Fix missing roles in access lists causing users to be locked out of their account

[rudream]

Purpose

This PR resolves #43775

This PR fixes an issue where users would be logged out and locked out of their accounts if their access list references a role which no longer exists. This can occur when the role in the access list has a TTL and expires.

When generating the UserLoginState, any access lists which reference one or more non-existent roles will be skipped entirely, and an audit event is emitted as a notice.

changelog: Fix missing roles in access lists causing users to be locked out of their account

[fspmarshall]

While use of deny rules in access lists is discouraged, we do not have a mechanism of preventing it, meaning that it isn't sane to skip roles as it might constitute a privilege escalation.

Because of the risk of malformed access lists breaking login, we've already made a single exception to this rule. We allow access list application to fail "atomically". I.e. we assume that failure to apply the entire access lists will not result in privilege escalation, and we make it the user's responsibility to only ever use access lists as a whole as a means of privilege escalation, not privilege limiting the way an individual role might be used.

We can solve missing roles locking out users, but it must be solved s.t. the entire access list that assigned the roles is skipped, rather than just skipping the specific role (i.e. none of the roles, traits, etc from that list get applied).

[rudream]

We can solve missing roles locking out users, but it must be solved s.t. the entire access list that assigned the roles is skipped, rather than just skipping the specific role (i.e. none of the roles, traits, etc from that list get applied).

@fspmarshall After confirming with the customer, I've gone with this approach and updated this PR.

[zmb3]

@smallinsky I would appreciate your review on this one too if you have a few minutes this week 🙏

[zmb3]

Just some minor cleanup suggestions.

[smallinsky]

LGTM.

[public-teleport-github-review-bot]

@rudream See the table below for backport results.

Branch	Result
branch/v16	Failed
branch/v17	Failed