fix: improve tsh logs when skipping auto Access Request by nklaassen · Pull Request #22048 · gravitational/teleport

nklaassen · 2023-02-18T01:16:44Z

Currently the tsh debug log is polluted with "errors" created by the automatic access request feature even in completely expected scenarios, e.g. when the user has no permission to create Resource Access Requests.

Before this change:

$ tsh ssh -d alice@one-auth
...<omitted>...
2023-02-17T15:30:16-08:00 DEBU [TSH]       unable to request access to node error:[
ERROR REPORT:
Original Error: *trace.BadParameterError user attempted a resource request but does not have any &#34;search_as_roles&#34;
Stack Trace:
        github.com/gravitational/teleport/api@v0.0.0/client/client.go:880 github.com/gravitational/teleport/api/client.(*Client).CreateAccessRequest
        github.com/gravitational/teleport/tool/tsh/tsh.go:2896 main.accessRequestForSSH.func1
        github.com/gravitational/teleport/lib/client/api.go:1351 github.com/gravitational/teleport/lib/client.(*TeleportClient).WithRootClusterClient
        github.com/gravitational/teleport/tool/tsh/tsh.go:2895 main.accessRequestForSSH
        github.com/gravitational/teleport/tool/tsh/tsh.go:2916 main.retryWithAccessRequest
        github.com/gravitational/teleport/tool/tsh/tsh.go:2993 main.onSSH
        github.com/gravitational/teleport/tool/tsh/tsh.go:1086 main.Run
        github.com/gravitational/teleport/tool/tsh/tsh.go:482 main.main
        runtime/proc.go:250 runtime.main
        runtime/asm_amd64.s:1598 runtime.goexit
User Message: user attempted a resource request but does not have any &#34;search_as_roles&#34;] tsh/tsh.go:2920

ERROR REPORT:
Original Error: *trace.AccessDeniedError access denied to alice connecting to one-auth:0@default@cluster-one
Stack Trace:
        github.com/gravitational/teleport/lib/client/client.go:1633 github.com/gravitational/teleport/lib/client.NewNodeClient
        github.com/gravitational/teleport/lib/client/client.go:1563 github.com/gravitational/teleport/lib/client.(*ProxyClient).ConnectToNode
        github.com/gravitational/teleport/lib/client/api.go:1451 github.com/gravitational/teleport/lib/client.(*TeleportClient).ConnectToNode
        github.com/gravitational/teleport/lib/client/api.go:1525 github.com/gravitational/teleport/lib/client.(*TeleportClient).runShellOrCommandOnSingleNode
        github.com/gravitational/teleport/lib/client/api.go:1408 github.com/gravitational/teleport/lib/client.(*TeleportClient).SSH
        github.com/gravitational/teleport/tool/tsh/tsh.go:2995 main.onSSH.func1.1
        github.com/gravitational/teleport/lib/client/api.go:504 github.com/gravitational/teleport/lib/client.RetryWithRelogin
        github.com/gravitational/teleport/tool/tsh/tsh.go:2994 main.onSSH.func1
        github.com/gravitational/teleport/tool/tsh/tsh.go:2907 main.retryWithAccessRequest
        github.com/gravitational/teleport/tool/tsh/tsh.go:2993 main.onSSH
        github.com/gravitational/teleport/tool/tsh/tsh.go:1086 main.Run
        github.com/gravitational/teleport/tool/tsh/tsh.go:482 main.main
        runtime/proc.go:250 runtime.main
        runtime/asm_amd64.s:1598 runtime.goexit
User Message: access denied to alice connecting to one-auth:0@default@cluster-one

After:

$ tsh ssh -d alice@one-auth
...<omitted>...
2023-02-17T16:42:29-08:00 DEBU [TSH]       Not attempting to automatically request access, reason: Resource Access Requests require usable "search_as_roles", none found for user "nklaassen" tsh/tsh.go:2922

ERROR REPORT:
Original Error: *trace.AccessDeniedError access denied to alice connecting to one-auth:0@default@cluster-one
Stack Trace:
        github.com/gravitational/teleport/lib/client/client.go:1633 github.com/gravitational/teleport/lib/client.NewNodeClient
        github.com/gravitational/teleport/lib/client/client.go:1563 github.com/gravitational/teleport/lib/client.(*ProxyClient).ConnectToNode
        github.com/gravitational/teleport/lib/client/api.go:1451 github.com/gravitational/teleport/lib/client.(*TeleportClient).ConnectToNode
        github.com/gravitational/teleport/lib/client/api.go:1525 github.com/gravitational/teleport/lib/client.(*TeleportClient).runShellOrCommandOnSingleNode
        github.com/gravitational/teleport/lib/client/api.go:1408 github.com/gravitational/teleport/lib/client.(*TeleportClient).SSH
        github.com/gravitational/teleport/tool/tsh/tsh.go:2997 main.onSSH.func1.1
        github.com/gravitational/teleport/lib/client/api.go:504 github.com/gravitational/teleport/lib/client.RetryWithRelogin
        github.com/gravitational/teleport/tool/tsh/tsh.go:2996 main.onSSH.func1
        github.com/gravitational/teleport/tool/tsh/tsh.go:2907 main.retryWithAccessRequest
        github.com/gravitational/teleport/tool/tsh/tsh.go:2995 main.onSSH
        github.com/gravitational/teleport/tool/tsh/tsh.go:1086 main.Run
        github.com/gravitational/teleport/tool/tsh/tsh.go:482 main.main
        runtime/proc.go:250 runtime.main
        runtime/asm_amd64.s:1598 runtime.goexit
User Message: access denied to alice connecting to one-auth:0@default@cluster-one

Resolves #21848

Currently the `tsh` debug log is polluted with "errors" created by the [automatic access request feature](https://goteleport.com/docs/access-controls/access-requests/resource-requests/?scope=enterprise#automatically-request-access-for-ssh) even in completely expected scenarios, e.g. when the user has no permission to create Resource Access Requests. Before this change: ``` $ tsh ssh -d alice@one-auth ...<omitted>... 2023-02-17T15:30:16-08:00 DEBU [TSH] unable to request access to node error:[ ERROR REPORT: Original Error: *trace.BadParameterError user attempted a resource request but does not have any "search_as_roles" Stack Trace: github.com/gravitational/teleport/api@v0.0.0/client/client.go:880 github.com/gravitational/teleport/api/client.(*Client).CreateAccessRequest github.com/gravitational/teleport/tool/tsh/tsh.go:2896 main.accessRequestForSSH.func1 github.com/gravitational/teleport/lib/client/api.go:1351 github.com/gravitational/teleport/lib/client.(*TeleportClient).WithRootClusterClient github.com/gravitational/teleport/tool/tsh/tsh.go:2895 main.accessRequestForSSH github.com/gravitational/teleport/tool/tsh/tsh.go:2916 main.retryWithAccessRequest github.com/gravitational/teleport/tool/tsh/tsh.go:2993 main.onSSH github.com/gravitational/teleport/tool/tsh/tsh.go:1086 main.Run github.com/gravitational/teleport/tool/tsh/tsh.go:482 main.main runtime/proc.go:250 runtime.main runtime/asm_amd64.s:1598 runtime.goexit User Message: user attempted a resource request but does not have any "search_as_roles"] tsh/tsh.go:2920 ERROR REPORT: Original Error: *trace.AccessDeniedError access denied to alice connecting to one-auth:0@default@cluster-one Stack Trace: github.com/gravitational/teleport/lib/client/client.go:1633 github.com/gravitational/teleport/lib/client.NewNodeClient github.com/gravitational/teleport/lib/client/client.go:1563 github.com/gravitational/teleport/lib/client.(*ProxyClient).ConnectToNode github.com/gravitational/teleport/lib/client/api.go:1451 github.com/gravitational/teleport/lib/client.(*TeleportClient).ConnectToNode github.com/gravitational/teleport/lib/client/api.go:1525 github.com/gravitational/teleport/lib/client.(*TeleportClient).runShellOrCommandOnSingleNode github.com/gravitational/teleport/lib/client/api.go:1408 github.com/gravitational/teleport/lib/client.(*TeleportClient).SSH github.com/gravitational/teleport/tool/tsh/tsh.go:2995 main.onSSH.func1.1 github.com/gravitational/teleport/lib/client/api.go:504 github.com/gravitational/teleport/lib/client.RetryWithRelogin github.com/gravitational/teleport/tool/tsh/tsh.go:2994 main.onSSH.func1 github.com/gravitational/teleport/tool/tsh/tsh.go:2907 main.retryWithAccessRequest github.com/gravitational/teleport/tool/tsh/tsh.go:2993 main.onSSH github.com/gravitational/teleport/tool/tsh/tsh.go:1086 main.Run github.com/gravitational/teleport/tool/tsh/tsh.go:482 main.main runtime/proc.go:250 runtime.main runtime/asm_amd64.s:1598 runtime.goexit User Message: access denied to alice connecting to one-auth:0@default@cluster-one ``` After: ``` $ tsh ssh -d alice@one-auth ...<omitted>... 2023-02-17T16:42:29-08:00 DEBU [TSH] Not attempting to automatically request access, reason: Resource Access Requests require usable "search_as_roles", none found for user "nklaassen" tsh/tsh.go:2922 ERROR REPORT: Original Error: *trace.AccessDeniedError access denied to alice connecting to one-auth:0@default@cluster-one Stack Trace: github.com/gravitational/teleport/lib/client/client.go:1633 github.com/gravitational/teleport/lib/client.NewNodeClient github.com/gravitational/teleport/lib/client/client.go:1563 github.com/gravitational/teleport/lib/client.(*ProxyClient).ConnectToNode github.com/gravitational/teleport/lib/client/api.go:1451 github.com/gravitational/teleport/lib/client.(*TeleportClient).ConnectToNode github.com/gravitational/teleport/lib/client/api.go:1525 github.com/gravitational/teleport/lib/client.(*TeleportClient).runShellOrCommandOnSingleNode github.com/gravitational/teleport/lib/client/api.go:1408 github.com/gravitational/teleport/lib/client.(*TeleportClient).SSH github.com/gravitational/teleport/tool/tsh/tsh.go:2997 main.onSSH.func1.1 github.com/gravitational/teleport/lib/client/api.go:504 github.com/gravitational/teleport/lib/client.RetryWithRelogin github.com/gravitational/teleport/tool/tsh/tsh.go:2996 main.onSSH.func1 github.com/gravitational/teleport/tool/tsh/tsh.go:2907 main.retryWithAccessRequest github.com/gravitational/teleport/tool/tsh/tsh.go:2995 main.onSSH github.com/gravitational/teleport/tool/tsh/tsh.go:1086 main.Run github.com/gravitational/teleport/tool/tsh/tsh.go:482 main.main runtime/proc.go:250 runtime.main runtime/asm_amd64.s:1598 runtime.goexit User Message: access denied to alice connecting to one-auth:0@default@cluster-one ```

public-teleport-github-review-bot · 2023-02-21T17:54:38Z

@nklaassen See the table below for backport results.

Branch	Result
branch/v10	Create PR
branch/v11	Create PR
branch/v12	Create PR

nklaassen added backport/branch/v10 labels Feb 18, 2023

github-actions Bot added size/sm tsh tsh - Teleport's command line tool for logging into nodes running Teleport. labels Feb 18, 2023

github-actions Bot requested review from probakowski and tobiaszheller February 18, 2023 01:17

zmb3 approved these changes Feb 18, 2023

View reviewed changes

rosstimothy approved these changes Feb 18, 2023

View reviewed changes

public-teleport-github-review-bot Bot removed request for probakowski and tobiaszheller February 18, 2023 03:07

nklaassen added this pull request to the merge queue Feb 21, 2023

Merged via the queue into master with commit d77fb5b Feb 21, 2023

This was referenced Feb 21, 2023

[v12] fix: improve tsh logs when skipping auto Access Request #22094

Merged

[v11] fix: improve tsh logs when skipping auto Access Request #22095

Merged

[v10] fix: improve tsh logs when skipping auto Access Request #22096

Merged

nklaassen deleted the nklaassen/auto-request-err-msg branch March 7, 2023 01:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: improve tsh logs when skipping auto Access Request#22048

fix: improve tsh logs when skipping auto Access Request#22048
nklaassen merged 1 commit intomasterfrom
nklaassen/auto-request-err-msg

nklaassen commented Feb 18, 2023

Uh oh!

public-teleport-github-review-bot Bot commented Feb 21, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

nklaassen commented Feb 18, 2023

Uh oh!

public-teleport-github-review-bot Bot commented Feb 21, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants