Skip to content

Remove device trust relationship as an example of token:create permis…#33159

Merged
lsgunn-teleport merged 1 commit intomasterfrom
LG/remove-trusted-device-example
Oct 9, 2023
Merged

Remove device trust relationship as an example of token:create permis…#33159
lsgunn-teleport merged 1 commit intomasterfrom
LG/remove-trusted-device-example

Conversation

@lsgunn-teleport
Copy link
Copy Markdown
Contributor

…sions

Previously, device trust was included as an example:

With these permissions, users assigned to the role can generate tokens to enroll
a server, application, or database, establish a trust relationship between a root cluster and a new Teleport Proxy Service or leaf cluster, or configure a device trust relationship for a managed device.

Based on the request:

The ability to create a join token is a sensitive action within Teleport. Currently the role to create join tokens is not scoped, allowing the creation of any type of join token. This means that the same permissions that allow you to join a server also could establish an entire new proxy / leaf, or also establish a Device Trust relationship through MDM (https://github.com/gravitational/teleport.e/pull/1018#discussion_r1156604808). The ability for the joining to influence the configuration and state of your cluster may result in unexpected security concerns, for that reason you should consider the ability to create join token's akin to an administrative role.

This PR removes that example.

@lsgunn-teleport lsgunn-teleport temporarily deployed to vercel October 9, 2023 17:30 — with GitHub Actions Inactive
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Oct 9, 2023

🤖 Vercel preview here: https://docs-7ncpfb54t-goteleport.vercel.app/docs/ver/preview

@lsgunn-teleport lsgunn-teleport added this pull request to the merge queue Oct 9, 2023
Merged via the queue into master with commit 018430d Oct 9, 2023
@lsgunn-teleport lsgunn-teleport deleted the LG/remove-trusted-device-example branch October 9, 2023 20:14
@public-teleport-github-review-bot
Copy link
Copy Markdown

@lsgunn-teleport See the table below for backport results.

Branch Result
branch/v12 Failed
branch/v13 Failed
branch/v14 Failed

@lsgunn-teleport
Copy link
Copy Markdown
Contributor Author

Change was incorporated into these PRs instead:
#33166
#33165
#33164

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants