Skip to content

MWI: Add lock targets for join token name and bot instance ID #56021

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
timothyb89 merged 7 commits into from
Jun 26, 2025
Merged

MWI: Add lock targets for join token name and bot instance ID #56021

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
1b34407
MWI: Add lock targets for join token name and bot instance ID
timothyb89 Jun 24, 2025
b5160d6
Set join token cert request field for non-renewable bot identities
timothyb89 Jun 24, 2025
8b81764
Fix ASN ID and pass through join token name in impersonated certs
timothyb89 Jun 24, 2025
a781439
Tweak docstrings and add missing references for lib/decision
timothyb89 Jun 24, 2025
cf7d19e
Clarify docstrings
timothyb89 Jun 26, 2025
856a84f
Merge remote-tracking branch 'origin/master' into timothyb89/bound-ke…
timothyb89 Jun 26, 2025
ff02725
Fix failing tests
timothyb89 Jun 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 27 additions & 3 deletions api/gen/proto/go/teleport/decision/v1alpha1/ssh_access.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 16 additions & 4 deletions api/gen/proto/go/teleport/decision/v1alpha1/ssh_identity.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

19 changes: 16 additions & 3 deletions api/gen/proto/go/teleport/decision/v1alpha1/tls_identity.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 8 additions & 0 deletions api/proto/teleport/decision/v1alpha1/ssh_access.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,14 @@ message LockTarget {

// ServerID is the host id of the Teleport instance.
string server_id = 8;

// BotInstanceID is the bot instance ID if this is a bot identity.
string bot_instance_id = 9;
Copy link
Copy Markdown
Contributor

@juliaogris juliaogris Jun 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If bot_instance_id and join_token can only exist together, should they be combined in a separate message?
What happens to the user field in case of a bot instance - is this worth a comment?

Copy link
Copy Markdown
Contributor Author

@timothyb89 timothyb89 Jun 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a bit messy but it probably doesn't make sense to move these fields into a separate message.

Bots are a variant of users and have a username (bot-foo, generally), so user will be set for both human users and bots. All bots have a bot_instance_id, but only some bots will have a join_token set. The fields will be empty for regular users, which is a convention shared with other fields, e.g. server_id is only set for servers, mfa_device is only set when a user has an MFA device, etc.


// JoinToken is the name of the join token used when this identity originally
// joined. This only applies to bot identities, and cannot be used to target
// bots that joined via the `token` join method.
string join_token = 10;
}

// HostUserMode determines how host users should be created.
Expand Down
4 changes: 4 additions & 0 deletions api/proto/teleport/decision/v1alpha1/ssh_identity.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,10 @@ message SSHIdentity {
// GitHubUsername indicates the GitHub username identified by the GitHub
// connector.
string github_username = 33;

// JoinToken is the name of the join token used for bot joining. It is unset
// for other identity types, or for bots using the `token` join method.
string join_token = 34;
}

// CertExtensionMode specifies the type of extension to use in the cert. This type
Expand Down
5 changes: 5 additions & 0 deletions api/proto/teleport/decision/v1alpha1/tls_identity.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,11 @@ message TLSIdentity {

// UserType indicates if the User was created by an SSO Provider or locally.
string user_type = 35;

// JoinToken is the name of the join token used when a bot joins; it does not
// apply to other identity types, or to bots using the traditional `token`
// join method.
string join_token = 36;
}

// RouteToApp holds routing information for applications.
Expand Down
3 changes: 3 additions & 0 deletions api/proto/teleport/legacy/types/events/events.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4959,6 +4959,9 @@ message Identity {
// BotInstanceID indicates the name of the Machine ID bot instance this
// identity was issued to, if any.
string BotInstanceID = 29 [(gogoproto.jsontag) = "bot_instance_id,omitempty"];
// JoinToken is the name of the join token used when a Machine ID bot joined,
// if any. It is not set for bots using the `token` join method.
string JoinToken = 30 [(gogoproto.jsontag) = "join_token,omitempty"];
}

// RouteToApp contains parameters for application access certificate requests.
Expand Down
9 changes: 9 additions & 0 deletions api/proto/teleport/legacy/types/types.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6039,6 +6039,15 @@ message LockTarget {

// ServerID is the host id of the Teleport instance.
string ServerID = 9 [(gogoproto.jsontag) = "server_id,omitempty"];

// BotInstanceID is the bot instance ID if this is a bot identity and is
// ignored otherwise.
string BotInstanceID = 10 [(gogoproto.jsontag) = "bot_instance_id,omitempty"];

// JoinToken is the name of the join token used when this identity originally
// joined. This is only valid for bot identities, and cannot be used to target
// `token`-joined bots.
string JoinToken = 11 [(gogoproto.jsontag) = "join_token,omitempty"];
}

// AddressCondition represents a set of addresses. Presently the addresses are specified
Expand Down
Loading
Loading