Add --callback flag to tsh login

[atburke]

This change adds the --callback flag to tsh login, which overrides the base URL printed when doing an SSO login. This allows the tsh SSO login flow to be completed on a remote host (as long as the host running tsh is accessible over HTTPS with the given callback url).

Resolves gravitational/customer-sensitive-requests#135.

Changelog: Added --callback flag to tsh login

[rosstimothy]

When I tested this out the browser opens to a page which shows 404 page not found.

[atburke]

When I tested this out the browser opens to a page which shows 404 page not found.

The setup needed for it to work is kind of specific. What flags did you pass to tsh login?

[rosstimothy]

When I tested this out the browser opens to a page which shows 404 page not found.

The setup needed for it to work is kind of specific. What flags did you pass to tsh login?

I think when I originally tested this flow that the callback was being served by my local Teleport Proxy. I tried again with nothing listening locally on port 443 with --callback=http://localhost and with --callback=http://alias-to-localhost which resulted in my browser showing This site can’t be reached. This makes sense because tsh is listening on a random port that isn't reflected in the callback. I was able to successfully login via --callback=http://localhost:55823 --bind-addr=127.0.0.1:55823, though I worry it may not be obvious to users that both options might be needed for this to truly work.

[jentfoo]

I am a little concerned about this change. I believe it's possible to safely introduce this feature, but right now customers could use it without realizing the security implications. I also think the enforcement of an https schema is important.

Please let me know your thoughts, thank you!

[jentfoo]

Thank you for adding the most recent changes. Given the direct prompt and schema enforcement I feel users can reasonably understand the risks of this feature.

[atburke]

Friendly ping @rosstimothy

[public-teleport-github-review-bot]

@atburke See the table below for backport results.

Branch	Result
branch/v14	Create PR

[webvictim]

Documentation is missing for this: #43373