Dynamic Roles

[russjones]

Purpose

As covered in #891, at the moment using OIDC with individual system logins means you have to either create a role for every user or keep updating a shared role with logins whenever someone new joins the team.

To improve the user experience of OIDC and Teleport, this PR allows you to define a role template that can be used to dynamically create roles based off the claims received from an identity provider.

Implementation

• The claims_to_roles for an OIDC connector can now contain roles or a role_template that contains an embedded role that is filled out by data from claims.

  claims_to_roles:
    - claim: roles
      value: teleport-admin
      role_template:
        kind: role
        version: v2
        metadata:
          name: '{{index . "email"}}'
          namespace: "default"
        spec:
          namespaces: [ "*" ]
          max_session_ttl: 90h0m0s
          logins: [ '{{index . "nickname"}}', root ]
          node_labels:
             "*": "*"
          resources:
            "*": [ "read", "write" ]
          forward_agent: true

• UpsertRole has been updated with a TTL so that dynamic roles are removed along with the dynamic user.

• User creation logic has been updated so if you re-login via OIDC you don't have to wait for your existing User to expire.

Related Issues

Fixes #891

[klizhentas]

can you use auth server clock instead?

[klizhentas]

incomplete comment sentence

[klizhentas]

can you implement this sligthly in a different way that will allow me to add extesions:

• use json.RawMessageHere
• use GetRoleMarshaller().Unmarshal()
• set the value

This will allow me to override this setting in Telekube and Teleport Enterprise

[klizhentas]

actually, nevermind, I can already do this without this change

[klizhentas]

have a couple of comments around using time, otherwise looks good.

[russjones]

@klizhentas Made the changes you suggested, can you take another look?