") } if assertionInfo.WarningInfo.NotInAudience { - return nil, trace.AccessDenied("no audience in SAML assertion info").AddUserMessage("SAML: not in expected audience. Check auth connector audience field and IdP configuration for typos and other errors.") + samlErr := trace.AccessDenied("no audience in SAML assertion info") + return nil, trace.WithUserMessage(samlErr, "SAML: not in expected audience. Check auth connector audience field and IdP configuration for typos and other errors.") } log.Debugf("Obtained SAML assertions for %q.", assertionInfo.NameID) @@ -547,7 +550,8 @@ func (a *Server) validateSAMLResponse(ctx context.Context, diagCtx *ssoDiagConte diagCtx.info.SAMLAttributesToRoles = connector.GetAttributesToRoles() if len(connector.GetAttributesToRoles()) == 0 { - return nil, trace.BadParameter("no attributes to roles mapping, check connector documentation").AddUserMessage("Attributes-to-roles mapping is empty, SSO user will never have any roles.") + samlErr := trace.BadParameter("no attributes to roles mapping, check connector documentation") + return nil, trace.WithUserMessage(samlErr, "Attributes-to-roles mapping is empty, SSO user will never have any roles.") } log.Debugf("Applying %v SAML attribute to roles mappings.", len(connector.GetAttributesToRoles())) diff --git a/lib/services/lock.go b/lib/services/lock.go index aac395449c2e4..a3aa4bce1b2d7 100644 --- a/lib/services/lock.go +++ b/lib/services/lock.go @@ -35,8 +35,7 @@ func LockInForceAccessDenied(lock types.Lock) error { s += ": " + msg } err := trace.AccessDenied(s) - err.AddField("lock-in-force", lock) - return err + return trace.WithField(err, "lock-in-force", lock) } // StrictLockingModeAccessDenied is an AccessDenied error returned when strict