Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ title: Access Requests with Mattermost
description: How to set up Teleport's Mattermost plugin for privilege elevation approvals.
---

This guide will explain how to set up Teleport with Mattermost, an open source
messaging platform. Teleport's Mattermost notifies individuals of
Access Requests. Users can then approve and deny Access Requests by following the
This guide explains how to integrate Teleport access requests with Mattermost, an open
source messaging platform. The Teleport Mattermost plugin notifies individuals of
access requests. Users can then approve and deny access requests by following the
message link, making it easier to implement security best practices without
compromising productivity.

Expand All @@ -17,13 +17,13 @@ compromising productivity.

- A Mattermost account with admin privileges. This plugin has been tested with
Mattermost v7.0.1.
- Either a Linux host or Kubernetes cluster where you will run the Mattermost plugin.
- Either a Linux host or Kubernetes cluster where you will run the Teleport Mattermost plugin.
- (!docs/pages/includes/tctl.mdx!)

## Step 1/8. Define RBAC resources

Before you set up the Mattermost plugin, you will need to enable Role Access
Requests in the Proxy or Auth Service.
Before you set up the Teleport Mattermost plugin, you need to enable Role Access
Requests in the Teleport Proxy Service or Teleport Auth Service.

(!/docs/pages/includes/plugins/editor-request-rbac.mdx!)

Expand All @@ -34,7 +34,7 @@ Requests in the Proxy or Auth Service.

We recommend installing Teleport plugins on the same host as the Teleport Proxy
Service. This is an ideal location as plugins have a low memory footprint, and
will require both public internet access and Teleport Auth Service access.
require both public internet access and Teleport Auth Service access.

</TabItem>

Expand Down Expand Up @@ -121,9 +121,9 @@ plugin to use these credentials and post messages in the right channels for your
workspace.

<Tabs>
<TabItem label="Executable">
The Mattermost plugin uses a config file in TOML format. On the host where you
will run the Mattermost plugin, generate a boilerplate config by running the
<TabItem label="Executable or Docker">
The Mattermost plugin uses a configuration file in TOML format. On the host where you
will run the Mattermost plugin, generate a boilerplate configuration by running the
following commands:

```code
Expand Down Expand Up @@ -172,7 +172,7 @@ For example, this configuration will notify `first.last@example.com` and
the `Town Square` channel in the `myteam` team of any Access Request events:

<Tabs>
<TabItem label="Executable">
<TabItem label="Executable or Docker">

```toml
recipients = [
Expand Down Expand Up @@ -222,7 +222,7 @@ Mattermost.
The final configuration should look similar to this:

<Tabs>
<TabItem label="Executable" >
<TabItem label="Executable or Docker" >
```yaml
# example mattermost configuration TOML file
[teleport]
Expand Down Expand Up @@ -272,6 +272,14 @@ DEBU Watcher connected mattermost/main.go:260
DEBU Mattermost API health check finished ok mattermost/main.go:19
```
</TabItem>
<TabItem label="Docker">

Run the plugin:

```bash
$ docker run -v <path-to-config>:/etc/teleport-mattermost.toml public.ecr.aws/gravitational/teleport-plugin-mattermost:(=teleport.version=) start
```
</TabItem>
<TabItem label="Helm Chart">
After modifying your configuration, run the bot with the following command:

Expand Down