Entra ID integration: integration script updates and web onboarding prerequisites by justinas · Pull Request #42172 · gravitational/teleport

justinas · 2024-05-30T15:12:32Z

This (together with the Enterprise counterpart https://github.com/gravitational/teleport.e/pull/4273) is the last large changeset for the initial version of Entra ID integration.

This PR:

Updates Prehog protos with values for Entra ID (as introduced in https://github.com/gravitational/cloud/pull/9111)
Fixes a couple of bugs in the integration script discovered while testing end-to-end.
- Onboarding script now calls az login to make sure we have the necessary token to make calls to the "private" Azure API during onboarding.
Adds prerequisites for Enterprise web changes

changelog: Added support for Microsoft Entra ID directory synchronization (Teleport Enterprise only, preview)

Not used by the script. It is validated by the "plugins/validate" endpoint.

From https://github.com/gravitational/cloud/pull/9111

Lets user know that `az login` has completed and `teleport` is continuing its work.

CTA is 1-to-1 with prehog, but IntegrationEnrollKind is not.

This parameter is no longer accepted by the endpoint

justinas · 2024-05-30T16:23:04Z

 // UPGRADE_IGS_URL is enterprise upgrading to enterprise with Identity Governance & Security
 const UPGRADE_IGS_URL = 'https://goteleport.com/r/upgrade-igs';
+// UPGRADE_POLICY_URL is enterprise upgrading to enterprise with Policy
+export const UPGRADE_POLICY_URL = 'https://goteleport.com/r/upgrade-policy';


Added in https://github.com/gravitational/next/pull/2505

i'm sorry, i think i led you astray with how the destination link should be crafted (before policy, it didn't matter so much), do you mind changing both igs and policy destination? https://github.com/gravitational/next/pull/2505#discussion_r1621543575

We only need to change the redirect destination in next, the URLs in the frontend can stay, right?

github-actions · 2024-05-30T16:57:25Z

The PR changelog entry failed validation: The changelog entry must start with a letter.

github-actions · 2024-05-30T17:02:31Z

The PR changelog entry failed validation: The changelog entry must start with a letter.

jakule · 2024-05-30T17:16:40Z

Is this intentional? From what I see this points to your dev branch and not master

Not intentional, will revert 👍

jakule · 2024-05-30T17:20:08Z

+  if (!url) {
+    url = UPGRADE_COMMUNITY_URL;
+    if (isEnterprise) {


nit:

Suggested change

if (!url) {

url = UPGRADE_COMMUNITY_URL;

if (isEnterprise) {

if (!url && isEnterprise) {

url = UPGRADE_COMMUNITY_URL;

not sure that means the same thing 🤔

Yeah, if url is defined we want to use it, no matter if enterprise or not.

This reverts commit fc747a0.

kimlisa · 2024-05-31T00:28:51Z

 // UPGRADE_IGS_URL is enterprise upgrading to enterprise with Identity Governance & Security
 const UPGRADE_IGS_URL = 'https://goteleport.com/r/upgrade-igs';
+// UPGRADE_POLICY_URL is enterprise upgrading to enterprise with Policy
+export const UPGRADE_POLICY_URL = 'https://goteleport.com/r/upgrade-policy';


i'm sorry, i think i led you astray with how the destination link should be crafted (before policy, it didn't matter so much), do you mind changing both igs and policy destination? https://github.com/gravitational/next/pull/2505#discussion_r1621543575

kimlisa · 2024-05-31T00:40:27Z

+  if (!url) {
+    url = UPGRADE_COMMUNITY_URL;
+    if (isEnterprise) {


not sure that means the same thing 🤔

public-teleport-github-review-bot · 2024-05-31T14:13:28Z

@justinas See the table below for backport results.

Branch	Result
branch/v16	Failed

…rerequisites (#42172) * Remove integration name validation from web script Not used by the script. It is validated by the "plugins/validate" endpoint. * Add required frontend constants for Entra ID * Support Azure/Entra integrations in the list * Add IsPolicyEnabled to web config * Allow custom URL for ButtonLockedFeature * Add CTA_ENTRA_ID event type * Expose TAGInfoCache for use in e * Add LackingIgs option * Add Entra ID icon * Add Entra ID plugin to storybook * Bump e for dev build * Return underlying error in getPrivateAPIToken * Find default Azure subscription instead of the first one * Require user to re-login when provisioning Azure OIDC * Update prehog protos with Entra ID values From https://github.com/gravitational/cloud/pull/9111 * Suppress verbose warnings / information from az * Add an additional message after successful auth Lets user know that `az login` has completed and `teleport` is continuing its work. * Move EntraId constant to the bottom * Revert unintended changes to usageevents CTA is 1-to-1 with prehog, but IntegrationEnrollKind is not. * Remove integrationName validation asserts from test This parameter is no longer accepted by the endpoint * Revert "Bump e for dev build" This reverts commit fc747a0.

…rerequisites (#42172) (#42294) * Remove integration name validation from web script Not used by the script. It is validated by the "plugins/validate" endpoint. * Add required frontend constants for Entra ID * Support Azure/Entra integrations in the list * Add IsPolicyEnabled to web config * Allow custom URL for ButtonLockedFeature * Add CTA_ENTRA_ID event type * Expose TAGInfoCache for use in e * Add LackingIgs option * Add Entra ID icon * Add Entra ID plugin to storybook * Bump e for dev build * Return underlying error in getPrivateAPIToken * Find default Azure subscription instead of the first one * Require user to re-login when provisioning Azure OIDC * Update prehog protos with Entra ID values From https://github.com/gravitational/cloud/pull/9111 * Suppress verbose warnings / information from az * Add an additional message after successful auth Lets user know that `az login` has completed and `teleport` is continuing its work. * Move EntraId constant to the bottom * Revert unintended changes to usageevents CTA is 1-to-1 with prehog, but IntegrationEnrollKind is not. * Remove integrationName validation asserts from test This parameter is no longer accepted by the endpoint * Revert "Bump e for dev build" This reverts commit fc747a0.

…rerequisites (#42172) * Remove integration name validation from web script Not used by the script. It is validated by the "plugins/validate" endpoint. * Add required frontend constants for Entra ID * Support Azure/Entra integrations in the list * Add IsPolicyEnabled to web config * Allow custom URL for ButtonLockedFeature * Add CTA_ENTRA_ID event type * Expose TAGInfoCache for use in e * Add LackingIgs option * Add Entra ID icon * Add Entra ID plugin to storybook * Bump e for dev build * Return underlying error in getPrivateAPIToken * Find default Azure subscription instead of the first one * Require user to re-login when provisioning Azure OIDC * Update prehog protos with Entra ID values From https://github.com/gravitational/cloud/pull/9111 * Suppress verbose warnings / information from az * Add an additional message after successful auth Lets user know that `az login` has completed and `teleport` is continuing its work. * Move EntraId constant to the bottom * Revert unintended changes to usageevents CTA is 1-to-1 with prehog, but IntegrationEnrollKind is not. * Remove integrationName validation asserts from test This parameter is no longer accepted by the endpoint * Revert "Bump e for dev build" This reverts commit fc747a0.

* Entra ID reconciler: directory reconciler prerequisites (#40778) * Add Entra ID resource origin * Ignore ID and Revision from `header` in cmp * Add e_imports for MS Graph SDK * Entra ID integration: add proto definitions (#40997) * Entra ID integration boilerplate (#40998) * Add e imports for MS Graph SDK * Add ability to sign Entra ID OIDC JWTs, rework KID handling - Synthesize Key IDs for our JWT keys. For backwards compatibility, also include the same keys with an empty `kid` in JWKS. - Sign AWS OIDC tokens with a `kid=""` header claim, rather than omitting the `kid` claim altogether. See comment for details. * Add validation for Entra ID plugin * Fix typo in assertion function name * Update the OIDC JWKS test to expect the same key twice * Add Entra ID plugin type constant * go mod tidy * Fix expected JWKS size in integration test * Add basic tests for KeyID * Move Azure auth settings from Plugin to Integration * Address review comments * Add a unit test to ensure KeyID compatibility * Add license header to token_generator.go * Rename validation function per new conventions * Access Graph: sync AWS identity providers (#41368) * Add AWSSAMLProviderV1 to access graph proto * Access Graph: sync AWS SAML Providers * Parse SAML entity descriptor before sending to TAG * Add protos for AWS OIDC providers * Fetch AWS OIDC providers * Fetch signing certificates for AWS SAML providers * Deflake identity provider fetch test The concrete implementation of IAM mock uses a map, resulting in non-deterministic iteration order. Sort the results before comparing to alleviate. * Update lib/srv/discovery/fetchers/aws-sync/iam_test.go Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com> --------- Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com> * Access Graph: Entra ID application sync prerequisites (#41650) * Add access graph settings to Entra ID plugin * Move Entra ID labels to OSS * Add Entra resources and RPC to Access Graph proto * Add azure-oidc integration to web. Current code assumes that Integration is always either AwsOidc, or an external audit storage integration * Change app sso cache to a repeated field * Entra ID integration: add onboarding script (#41811) * Add Entra ID integration onboarding script * Adapt after proto update * Validate names in azure script handler, add test * Add license headers * Update Entra plugin test with SSO connector field * Fix lint * Remove leftover panics * Adjust success message * Downgrade log message level * Expect exactly 1 SP for MS Graph, improve errors * Properly extract hostname for enterprise app name * Comment on assuming the first subscription * Address review nits * Factor out sso info fetch into a function * fixup refactor * Add retry logic to app role assignment * Make godoc conventional * Entra ID integration: integration script updates and web onboarding prerequisites (#42172) * Remove integration name validation from web script Not used by the script. It is validated by the "plugins/validate" endpoint. * Add required frontend constants for Entra ID * Support Azure/Entra integrations in the list * Add IsPolicyEnabled to web config * Allow custom URL for ButtonLockedFeature * Add CTA_ENTRA_ID event type * Expose TAGInfoCache for use in e * Add LackingIgs option * Add Entra ID icon * Add Entra ID plugin to storybook * Bump e for dev build * Return underlying error in getPrivateAPIToken * Find default Azure subscription instead of the first one * Require user to re-login when provisioning Azure OIDC * Update prehog protos with Entra ID values From https://github.com/gravitational/cloud/pull/9111 * Suppress verbose warnings / information from az * Add an additional message after successful auth Lets user know that `az login` has completed and `teleport` is continuing its work. * Move EntraId constant to the bottom * Revert unintended changes to usageevents CTA is 1-to-1 with prehog, but IntegrationEnrollKind is not. * Remove integrationName validation asserts from test This parameter is no longer accepted by the endpoint * Revert "Bump e for dev build" This reverts commit fc747a0. * `go mod tidy` secondary modules --------- Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>

Justinas Stankevicius added 15 commits May 29, 2024 16:41

Remove integration name validation from web script

cfbaff7

Not used by the script. It is validated by the "plugins/validate" endpoint.

Add required frontend constants for Entra ID

d8414db

Support Azure/Entra integrations in the list

aea688f

Add IsPolicyEnabled to web config

a0d236f

Allow custom URL for ButtonLockedFeature

e75d789

Add CTA_ENTRA_ID event type

006a727

Expose TAGInfoCache for use in e

713c5b5

Add LackingIgs option

f3708ce

Add Entra ID icon

df5d884

Add Entra ID plugin to storybook

32c8a5b

Bump e for dev build

fc747a0

Return underlying error in getPrivateAPIToken

90a84b2

Find default Azure subscription instead of the first one

077fd1a

Require user to re-login when provisioning Azure OIDC

ac6fd15

Update prehog protos with Entra ID values

275b5cb

From https://github.com/gravitational/cloud/pull/9111

justinas changed the title ~~Entra ID integration: integration script updates and~~ Entra ID integration: integration script updates and web onboarding prerequisites May 30, 2024

Justinas Stankevicius added 5 commits May 30, 2024 18:34

Suppress verbose warnings / information from az

29ee969

Add an additional message after successful auth

1bf2cc8

Lets user know that `az login` has completed and `teleport` is continuing its work.

Move EntraId constant to the bottom

bdbff50

Revert unintended changes to usageevents

5b59f1b

CTA is 1-to-1 with prehog, but IntegrationEnrollKind is not.

Remove integrationName validation asserts from test

4c3fbf3

This parameter is no longer accepted by the endpoint

justinas commented May 30, 2024

View reviewed changes

justinas marked this pull request as ready for review May 30, 2024 16:56

github-actions Bot requested review from avatus and rudream May 30, 2024 16:57

github-actions Bot added size/sm ui labels May 30, 2024

justinas requested review from jakule and tigrato May 30, 2024 16:57

justinas requested review from kimlisa and removed request for avatus and rudream May 30, 2024 16:57

justinas added the backport/branch/v15 label May 30, 2024

jakule reviewed May 30, 2024

View reviewed changes

Revert "Bump e for dev build"

f4253a7

This reverts commit fc747a0.

kimlisa approved these changes May 31, 2024

View reviewed changes

justinas added backport/branch/v16 and removed backport/branch/v15 labels May 31, 2024

justinas requested a review from jakule May 31, 2024 13:28

jakule approved these changes May 31, 2024

View reviewed changes

public-teleport-github-review-bot Bot removed the request for review from tigrato May 31, 2024 13:53

justinas added this pull request to the merge queue May 31, 2024

Merged via the queue into master with commit 5eb9aa9 May 31, 2024

justinas deleted the justinas/entra-plugin-onboard-web branch May 31, 2024 14:12

justinas mentioned this pull request Jun 3, 2024

[v16] Entra ID integration: integration script updates and web prerequisites #42294

Merged

Conversation

justinas commented May 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented May 30, 2024

Uh oh!

github-actions Bot commented May 30, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

public-teleport-github-review-bot Bot commented May 31, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

justinas commented May 30, 2024 •

edited

Loading