Fix disconnect_expired_cert when Kube Identity forwarding is used#24913
Fix disconnect_expired_cert when Kube Identity forwarding is used#24913
disconnect_expired_cert when Kube Identity forwarding is used#24913Conversation
Teleport 13 introduces the identity forwarding mechanism that allows a proxy to forward the client's identity without re-signing a new certificate on his behalf. Proxy uses its certificate key pair and it's valid for a long period of time resulting in the current version not respecting the connection termination. This PR removes the parsing of the connection certificate and uses the value provided by the unmapped identity - supports the new and old forwarding methods. Fixes #24910
| RouteToCluster: tt.routeToCluster, | ||
| KubernetesCluster: tt.kubernetesCluster, | ||
| ActiveRequests: tt.activeRequests, | ||
| Expires: certExpiration, |
There was a problem hiding this comment.
If I add this line, but don't add the fixes above, the test still passes.
This makes me think we don't actually have a test that verifies this behavior is correct.
There was a problem hiding this comment.
That was a nice catch although the test was correct. I didn't remove the expiration from the certificate and it was picking that value.
Fixed by 1cbc54b
ibeckermayer
left a comment
ibeckermayer
left a comment
There was a problem hiding this comment.
I'm not quite clear on what identity is what here, but I notice that you say
This PR removes the parsing of the connection certificate and uses the value provided by the unmapped identity - supporting the new and old forwarding methods.
but you are only using something called UnmappedIdentity in the kubeResourceDeniedAccessMsg. In setupContext, you're using identity := authCtx.Identity.GetIdentity(). Probably a definitional matter, but just double checking.
When I refer unmapped identity what I wanted to say is: the value received from the unmapped identity in the TLS certificate or the unmapped value received as impersonation. For both cases, the unmapped expire is adjusted with the identity roles rules after mapping the identity to local. That's why I use the mapped identity (Identity) to get the value. Sorry for the confusion |
public-teleport-github-review-bot
Bot
removed request for
Joerger and
fspmarshall
4 participants
Teleport 13 introduces the identity forwarding mechanism that allows a proxy to forward the client's identity without re-signing a new certificate on his behalf. Proxy uses its certificate key pair and it's valid for a long period of time resulting in the current version not respecting the connection termination.
This PR removes the parsing of the connection certificate and uses the value provided by the unmapped identity - supporting the new and old forwarding methods.
Fixes #24910