[entraid] add setup script for offline clusters. #47863

tigrato · 2024-10-23T17:12:16Z

This PR introduces a CLI configuration option for Entra ID, allowing the use of system credentials as the default authentication method instead of OIDC. This is particularly useful for private clusters that are not accessible via the internet, where OIDC may not be a viable option.

The UX is the following:

Enter the path to write the script file [/home/tiago/code/teleport/entraid.sh]:

Step 1: Run the Setup Script

1. Open **Azure Cloud Shell** (Bash) using **Google Chrome** or **Safari** for the best compatibility.
2. Upload the setup script using the **Upload** button in the Cloud Shell toolbar.
3. Once uploaded, execute the script by running the following command:
   $ bash entraid.sh

**Important Considerations**:
- You must have **Azure privileged administrator permissions** to complete the integration.
- Ensure you're using the **Bash** environment in Cloud Shell.
- During the script execution, you'll be prompted to run 'az login' to authenticate with Azure. **Teleport** does not store or persist your credentials.
- **Mozilla Firefox** users may experience connectivity issues in Azure Cloud Shell; using Chrome or Safari is recommended.

Once the script completes, type 'continue' to proceed, 'exit' to quit: continue

Step 2: Input Tenant ID and Client ID

With the output of Step 1, please copy and paste the following information:
Enter the Tenant ID: 1056b571-0390-4b08-86c8-2edba8d9ae79
Enter the Client ID: 1056b571-0390-4b08-86c8-2edba8d9ae79

Successfully created EntraID plugin "name".

Changelog: Added support for Entra ID directory synchronization for clusters without public internet access.

This PR adds a cli configuration for Entra ID where it's possible to default to system credentials instead of relying on OIDC for authentication in EntraID. OIDC is not always a possibility specially when the cluster is private and not internet acessible. The UX is the following: ```text Step 1: Run the Setup Script 1. Open **Azure Cloud Shell** (Bash) using **Google Chrome** or **Safari** for the best compatibility. 2. Upload the setup script using the **Upload** button in the Cloud Shell toolbar. 3. Once uploaded, execute the script by running the following command: $ bash entraid.sh **Important Considerations**: - You must have **Azure privileged administrator permissions** to complete the integration. - Ensure you're using the **Bash** environment in Cloud Shell. - During the script execution, you'll be prompted to run 'az login' to authenticate with Azure. **Teleport** does not store or persist your credentials. - **Mozilla Firefox** users may experience connectivity issues in Azure Cloud Shell; using Chrome or Safari is recommended. Once the script completes, type 'continue' to proceed, 'exit' to quit: continue Step 2: Input Tenant ID and Client ID With the output of Step 1, please copy and paste the following information: Enter the Tenant ID: 1056b571-0390-4b08-86c8-2edba8d9ae79 Enter the Client ID: 1056b571-0390-4b08-86c8-2edba8d9ae79 Successfully created EntraID plugin "name". ``` Signed-off-by: Tiago Silva <[email protected]>

tool/tctl/common/plugin/entraid.go

marcoandredinis · 2024-10-28T14:05:32Z

tool/tctl/common/plugin/entraid.go

+
+**Important Considerations**:
+- You must have **Azure privileged administrator permissions** to complete the integration.
+- Ensure you're using the **Bash** environment in Cloud Shell.


I assume this means that the user's default shell should be bash.
However, given that we are calling bashe script.sh, it is not really required to be the default but to just be present in the system. I think we could omit this line for the sake of simplicity.

This shell is the azure cloud shell and it's by default bash

tool/tctl/common/plugin/entraid.go

Co-authored-by: Marco Dinis <[email protected]>

mvbrock

LGTM, just a few nitpicks

tool/tctl/common/plugin/entraid.go

marcoandredinis

Just left two comments but no blockers.

tool/tctl/common/plugin/entraid.go

r0mant

With a few suggestions.

r0mant · 2024-10-29T15:24:24Z

lib/msgraph/models.go

+func (g *Group) IsOffice365Group() bool {
+	const office365Group = "Unified"
+	return slices.Contains(g.GroupTypes, office365Group)
 }


Where is this being used? I can't find it in this PR.

It's being used in e

tool/tctl/common/plugin/entraid.go

r0mant · 2024-10-29T15:29:43Z

tool/tctl/common/plugin/entraid.go

+	fmt.Fprintf(os.Stdout, tmpl, filepath.Base(fileLoc))
+
+	op, err := readData(os.Stdin, os.Stdout,
+		"Once the script completes, type 'continue' to proceed, 'exit' to quit",


Nit: Can they continue/rerun this command if they choose to exit? I would include this information in the message, I would be wondering what happens if I exit but say want to resume later or clean up.

r0mant · 2024-10-29T15:32:08Z

tool/tctl/common/plugin/entraid.go

+			{
+				Name:  "https://example.com/my_attribute",
+				Value: "my_value",
+				Roles: []string{"requester"},
+			},


How would a user know they need to modify these? Should the command ask for claim name and value as a part of this setup flow?

tool/tctl/common/plugin/entraid.go

public-teleport-github-review-bot · 2024-10-29T18:11:29Z

@tigrato See the table below for backport results.

Branch	Result
branch/v16	Failed
branch/v17	Create PR

* [entraid] add setup script for offline clusters. This PR adds a cli configuration for Entra ID where it's possible to default to system credentials instead of relying on OIDC for authentication in EntraID. OIDC is not always a possibility specially when the cluster is private and not internet acessible. The UX is the following: ```text Step 1: Run the Setup Script 1. Open **Azure Cloud Shell** (Bash) using **Google Chrome** or **Safari** for the best compatibility. 2. Upload the setup script using the **Upload** button in the Cloud Shell toolbar. 3. Once uploaded, execute the script by running the following command: $ bash entraid.sh **Important Considerations**: - You must have **Azure privileged administrator permissions** to complete the integration. - Ensure you're using the **Bash** environment in Cloud Shell. - During the script execution, you'll be prompted to run 'az login' to authenticate with Azure. **Teleport** does not store or persist your credentials. - **Mozilla Firefox** users may experience connectivity issues in Azure Cloud Shell; using Chrome or Safari is recommended. Once the script completes, type 'continue' to proceed, 'exit' to quit: continue Step 2: Input Tenant ID and Client ID With the output of Step 1, please copy and paste the following information: Enter the Tenant ID: 1056b571-0390-4b08-86c8-2edba8d9ae79 Enter the Client ID: 1056b571-0390-4b08-86c8-2edba8d9ae79 Successfully created EntraID plugin "name". ``` Signed-off-by: Tiago Silva <[email protected]> * move function to api * handle code review comments * Apply suggestions from code review Co-authored-by: Marco Dinis <[email protected]> * fix url * enable group claims * add godoc * handle code review comments * fix gomod --------- Signed-off-by: Tiago Silva <[email protected]> Co-authored-by: Marco Dinis <[email protected]>

* [entraid] add setup script for offline clusters. This PR adds a cli configuration for Entra ID where it's possible to default to system credentials instead of relying on OIDC for authentication in EntraID. OIDC is not always a possibility specially when the cluster is private and not internet acessible. The UX is the following: ```text Step 1: Run the Setup Script 1. Open **Azure Cloud Shell** (Bash) using **Google Chrome** or **Safari** for the best compatibility. 2. Upload the setup script using the **Upload** button in the Cloud Shell toolbar. 3. Once uploaded, execute the script by running the following command: $ bash entraid.sh **Important Considerations**: - You must have **Azure privileged administrator permissions** to complete the integration. - Ensure you're using the **Bash** environment in Cloud Shell. - During the script execution, you'll be prompted to run 'az login' to authenticate with Azure. **Teleport** does not store or persist your credentials. - **Mozilla Firefox** users may experience connectivity issues in Azure Cloud Shell; using Chrome or Safari is recommended. Once the script completes, type 'continue' to proceed, 'exit' to quit: continue Step 2: Input Tenant ID and Client ID With the output of Step 1, please copy and paste the following information: Enter the Tenant ID: 1056b571-0390-4b08-86c8-2edba8d9ae79 Enter the Client ID: 1056b571-0390-4b08-86c8-2edba8d9ae79 Successfully created EntraID plugin "name". ``` * move function to api * handle code review comments * Apply suggestions from code review * fix url * enable group claims * add godoc * handle code review comments * fix gomod --------- Signed-off-by: Tiago Silva <[email protected]> Co-authored-by: Marco Dinis <[email protected]>

tigrato added backport/branch/v14 backport/branch/v15 backport/branch/v16 labels Oct 23, 2024

github-actions bot requested review from EdwardDowling and r0mant October 23, 2024 17:12

github-actions bot added size/md tctl tctl - Teleport admin tool labels Oct 23, 2024

tigrato force-pushed the tigrato/entra-id branch from 0c931bd to e82e8fe Compare October 23, 2024 17:53

tigrato force-pushed the tigrato/entra-id-sync branch from 4875073 to c0852f8 Compare October 23, 2024 17:59

Base automatically changed from tigrato/entra-id to master October 24, 2024 09:35

tigrato added 2 commits October 24, 2024 11:14

move function to api

ff60a0f

tigrato force-pushed the tigrato/entra-id-sync branch from 857e3e8 to ff60a0f Compare October 24, 2024 10:14

tigrato requested a review from mvbrock October 28, 2024 10:53

marcoandredinis reviewed Oct 28, 2024

View reviewed changes

tigrato and others added 2 commits October 28, 2024 15:12

handle code review comments

c7dd315

Apply suggestions from code review

37e9dee

Co-authored-by: Marco Dinis <[email protected]>

tigrato requested a review from marcoandredinis October 28, 2024 15:14

mvbrock approved these changes Oct 28, 2024

View reviewed changes

tool/tctl/common/plugin/entraid.go Outdated Show resolved Hide resolved

tool/tctl/common/plugin/entraid.go Show resolved Hide resolved

tool/tctl/common/plugin/entraid.go Outdated Show resolved Hide resolved

marcoandredinis approved these changes Oct 28, 2024

View reviewed changes

tool/tctl/common/plugin/entraid.go Outdated Show resolved Hide resolved

tool/tctl/common/plugin/entraid.go Show resolved Hide resolved

fix url

8f04e0d

tigrato force-pushed the tigrato/entra-id-sync branch from 2059099 to 8f04e0d Compare October 28, 2024 19:14

tigrato added 2 commits October 29, 2024 10:19

enable group claims

b1911b5

add godoc

5edc514

r0mant approved these changes Oct 29, 2024

View reviewed changes

public-teleport-github-review-bot bot removed the request for review from EdwardDowling October 29, 2024 15:36

handle code review comments

209e239

tigrato enabled auto-merge October 29, 2024 16:40

tigrato added backport/branch/v17 and removed backport/branch/v14 labels Oct 29, 2024

tigrato removed the backport/branch/v15 label Oct 29, 2024

tigrato added this pull request to the merge queue Oct 29, 2024

fix gomod

803810a

tigrato removed this pull request from the merge queue due to a manual request Oct 29, 2024

tigrato force-pushed the tigrato/entra-id-sync branch from a596429 to 803810a Compare October 29, 2024 17:34

tigrato enabled auto-merge October 29, 2024 17:34

tigrato added this pull request to the merge queue Oct 29, 2024

Merged via the queue into master with commit 768a0bd Oct 29, 2024
41 checks passed

tigrato deleted the tigrato/entra-id-sync branch October 29, 2024 18:10

tigrato mentioned this pull request Oct 29, 2024

[v17] [entraid] add setup script for offline clusters. #48088

Merged

tigrato mentioned this pull request Oct 29, 2024

[v16] [entraid] add setup script for offline clusters. #48089

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[entraid] add setup script for offline clusters. #47863

[entraid] add setup script for offline clusters. #47863

tigrato commented Oct 23, 2024

marcoandredinis Oct 28, 2024

tigrato Oct 28, 2024

mvbrock left a comment

marcoandredinis left a comment

r0mant left a comment

r0mant Oct 29, 2024

tigrato Oct 29, 2024

r0mant Oct 29, 2024

r0mant Oct 29, 2024

public-teleport-github-review-bot bot commented Oct 29, 2024

[entraid] add setup script for offline clusters. #47863

[entraid] add setup script for offline clusters. #47863

Conversation

tigrato commented Oct 23, 2024

marcoandredinis Oct 28, 2024

Choose a reason for hiding this comment

tigrato Oct 28, 2024

Choose a reason for hiding this comment

mvbrock left a comment

Choose a reason for hiding this comment

marcoandredinis left a comment

Choose a reason for hiding this comment

r0mant left a comment

Choose a reason for hiding this comment

r0mant Oct 29, 2024

Choose a reason for hiding this comment

tigrato Oct 29, 2024

Choose a reason for hiding this comment

r0mant Oct 29, 2024

Choose a reason for hiding this comment

r0mant Oct 29, 2024

Choose a reason for hiding this comment

public-teleport-github-review-bot bot commented Oct 29, 2024