Let tctl make plugins #41038

tcsc · 2024-04-30T10:01:07Z

Allows tctl to install an Okta integration without having the user resort to crafting a PluginRequest in JSON. It's not as automated as the Web-based installer, but is a reasonable mid-point if you need more control over integration behaviour.

Example:

$ tctl plugins install okta --org https://example.com --owner "admin" -g "group #1" --api-token ${API-TOKEN}

Note: Currently defaults to --sync--users and --sync-groups being enabled for parity with the Web-based installer, but I'm not wedded to it. Perhaps defaulting to "off" would be less surprising for a CLI.

Full option set:

❯ ./e/build/tctl plugins install okta --help
usage: tctl plugins install okta --org=ORG --api-token=API-TOKEN [<flags>]

install an okta integration

Flags:
  -d, --[no-]debug        Enable verbose logging to stderr
  -c, --config            Path to a configuration file [/etc/teleport.yaml]. Can also be set via the TELEPORT_CONFIG_FILE environment variable.
      --auth-server       Attempts to connect to specific auth/proxy address(es) instead of local auth [127.0.0.1:3025]
  -i, --identity          Path to an identity file. Must be provided to make remote connections to auth. An identity file can be exported with 'tctl auth sign'
      --[no-]insecure     When specifying a proxy address in --auth-server, do not verify its TLS certificate. Danger: any data you send can be intercepted or modified by an attacker.
      --name              name of the plugin resource to create
      --org               URL of Okta organization
      --api-token         API token to install with plugin
      --saml-connector    SAML connector to link to plugin
      --app-id            Okta ID of the APP used for SSO via SAML
      --scim-token        SCIM token to install with plugin
      --[no-]sync-users   Enable user synchronization
  -o, --owner             Set default owners for synced AccessLists
      --[no-]sync-groups  Enable group to AccessList synchronization
  -g, --group             Add a group filter. Supports globbing by default. Enclose in `^pattern$` for full regex support.
  -a, --app               Add an app filter. Supports globbing by default. Enclose in `^pattern$` for full regex support.

Also moves some constants (e.g. Okta plugin label names) from Enterprise to OSS where they can be seen from tctl. A following PR will update the enterprse definitions to point back to the new constants created here.

Changelog: Added support for creating Okta integrations in tctl.

tool/tctl/common/plugins_command_test.go

tool/tctl/common/plugins_command.go

r0mant · 2024-05-01T16:55:45Z

api/types/constants.go

+const (
+	// HostedPluginLabel defines the name for the hosted plugin label.
+	// When this label is set to "true" on a Plugin resource,
+	// it indicates that the Plugin should be run by the Cloud service,
+	// rather than self-hosted plugin services.
+	HostedPluginLabel = TeleportNamespace + "/hosted-plugin"
+)
+
+const (
+	// OktaOrgURLLabel is the label used by Okta-managed resources to indicate
+	// the upstream Okta organization that they come from.
+	OktaOrgURLLabel = "okta/org"
+
+	// OktaCredPurposeLabel is used by Okta-managed PluginStaticCredentials to
+	// indicate their purpose
+	OktaCredPurposeLabel = "okta/purpose"
+
+	// OktaCredPurposeAuth indicates that the credential is intended for
+	// authenticating with the Okta REST API
+	OktaCredPurposeAuth = "okta-auth"
+
+	// OktaCredPurposeSCIMToken indicates that theis to be used for authenticating
+	// SCIM requests from the upstream organization. The content of the credential
+	// is a bcrypt hash of actual token.
+	OktaCredPurposeSCIMToken = "scim-bearer-token"
+)


All of these constants are defined in teleport.e. Is there a corresponding teleport.e PR that removes them from there and uses these?

Not yet, but its on the way

gravitational/teleport.e#4098

r0mant · 2024-05-01T16:56:55Z

tool/tctl/common/plugins_command.go

+		Required().
+		StringVar(&p.install.okta.apiToken)
+	p.install.okta.cmd.
+		Flag("saml-connector", "SAML connector to link to plugin").


What does it mean to "link" connector? Will it try to create connector with this name, or somehow adopt an existing one? It's not clear from this description.

tool/tctl/common/plugins_command.go

r0mant · 2024-05-01T17:00:38Z

tool/tctl/common/plugins_command.go

+		},
+	}
+
+	if _, err := args.plugins.CreatePlugin(ctx, req); err != nil {


Web UI doesn't let you create more than 1 instance of a hosted plugin, incl. Okta. How will this behave if you already have an Okta integration running?

And similarly, our UI prompts user to cleanup old Okta integration before creating a new one if it detects there are resources left from the previous instance of Okta integration. Does this behave the same way? @smallinsky should have details about it.

Yes It should behave the same way and the cleanup step will be retuned in error message.

Co-authored-by: Roman Tkachenko <[email protected]> Co-authored-by: Jakub Nyckowski <[email protected]>

tool/tctl/common/plugins_command.go

…ugin

smallinsky

Let few minor comments.

smallinsky · 2024-05-08T09:53:14Z

tool/tctl/common/plugins_command.go

+		if oktaSettings.samlConnector == "" {
+			return trace.BadParameter("SCIM support requires saml-connector to be set")
+		}


Why samlConnector is only validated when SCIM is enabled ?

Don't we reference to samlConnector in our okta sync flow ? For instance:
https://github.com/gravitational/teleport.e/blob/5012ca517540f8d1d44bda375fc5de0e8113e04a/lib/okta/synchronize.go#L640

Ok, will just make it flat-out required

smallinsky · 2024-05-08T09:58:14Z

tool/tctl/common/plugins_command.go

+		}
+	}
+
+	if oktaSettings.samlConnector != "" {


if samlConnector was provided can we get the okta org from connector spec ?

We can try it, and give a warning to set it explicitly if it can't be found. The App ID label is only guaranteed to be set if the SAML Connector was created though the Okta install flow; if it was created manually it may not exist.

tool/tctl/common/plugins_command.go

r0mant · 2024-05-10T15:23:29Z

tool/tctl/common/plugins_command.go

+func (p *PluginsCommand) initInstall(parent *kingpin.CmdClause, config *servicecfg.Config) {
+	p.install.cmd = parent.Command("install", "Install new plugin instance")
+
+	p.install.okta.cmd = p.install.cmd.Command("okta", "Install an okta integration")


Suggested change

p.install.okta.cmd = p.install.cmd.Command("okta", "Install an okta integration")

p.install.okta.cmd = p.install.cmd.Command("okta", "Install an Okta integration")

r0mant · 2024-05-10T15:24:33Z

tool/tctl/common/plugins_command.go

+		fmt.Printf("Failed validating SAML connector: %v", err)
+		return trace.Wrap(err)


Suggested change

fmt.Printf("Failed validating SAML connector: %v", err)

return trace.Wrap(err)

return trace.Wrap(err, "failed validating SAML connector")

r0mant · 2024-05-10T15:25:04Z

tool/tctl/common/plugins_command.go

+		fmt.Printf("Plugin creation failed: %v\n", err)
+		return trace.Wrap(err)


Suggested change

fmt.Printf("Plugin creation failed: %v\n", err)

return trace.Wrap(err)

return trace.Wrap(err, "plugin creation failed")

r0mant

@tcsc Can you include the docs for this as well?

…ugin

Co-authored-by: Roman Tkachenko <[email protected]>

…ugin

tcsc added 2 commits April 30, 2024 19:57

Let tctl make plugins

a584e96

Full-service Okta install

c3f789e

tcsc requested review from smallinsky and r0mant May 1, 2024 12:40

tcsc marked this pull request as ready for review May 1, 2024 12:40

github-actions bot added size/md tctl tctl - Teleport admin tool labels May 1, 2024

github-actions bot requested review from jakule and marcoandredinis May 1, 2024 12:41

tcsc added 4 commits May 1, 2024 23:07

Move constants to OSS

255b909

Merge branch 'master' into tcsc/tctl-create-plugin

72a8b1b

Remove more enterprise refs

c93ef40

Merge branch 'master' into tcsc/tctl-create-plugin

65ec767

jakule approved these changes May 1, 2024

View reviewed changes

r0mant reviewed May 1, 2024

View reviewed changes

Apply suggestions from code review

9a8d3f6

Co-authored-by: Roman Tkachenko <[email protected]> Co-authored-by: Jakub Nyckowski <[email protected]>

marcoandredinis removed their request for review May 2, 2024 10:22

smallinsky reviewed May 2, 2024

View reviewed changes

tool/tctl/common/plugins_command.go Show resolved Hide resolved

smallinsky reviewed May 2, 2024

View reviewed changes

tool/tctl/common/plugins_command.go Outdated Show resolved Hide resolved

tcsc added 2 commits May 7, 2024 10:05

Merge remote-tracking branch 'origin/master' into tcsc/tctl-create-pl…

e4037ae

…ugin

docs link

f0a62d9

smallinsky reviewed May 8, 2024

View reviewed changes

Deduce App ID from SAML connector

de9f98f

r0mant approved these changes May 10, 2024

View reviewed changes

r0mant reviewed May 10, 2024

View reviewed changes

tcsc added 4 commits May 14, 2024 22:04

Merge remote-tracking branch 'origin/master' into tcsc/tctl-create-pl…

b3df9ad

…ugin

Post-merge cleanup

7729793

Merge branch 'master' into tcsc/tctl-create-plugin

0c5858d

review feedback

41e3790

smallinsky approved these changes May 14, 2024

View reviewed changes

tcsc and others added 2 commits May 15, 2024 09:10

Merge branch 'master' into tcsc/tctl-create-plugin

8354217

Apply suggestions from code review

2ff3176

Co-authored-by: Roman Tkachenko <[email protected]>

tcsc enabled auto-merge May 14, 2024 23:13

tcsc added 6 commits May 15, 2024 14:03

Merge branch 'master' into tcsc/tctl-create-plugin

7869f02

Merge branch 'master' into tcsc/tctl-create-plugin

d376977

Merge branch 'master' into tcsc/tctl-create-plugin

5cd2a4a

Merge remote-tracking branch 'origin/master' into tcsc/tctl-create-pl…

0782ec9

…ugin

linter

5c31d38

Fix tctl argparse

eff6b36

tcsc added this pull request to the merge queue May 17, 2024

Merged via the queue into master with commit dfc127d May 17, 2024
38 checks passed

tcsc deleted the tcsc/tctl-create-plugin branch May 17, 2024 06:26

smallinsky mentioned this pull request May 22, 2024

[v15] Let tctl make plugins #41888

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Let tctl make plugins #41038

Let tctl make plugins #41038

tcsc commented Apr 30, 2024 •

edited

Loading

r0mant May 1, 2024

tcsc May 2, 2024

tcsc May 7, 2024

r0mant May 1, 2024

r0mant May 1, 2024

smallinsky May 2, 2024

smallinsky left a comment

smallinsky May 8, 2024

tcsc May 10, 2024

smallinsky May 8, 2024

tcsc May 10, 2024

r0mant May 10, 2024

r0mant May 10, 2024

r0mant May 10, 2024

r0mant left a comment

	p.install.okta.cmd = p.install.cmd.Command("okta", "Install an okta integration")
	p.install.okta.cmd = p.install.cmd.Command("okta", "Install an Okta integration")

		fmt.Printf("Failed validating SAML connector: %v", err)
		return trace.Wrap(err)

	fmt.Printf("Failed validating SAML connector: %v", err)
	return trace.Wrap(err)
	return trace.Wrap(err, "failed validating SAML connector")

		fmt.Printf("Plugin creation failed: %v\n", err)
		return trace.Wrap(err)

	fmt.Printf("Plugin creation failed: %v\n", err)
	return trace.Wrap(err)
	return trace.Wrap(err, "plugin creation failed")

Let tctl make plugins #41038

Let tctl make plugins #41038

Conversation

tcsc commented Apr 30, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

smallinsky left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

r0mant left a comment

Choose a reason for hiding this comment

tcsc commented Apr 30, 2024 •

edited

Loading