Adding resource backend for scoped join tokens by eriktate · Pull Request #59609 · gravitational/teleport

eriktate · 2025-09-25T21:12:41Z

This PR adds basic CRUD with list filters and validation for scoped join tokens.

api/proto/teleport/scopes/joining/v1/service.proto

lib/auth/scopes/joining/service.go

lib/services/scoped_tokens.go

lib/auth/scopes/joining/service_test.go

rosstimothy · 2025-10-09T21:06:35Z

lib/services/local/scoped_tokens.go

+// UpsertScopedToken upserts a scoped token to the auth server.
+func (s *ScopedTokenService) UpsertScopedToken(ctx context.Context, token *joiningv1.ScopedToken) (*joiningv1.ScopedToken, error) {


What use cases will be calling UpsertScopedToken?

lib/services/local/scoped_tokens_test.go

espadolini · 2025-10-13T15:26:49Z

api/proto/teleport/scopes/joining/v1/service.proto

+  // Filter tokens that apply at least one of the provided roles.
+  repeated string roles = 5;
+
+  // Filter tokens that match all provided labels.
+  map<string, string> labels = 6;


In the future please don't backport RPCs in release branches if they're not finalized and the semantics are planned to be changed in backwards-incompatible ways - I almost requested changes on this because I saw the proto definition in branch/v18, and this change is only ok because the server side of things is not actually implemented in any release yet.

fspmarshall

General feedback: I'd like to try to stick a little closer to the patterns used for ScopedRole/ScopedRoleAssignment. In particular:

Define validation/helpers in lib/scopes/joining.
Provide separate StrongValidateScopedToken and WeakValidateScopedToken functions.
Have the backend always perform strong validation on writes and weak validation on reads.
Keep the service/interface method signatures equivalent to the grpc method signatures (scope api's are likely going to be high churn for a while, so this tends to just make things easier).

lib/services/local/scoped_tokens.go

lib/services/scoped_tokens.go

public-teleport-github-review-bot · 2025-10-16T03:02:09Z

@eriktate - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

lib/auth/scopes/joining/service.go

lib/services/local/scoped_tokens.go

rosstimothy · 2025-10-17T15:51:15Z

lib/services/local/scoped_tokens.go

+// UpdateScopedToken updates a scoped token in the auth server.
+func (s *ScopedTokenService) UpdateScopedToken(ctx context.Context, req *joiningv1.UpdateScopedTokenRequest) (*joiningv1.UpdateScopedTokenResponse, error) {


If we never plan to support updating scoped tokens should we remove Update from all the API layers?

It was already in the gRPC service definition and since we may implement it in some form later I'll leave it as NotImplemented in the service implementation. I removed it from the local service and ScopedService interface though 👍

lib/services/local/scoped_tokens.go

eriktate force-pushed the eriktate/scoped-join-tokens-backend branch from cb83807 to ac98db3 Compare September 26, 2025 17:24

eriktate force-pushed the eriktate/scoped-join-tokens-backend branch from ac98db3 to cb28a3e Compare October 8, 2025 01:10

eriktate marked this pull request as ready for review October 8, 2025 01:11

github-actions bot added the size/lg label Oct 8, 2025

github-actions bot requested review from Tener and kiosion October 8, 2025 01:12

eriktate added no-changelog Indicates that a PR does not require a changelog entry backport/branch/v18 labels Oct 8, 2025

eriktate force-pushed the eriktate/scoped-join-tokens-backend branch from cb28a3e to d960a90 Compare October 8, 2025 01:23

Tener reviewed Oct 8, 2025

View reviewed changes

api/proto/teleport/scopes/joining/v1/service.proto Show resolved Hide resolved

lib/auth/scopes/joining/service.go Outdated Show resolved Hide resolved

lib/auth/scopes/joining/service.go Outdated Show resolved Hide resolved

lib/services/scoped_tokens.go Outdated Show resolved Hide resolved

rosstimothy requested a review from fspmarshall October 8, 2025 14:05

rosstimothy reviewed Oct 9, 2025

View reviewed changes

eriktate force-pushed the eriktate/scoped-join-tokens-backend branch from 7849329 to 703c043 Compare October 10, 2025 19:30

espadolini approved these changes Oct 13, 2025

View reviewed changes

fspmarshall reviewed Oct 15, 2025

View reviewed changes

lib/services/local/scoped_tokens.go Outdated Show resolved Hide resolved

fspmarshall reviewed Oct 15, 2025

View reviewed changes

lib/services/scoped_tokens.go Outdated Show resolved Hide resolved

eriktate removed the backport/branch/v18 label Oct 15, 2025

eriktate force-pushed the eriktate/scoped-join-tokens-backend branch from b33fac5 to 9fb4699 Compare October 16, 2025 03:01

eriktate force-pushed the eriktate/scoped-join-tokens-backend branch 3 times, most recently from 5f9bf01 to 735c60e Compare October 16, 2025 16:03

rosstimothy reviewed Oct 17, 2025

View reviewed changes

eriktate requested a review from fspmarshall October 17, 2025 15:59

eriktate force-pushed the eriktate/scoped-join-tokens-backend branch 2 times, most recently from 7846fe2 to 0ee1260 Compare October 20, 2025 20:10

eriktate requested a review from rosstimothy October 21, 2025 11:48

eriktate mentioned this pull request Oct 21, 2025

Adding scoped joining of nodes using dynamic tokens #60362

Merged

eriktate force-pushed the eriktate/scoped-join-tokens-backend branch from 690009e to 4b2557b Compare October 21, 2025 20:50

rosstimothy approved these changes Oct 21, 2025

View reviewed changes

public-teleport-github-review-bot bot removed the request for review from kiosion October 21, 2025 21:10

adding backend and service for scoped token resources

e810e5a

eriktate force-pushed the eriktate/scoped-join-tokens-backend branch from 4b2557b to e810e5a Compare October 22, 2025 03:52

eriktate enabled auto-merge October 22, 2025 03:56

eriktate added this pull request to the merge queue Oct 22, 2025

Merged via the queue into master with commit a6ff9dc Oct 22, 2025
44 checks passed

eriktate deleted the eriktate/scoped-join-tokens-backend branch October 22, 2025 04:35

eriktate added a commit that referenced this pull request Oct 29, 2025

adding backend and service for scoped token resources (#59609)

e655abe

eriktate mentioned this pull request Oct 29, 2025

[v18] Adding scoped join tokens for SSH nodes #60758

Merged

fspmarshall pushed a commit that referenced this pull request Oct 31, 2025

adding backend and service for scoped token resources (#59609)

cbc4965

eriktate added a commit that referenced this pull request Nov 4, 2025

adding backend and service for scoped token resources (#59609)

577fb7f

mmcallister pushed a commit that referenced this pull request Nov 6, 2025

adding backend and service for scoped token resources (#59609)

90d6ea0

mmcallister pushed a commit that referenced this pull request Nov 19, 2025

adding backend and service for scoped token resources (#59609)

cbe4d75

mmcallister pushed a commit that referenced this pull request Nov 20, 2025

adding backend and service for scoped token resources (#59609)

ebfc244

		// UpsertScopedToken upserts a scoped token to the auth server.
		func (s ScopedTokenService) UpsertScopedToken(ctx context.Context, token joiningv1.ScopedToken) (*joiningv1.ScopedToken, error) {

		// UpdateScopedToken updates a scoped token in the auth server.
		func (s ScopedTokenService) UpdateScopedToken(ctx context.Context, req joiningv1.UpdateScopedTokenRequest) (*joiningv1.UpdateScopedTokenResponse, error) {

Conversation

eriktate commented Sep 25, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rosstimothy Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

espadolini Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

fspmarshall left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

public-teleport-github-review-bot bot commented Oct 16, 2025

Uh oh!

Uh oh!

Uh oh!

rosstimothy Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

eriktate Oct 21, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants