feat: Support multiple active CAs in Web exports by codingllama · Pull Request #51301 · gravitational/teleport

codingllama · 2025-01-21T19:11:59Z

Add support for exporting multiple active CAs via the "format=zip" param.

If a single active CA exists the behavior is the same as before
If multiple active CAs exist the error message is changed to refer to the "format=zip" param
Any number of active CAs may be exported using "format=zip"

Error before this PR:

GET /auth/export?type=tls-user

"export returned 2 authorities, expected exactly one"

After this PR:

GET /auth/export?type=tls-user

"found 2 authorities to export, use format=zip to export all"

If format=zip is supplied (for example, "/auth/export?type=tls-user&format=zip") then a zip file called "Teleport_CA.zip" is returned as an attachment. The file contains various "ca$i.cer" files, one for each exported CA, in whatever format it would have as a single-file export.

Follow up from #51189. Sibling PR to #51298.

#35444

Changelog: Added support for multiple active CAs in the /auth/export endpoint

codingllama · 2025-01-21T19:12:58Z

Branched from #51189.

Add client-side functions to export multiple authorities #51189

codingllama · 2025-01-21T19:15:36Z

The PR is smaller than it seems, as there's a big move from the larger apiserver{,_test}.go files to ca_export{,_test}.go files. Because of that I suggest reviewing commit-by-commit.

The move commit is a plain move without changes (768da03)
The test refactor commit doesn't change any functionality (1cfebdc)

codingllama · 2025-01-21T19:17:37Z

Takes inspiration from Gavin's #35754, although it has my own spin on it.

zmb3 · 2025-01-22T04:16:22Z

Do we have a way to put multiple DER-encoded certs in the zip file for windows, or will the zip always use PEM?

The use case that led to this issue was exporting the windows CA when using HSMs. In order to import the CA on the windows side it needs to be DER.

codingllama · 2025-01-22T14:17:09Z

Do we have a way to put multiple DER-encoded certs in the zip file for windows, or will the zip always use PEM?

The use case that led to this issue was exporting the windows CA when using HSMs. In order to import the CA on the windows side it needs to be DER.

I used type=tls-user as an example, but it works the same for type=windows - you'd get the same zip as a result, but the underlying .cer files are DER and not PEM.

codingllama · 2025-01-22T14:18:05Z

Friendly ping @mvbrock @probakowski @GavinFrazar.

codingllama · 2025-01-22T16:45:11Z

Rebased onto master, no changes.

codingllama · 2025-01-22T19:15:39Z

Thanks, Zac!

codingllama · 2025-01-22T19:56:38Z

Rebased onto master so I can pull #51298 (the tctl PR) and add a final cleanup commit - 9e1b309. PTAL.

codingllama · 2025-01-23T13:57:56Z

Friendly ping @mvbrock @probakowski @GavinFrazar ?

public-teleport-github-review-bot · 2025-01-23T14:56:24Z

@codingllama See the table below for backport results.

Branch	Result
branch/v15	Failed
branch/v16	Failed
branch/v17	Failed

* Move /auth/export code to own file * Implement "/auth/export?format=zip" * Refactor existing tests * Test format=zip * Fix comment * Use bytes.NewReader * Remove lib/client.ExportAuthorities

Now that #51301 is merged, we have the ability to get all of the active user CA certificates.

* docs: update CA import instructions for HSMs (#51530) Now that #51301 is merged, we have the ability to get all of the active user CA certificates. * docs: add a dedicated section to desktop LDAP discovery (#51515) Closes #51485

Now that #51301 is merged, we have the ability to get all of the active user CA certificates.

* Move /auth/export code to own file * Implement "/auth/export?format=zip" * Refactor existing tests * Test format=zip * Fix comment * Use bytes.NewReader * Remove lib/client.ExportAuthorities

Now that gravitational#51301 is merged, we have the ability to get all of the active user CA certificates.

codingllama added the no-changelog Indicates that a PR does not require a changelog entry label Jan 21, 2025

github-actions Bot requested review from mvbrock and probakowski January 21, 2025 19:12

github-actions Bot added the size/md label Jan 21, 2025

codingllama added backport/branch/v15 backport/branch/v17 labels Jan 21, 2025

codingllama requested a review from GavinFrazar January 21, 2025 19:16

Base automatically changed from codingllama/export-all-funcs to master January 22, 2025 15:44

codingllama force-pushed the codingllama/export-all-web branch from 806d6b6 to e2f08d1 Compare January 22, 2025 16:44

zmb3 approved these changes Jan 22, 2025

View reviewed changes

Comment thread lib/web/ca_export.go Outdated

Comment thread lib/web/ca_export.go Outdated

codingllama mentioned this pull request Jan 22, 2025

export all tls keypairs with tctl or webapi #35754

Closed

codingllama added 7 commits January 22, 2025 16:55

Move /auth/export code to own file

ea16ec5

Implement "/auth/export?format=zip"

a404c6c

Refactor existing tests

a3f4946

Test format=zip

70c6058

Fix comment

55be97c

Use bytes.NewReader

24a2e7e

Remove lib/client.ExportAuthorities

9e1b309

codingllama force-pushed the codingllama/export-all-web branch from ccec73a to 9e1b309 Compare January 22, 2025 19:55

probakowski approved these changes Jan 23, 2025

View reviewed changes

public-teleport-github-review-bot Bot removed request for GavinFrazar and mvbrock January 23, 2025 14:32

codingllama added this pull request to the merge queue Jan 23, 2025

Merged via the queue into master with commit 2e89fd7 Jan 23, 2025

codingllama deleted the codingllama/export-all-web branch January 23, 2025 14:54

codingllama mentioned this pull request Jan 23, 2025

[v17] feat: Support multiple active CAs in Web exports #51415

Merged

codingllama mentioned this pull request Jan 23, 2025

[v16] feat: Support multiple active CAs in Web exports #51418

Merged

codingllama mentioned this pull request Jan 23, 2025

[v15] feat: Support multiple active CAs in Web exports #51420

Merged

zmb3 added a commit that referenced this pull request Jan 27, 2025

docs: update CA import instructions for HSMs

d97f222

Now that #51301 is merged, we have the ability to get all of the active user CA certificates.

zmb3 mentioned this pull request Jan 27, 2025

docs: update CA import instructions for HSMs #51530

Merged

zmb3 added a commit that referenced this pull request Jan 29, 2025

docs: update CA import instructions for HSMs

9c9d9d6

Now that #51301 is merged, we have the ability to get all of the active user CA certificates.

zmb3 added a commit that referenced this pull request Jan 29, 2025

docs: update CA import instructions for HSMs

c684b0a

Now that #51301 is merged, we have the ability to get all of the active user CA certificates.

github-merge-queue Bot pushed a commit that referenced this pull request Jan 29, 2025

docs: update CA import instructions for HSMs (#51530)

08fcdd0

Now that #51301 is merged, we have the ability to get all of the active user CA certificates.

github-actions Bot pushed a commit that referenced this pull request Jan 29, 2025

docs: update CA import instructions for HSMs

52d6f12

Now that #51301 is merged, we have the ability to get all of the active user CA certificates.

zmb3 added a commit that referenced this pull request Jan 30, 2025

docs: update CA import instructions for HSMs (#51530)

c45c72b

Now that #51301 is merged, we have the ability to get all of the active user CA certificates.

github-merge-queue Bot pushed a commit that referenced this pull request Jan 30, 2025

docs: update CA import instructions for HSMs (#51623)

2bf229b

Now that #51301 is merged, we have the ability to get all of the active user CA certificates.

carloscastrojumo pushed a commit to carloscastrojumo/teleport that referenced this pull request Feb 19, 2025

docs: update CA import instructions for HSMs (gravitational#51530)

3fd7f61

Now that gravitational#51301 is merged, we have the ability to get all of the active user CA certificates.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Support multiple active CAs in Web exports#51301

feat: Support multiple active CAs in Web exports#51301
codingllama merged 7 commits intomasterfrom
codingllama/export-all-web

codingllama commented Jan 21, 2025 •

edited

Loading

Uh oh!

codingllama commented Jan 21, 2025

Uh oh!

codingllama commented Jan 21, 2025

Uh oh!

codingllama commented Jan 21, 2025

Uh oh!

zmb3 commented Jan 22, 2025

Uh oh!

codingllama commented Jan 22, 2025

Uh oh!

codingllama commented Jan 22, 2025

Uh oh!

codingllama commented Jan 22, 2025

Uh oh!

Uh oh!

Uh oh!

codingllama commented Jan 22, 2025

Uh oh!

codingllama commented Jan 22, 2025

Uh oh!

codingllama commented Jan 23, 2025

Uh oh!

public-teleport-github-review-bot Bot commented Jan 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

codingllama commented Jan 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codingllama commented Jan 21, 2025

Uh oh!

codingllama commented Jan 21, 2025

Uh oh!

codingllama commented Jan 21, 2025

Uh oh!

zmb3 commented Jan 22, 2025

Uh oh!

codingllama commented Jan 22, 2025

Uh oh!

codingllama commented Jan 22, 2025

Uh oh!

codingllama commented Jan 22, 2025

Uh oh!

Uh oh!

Uh oh!

codingllama commented Jan 22, 2025

Uh oh!

codingllama commented Jan 22, 2025

Uh oh!

codingllama commented Jan 23, 2025

Uh oh!

public-teleport-github-review-bot Bot commented Jan 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codingllama commented Jan 21, 2025 •

edited

Loading