Add tctl plugins install awsic by smallinsky · Pull Request #51239 · gravitational/teleport

smallinsky · 2025-01-20T17:21:51Z

What

AWS CLI to install AWS IC plugin with local creds.

usage:

tctl plugins install awsic --token $(op read "op://Employee/AWS IC Teleport Identity Provider/token") --url https://scim.eu-north-1.amazonaws.com/.../scim/v2 --default-owner=marek --region=eu-north-1 --arn=arn:aws:sso:::instance/ssoins...

Depends-On: #52239

kopiczko · 2025-01-31T14:28:10Z

+		},
+	}
+
+	_, err = args.plugins.CreatePlugin(ctx, req)


Don't we expose an API like we do with Okta? It would be nice to stop creating those plugins directly and start using the same API that the UI does

I suspect that it would be the best way to provide the sort of extended validation that @flyinghermit is suggesting as well, which we really can't do right now because all of the requisite code is on teleport.e.

smallinsky

LGTM

flyinghermit

Looks good, just a few comments to ensure cli installation handles default dependencies and validation that is on par with the plugin enrollment supported in the UI.

flyinghermit · 2025-02-03T15:26:02Z

+			},
+		},
+	}
+


before installing plugin, I think we should check if saml service provider for the identity center is installed and guide user to do so if it isn't.

Not sure what you mean - do you mean the SAML setup for Okta, or the SAML IdP for IC to call into?

I meant for the SAML IdP. Though I realized that this is not required for the use case we are trying to address for a customer, so my initial comment is somewhat invalid.

My new found concern here is that, once we release these CLI based integration configuration, although we specifically implemented this to one customer that wants to use system credential and defer auth to their IdP, it still gives chance for other customers to try this feature. In that case, they might end up in a bad state and we should avoid providing footgun where possible. For example, they might try integration with system credential but manage auth via SAML IdP.

Since we have no way to detect and prevent such usage, what do you think about adding a flag --no-saml-idp-auth (or something similar) to differentiate this behaviour. And if the --no-saml-idp-auth flag is NOT set, we check for SAML service provider.

I'm not opposed in principal, but I think it would be better in a separate PR, mainly because I'd like a bit more time to think about the UX and I want to get this out the door.

But yeah, I can imagine some flags like

--[no-]saml-idp-auth Configure the integration with/without a SAML Identity Provider service. --saml-idp-provider PROVIDER-NAME The name of the SAML IdP provider service to validate. Defaults to `whatever-actual-default-is`.

flyinghermit · 2025-02-05T14:12:24Z

+			},
+		},
+	}
+


I meant for the SAML IdP. Though I realized that this is not required for the use case we are trying to address for a customer, so my initial comment is somewhat invalid.

My new found concern here is that, once we release these CLI based integration configuration, although we specifically implemented this to one customer that wants to use system credential and defer auth to their IdP, it still gives chance for other customers to try this feature. In that case, they might end up in a bad state and we should avoid providing footgun where possible. For example, they might try integration with system credential but manage auth via SAML IdP.

Since we have no way to detect and prevent such usage, what do you think about adding a flag --no-saml-idp-auth (or something similar) to differentiate this behaviour. And if the --no-saml-idp-auth flag is NOT set, we check for SAML service provider.

Adds a comand-line installation tool for the AWS Identity Center integration. Co-authored-by: Marek Smoliński <marek@goteleport.com> Co-authored-by: Trent Clatke <trent@goteleport.com>

Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>

public-teleport-github-review-bot · 2025-02-19T22:52:37Z

@smallinsky See the table below for backport results.

Branch	Result
branch/v17	Failed

Backports #51239 Adds a comand-line installation tool for the AWS Identity Center integration. Co-authored-by: Marek Smoliński <marek@goteleport.com> Co-authored-by: Trent Clatke <trent@goteleport.com> Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com> --------- Co-authored-by: Trent Clatke <trent@goteleport.com> Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>

Backports #51239 Adds a comand-line installation tool for the AWS Identity Center integration. --------- Co-authored-by: Marek Smoliński <marek@goteleport.com> Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>

tcsc force-pushed the smallinsky/aws-ic-instal-plugin branch from 5ca783d to 367ac0a Compare January 31, 2025 12:27

tcsc marked this pull request as ready for review January 31, 2025 12:29

github-actions Bot added size/md tctl tctl - Teleport admin tool labels Jan 31, 2025

github-actions Bot requested review from Tener and ryanclark January 31, 2025 12:30

tcsc self-assigned this Jan 31, 2025

tcsc requested review from flyinghermit and kopiczko January 31, 2025 12:53

tcsc added no-changelog Indicates that a PR does not require a changelog entry aws-iam-identity-center backport/branch/v17 labels Jan 31, 2025

smallinsky commented Jan 31, 2025

View reviewed changes

Comment thread tool/tctl/common/plugin/awsic.go

kopiczko reviewed Jan 31, 2025

View reviewed changes

smallinsky commented Feb 3, 2025

View reviewed changes

flyinghermit reviewed Feb 3, 2025

View reviewed changes

flyinghermit reviewed Feb 5, 2025

View reviewed changes

flyinghermit approved these changes Feb 6, 2025

View reviewed changes

tcsc requested a review from kopiczko February 7, 2025 05:28

tcsc approved these changes Feb 7, 2025

View reviewed changes

tcsc enabled auto-merge February 7, 2025 13:10

zmb3 reviewed Feb 10, 2025

View reviewed changes

tcsc requested a review from zmb3 February 10, 2025 05:01

tcsc force-pushed the smallinsky/aws-ic-instal-plugin branch from 391330f to 8a691c7 Compare February 18, 2025 03:48

tcsc changed the base branch from master to tcsc/aws-ic-move-validators February 18, 2025 03:50

auto-merge was automatically disabled February 18, 2025 03:50
Merge commits are not allowed on this repository

tcsc force-pushed the tcsc/aws-ic-move-validators branch from 76383ea to 2031bf9 Compare February 19, 2025 01:24

tcsc force-pushed the smallinsky/aws-ic-instal-plugin branch from 8a691c7 to 22fcfb5 Compare February 19, 2025 01:34

Base automatically changed from tcsc/aws-ic-move-validators to master February 19, 2025 03:09

Adds tctl plugins install awsic

da0cc30

Adds a comand-line installation tool for the AWS Identity Center integration. Co-authored-by: Marek Smoliński <marek@goteleport.com> Co-authored-by: Trent Clatke <trent@goteleport.com>

tcsc force-pushed the smallinsky/aws-ic-instal-plugin branch from 22fcfb5 to da0cc30 Compare February 19, 2025 03:33

Merge branch 'master' into smallinsky/aws-ic-instal-plugin

808c81b

zmb3 approved these changes Feb 19, 2025

View reviewed changes

Comment thread lib/utils/aws/identitycenter/scim.go Outdated

Comment thread lib/utils/aws/identitycenter/scim.go Outdated

Comment thread tool/tctl/common/plugin/awsic.go Outdated

Comment thread lib/utils/aws/identitycenterutils/scim.go Outdated

public-teleport-github-review-bot Bot removed request for Tener and ryanclark February 19, 2025 18:19

tcsc and others added 2 commits February 20, 2025 09:08

Apply suggestions from code review

a256083

Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>

Merge branch 'master' into smallinsky/aws-ic-instal-plugin

930586d

tcsc enabled auto-merge February 19, 2025 22:09

tcsc added this pull request to the merge queue Feb 19, 2025

Merged via the queue into master with commit 8f02eb1 Feb 19, 2025

tcsc deleted the smallinsky/aws-ic-instal-plugin branch February 19, 2025 22:51

tcsc mentioned this pull request Feb 20, 2025

[v17] Add tctl plugins install awsic #52336

Merged

Conversation

smallinsky commented Jan 20, 2025 • edited by tcsc Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Uh oh!

Uh oh!

kopiczko Jan 31, 2025

Choose a reason for hiding this comment

Uh oh!

tcsc Feb 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

smallinsky left a comment

Choose a reason for hiding this comment

Uh oh!

flyinghermit left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

flyinghermit Feb 3, 2025

Choose a reason for hiding this comment

Uh oh!

tcsc Feb 5, 2025

Choose a reason for hiding this comment

Uh oh!

flyinghermit Feb 5, 2025

Choose a reason for hiding this comment

Uh oh!

tcsc Feb 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

flyinghermit Feb 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

public-teleport-github-review-bot Bot commented Feb 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

smallinsky commented Jan 20, 2025 •

edited by tcsc

Loading

tcsc Feb 11, 2025 •

edited

Loading