Merge Teleport V4.3 UI branch to master (gravitational#3583)

* Add monorepo

* Add reset/passwd capability for local users (gravitational#3287)

* Add UserTokens to allow password resets

* Pass context down through ChangePasswordWithToken

* Rename UserToken to ResetPasswordToken

* Add auto formatting for proto files

* Add common Marshaller interfaces to reset password token

* Allow enterprise "tctl" reuse OSS user methods (gravitational#3344)

* Pass localAuthEnabled flag to UI (gravitational#3412)

* Added LocalAuthEnabled prop to WebConfigAuthSetting struct in webconfig.go
* Added LocalAuthEnabled state as part of webCfg in  apiserver.go

* update e-refs

* Fix a regression bug after merge

* Update tctl CLI output msgs (gravitational#3442)

* Use local user client when resolving user roles

* Update webapps ref

* Add and retrieve fields from Cluster struct (gravitational#3476)

* Set Teleport versions for node, auth, proxy init heartbeat
* Add and retrieve fields NodeCount, PublicURL, AuthVersion from Clusters
* Remove debug logging to avoid log pollution when getting public_addr of proxy
* Create helper func GuessProxyHost to get the public_addr of a proxy host
* Refactor newResetPasswordToken to use GuessProxyHost and remove publicUrl func

* Remove webapps submodule

* Add webassets submodule

* Replace webapps sub-module reference with webassets

* Update webassets path in Makefile

* Update webassets

1b11b26 Simplify and clean up Makefile (gravitational#62) gravitational/webapps@1b11b26

* Retrieve cluster details for user context (gravitational#3515)

* Let GuessProxyHost also return proxy's version
* Unit test GuessProxyHostAndVersion & GetClusterDetails

* Update webassets

4dfef4e Fix build pipeline (gravitational#66) gravitational/webapps@4dfef4e

* Update e-ref

* Update webassets

0647568 Fix OSS redirects gravitational/webapps@0647568

* update e-ref

* Update webassets

e0f4189 Address security audit warnings Updates  "minimist" package which is used by 7y old "optimist". gravitational/webapps@e0f4189

* Add new attr to Session struct (gravitational#3574)

* Add fields ServerHostname and ServerAddr
* Set these fields on newSession

* Ensure webassets submodule during build

* Update e-ref

* Ensure webassets before running unit-tests

* Update E-ref

Co-authored-by: Lisa Kim <[email protected]>
Co-authored-by: Pierre Beaucamp <[email protected]>
Co-authored-by: Jenkins <[email protected]>

.gitattributes

@@ -1,6 +1,3 @@
-web/dist/app/vendor.js linguist-vendored
-web/dist/app/assets/* linguist-vendored
-web/src/assets/* linguist-vendored
-web/src/styles/bootstrap/bootstrap.scss linguist-vendored
+webassets/* linguist-vendored
 docs/theme/js/* linguist-vendored
 docs/theme/js/theme.js linguist-vendored=false

.gitignore

@@ -9,9 +9,6 @@ darwin
 *.gz
 *.zip
 
-# built web assets
-web/dist/app/app
-
 # editors
 .vscode
 

.gitmodules

@@ -4,3 +4,6 @@
 [submodule "examples/chart/teleport-demo/secrets"]
 	path = examples/chart/teleport-demo/secrets
 	url = [email protected]:gravitational/ops.git
+[submodule "webassets"]
+	path = webassets
+	url = https://github.com/gravitational/webassets.git

Makefile

@@ -88,7 +88,7 @@ $(BUILDDIR)/tctl:
 	GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG) go build -tags "$(PAM_TAG) $(FIPS_TAG) $(BPF_TAG)" -o $(BUILDDIR)/tctl $(BUILDFLAGS) ./tool/tctl
 
 .PHONY: $(BUILDDIR)/teleport
-$(BUILDDIR)/teleport:
+$(BUILDDIR)/teleport: ensure-webassets
 	GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG) go build -tags "$(PAM_TAG) $(FIPS_TAG) $(BPF_TAG)" -o $(BUILDDIR)/teleport $(BUILDFLAGS) ./tool/teleport
 
 .PHONY: $(BUILDDIR)/tsh
@@ -193,6 +193,7 @@ run-docs:
 # tests everything: called by Jenkins
 #
 .PHONY: test
+test: ensure-webassets
 test: FLAGS ?= '-race'
 test: PACKAGES := $(shell go list ./... | grep -v integration)
 test: $(VERSRC)
@@ -243,7 +244,7 @@ tag:
 $(BUILDDIR)/webassets.zip:
 ifneq ("$(OS)", "windows")
 	@echo "---> Building OSS web assets."
-	cd web/dist ; zip -qr ../../$(BUILDDIR)/webassets.zip .
+	cd webassets/teleport/ ; zip -qr ../../$(BUILDDIR)/webassets.zip .
 endif
 
 .PHONY: test-package
@@ -305,6 +306,8 @@ grpc: buildbox
 buildbox-grpc:
 # standard GRPC output
 	echo $$PROTO_INCLUDE
+	find lib/ -iname *.proto | xargs clang-format -i -style='{ColumnLimit: 100, IndentWidth: 4, Language: Proto}'
+
 	cd lib/events && protoc -I=.:$$PROTO_INCLUDE \
 	  --gofast_out=plugins=grpc:.\
     *.proto
@@ -410,3 +413,30 @@ deb:
 update-helm-charts:
 	sed -i -E "s/^  tag: [a-z0-9.-]+$$/  tag: $(VERSION)/" examples/chart/teleport/values.yaml
 	sed -i -E "s/^teleportVersion: [a-z0-9.-]+$$/teleportVersion: $(VERSION)/" examples/chart/teleport-demo/values.yaml
+
+.PHONY: ensure-webassets
+ensure-webassets:
+	@if [ ! -d $(shell pwd)/webassets/teleport/ ]; then \
+		$(MAKE) init-webapps-submodules; \
+	fi;
+
+.PHONY: ensure-webassets-e
+ensure-webassets-e:
+	@if [ ! -d $(shell pwd)/webassets/e/teleport ]; then \
+		$(MAKE) init-webapps-submodules-e; \
+	fi;
+
+.PHONY: init-webapps-submodules
+init-webapps-submodules:
+	echo "init webassets submodule"
+	git submodule update --init webassets
+
+.PHONY: init-webapps-submodules-e
+init-webapps-submodules-e:
+	echo "init webassets oss and enterprise submodules"
+	git submodule update --init --recursive webassets
+
+.PHONY: init-submodules-e
+init-submodules-e: init-webapps-submodules-e
+	git submodule init e
+	git submodule update

README.md

@@ -21,11 +21,11 @@ practices like:
 - No need to distribute keys: Teleport uses certificate-based access with automatic certificate expiration time.
 - 2nd factor authentication (2FA) for SSH and Kubernetes.
 - Collaboratively troubleshoot issues through session sharing.
-- Single sign-on (SSO) for SSH/Kubernetes and your organization identities via 
+- Single sign-on (SSO) for SSH/Kubernetes and your organization identities via
   Github Auth, OpenID Connect or SAML with endpoints like Okta or Active Directory.
 - Cluster introspection: every SSH node and its status can be queried via CLI and Web UI.
 
-Teleport is built on top of the high-quality [Golang SSH](https://godoc.org/golang.org/x/crypto/ssh) 
+Teleport is built on top of the high-quality [Golang SSH](https://godoc.org/golang.org/x/crypto/ssh)
 implementation and it is _fully compatible with OpenSSH_ and can be used with
 `sshd` servers and `ssh` clients.
 
@@ -41,17 +41,17 @@ implementation and it is _fully compatible with OpenSSH_ and can be used with
 
 ## Installing and Running
 
-Download the [latest binary release](https://gravitational.com/teleport/download/), 
-unpack the .tar.gz and run `sudo ./install`. This will copy Teleport binaries into 
+Download the [latest binary release](https://gravitational.com/teleport/download/),
+unpack the .tar.gz and run `sudo ./install`. This will copy Teleport binaries into
 `/usr/local/bin`.
 
 Then you can run Teleport as a single-node cluster:
 
 ```bash
-$ sudo teleport start 
+$ sudo teleport start
 ```
 
-In a production environment Teleport must run as root. But to play, just do `chown $USER /var/lib/teleport` 
+In a production environment Teleport must run as root. But to play, just do `chown $USER /var/lib/teleport`
 and run it under `$USER`, in this case you will not be able to login as someone else though.
 
 ## Docker
@@ -71,8 +71,7 @@ Follow instructions at [docker/README](docker/README.md)
 ## Building Teleport
 
 Teleport source code consists of the actual Teleport daemon binary written in Golang, and also
-it has a web UI (located in /web directory) written in Javascript. The WebUI is not changed often
-and we keep it checked into Git under `/dist`, so you only need to build Golang:
+of a web UI (a git submodule located in /webassets directory) written in Javascript.
 
 Make sure you have Golang `v1.13` or newer, then run:
 
@@ -89,7 +88,7 @@ $ sudo mkdir -p /var/lib/teleport
 $ sudo chown $USER /var/lib/teleport
 ```
 
-If the build succeeds the binaries will be placed in 
+If the build succeeds the binaries will be placed in
 `$GOPATH/src/github.com/gravitational/teleport/build`
 
 NOTE: The Go compiler is somewhat sensitive to amount of memory: you will need
@@ -100,14 +99,25 @@ NOTE: This will build the latest version of Teleport, regardless of whether it i
 
 ### Rebuilding Web UI
 
-To enable speedy iterations on the Web UI, teleport can load the web UI assets 
-from the source directory. To enable this behavior, set the environment variable 
-`DEBUG=1` and rebuild with the default target:
+Teleport Web UI is located in the [Gravitational Webapps](https://github.com/gravitational/webapps.) monorepo.
+You can clone that repository and rebuild teleport UI package with:
 
 ```bash
-$ make
+$ git clone [email protected]:gravitational/webapps.git
+$ cd webapps
+$ make build-teleport
+```
+
+Then you can replace Teleport web UI files with the one found in the generated `/dist` folder.
+
+To enable speedy iterations on the Web UI, you can run a
+[local web-dev server](https://github.com/gravitational/webapps/tree/master/packages/teleport).
 
-# Run Teleport as a single-node cluster in development mode: 
+You can also tell teleport to load the web UI assets from the source directory.
+To enable this behavior, set the environment variable `DEBUG=1` and rebuild with the default target:
+
+```bash
+# Run Teleport as a single-node cluster in development mode:
 $ DEBUG=1 ./build/teleport start -d
 ```
 
@@ -134,7 +144,7 @@ expensive to maintain. Additionally, most organizations use multiple
 infrastructure form factors such as several cloud providers, multiple cloud
 accounts, servers in colocation, and even smart devices. Some of those devices
 run on untrusted networks, behind third party firewalls. This only magnifies
-complexity and increases operational overhead. 
+complexity and increases operational overhead.
 
 We had a choice, either to start a security consulting business or build a
 solution that’s dead-easy to use and understand, something that creates an
@@ -160,11 +170,11 @@ We offer a few different options for support. First of all, we try to provide cl
 ## Is Teleport Secure and Production Ready?
 
 Teleport has completed several security audits from the nationally recognized
-technology security companies. [Some](https://gravitational.com/blog/teleport-release-2-2/) of 
-[them](https://gravitational.com/blog/teleport-security-audit/) have been made public. 
+technology security companies. [Some](https://gravitational.com/blog/teleport-release-2-2/) of
+[them](https://gravitational.com/blog/teleport-security-audit/) have been made public.
 We are comfortable with the use of Teleport from a security perspective.
 
-You can see the list of companies who use Teleport in production on the Teleport 
+You can see the list of companies who use Teleport in production on the Teleport
 [product page](https://gravitational.com/teleport#customerlist).
 
 However, Teleport is still a relatively young product so you may experience
@@ -177,11 +187,11 @@ The latest stable Teleport build can be found in [Releases](https://gravitationa
 ## Who Built Teleport?
 
 Teleport was created by [Gravitational Inc](https://gravitational.com). We have
-built Teleport by borrowing from our previous experiences at Rackspace. It has 
+built Teleport by borrowing from our previous experiences at Rackspace. It has
 been extracted from [Gravity](https://gravitational.com/gravity/), our
-Kubernetes distribution optimized for deploying and remotely controlling complex 
+Kubernetes distribution optimized for deploying and remotely controlling complex
 applications into multiple environments _at the same time_:
 
 * Multiple cloud regions
-* Colocation 
+* Colocation
 * Private enterprise clouds located behind firewalls

build.assets/grpc/Dockerfile

@@ -7,7 +7,7 @@ ARG PLATFORM
 ENV TARBALL protoc-${PROTOC_VER}-${PLATFORM}.zip
 ENV GOGOPROTO_ROOT ${GOPATH}/src/github.com/gogo/protobuf
 
-RUN apt-get update && apt-get install unzip
+RUN apt-get update && apt-get install unzip clang-format -y
 
 RUN curl -L -o /tmp/${TARBALL} https://github.com/google/protobuf/releases/download/v${PROTOC_VER}/${TARBALL}
 RUN cd /tmp && unzip /tmp/protoc-${PROTOC_VER}-linux-x86_64.zip -d /usr/local && rm /tmp/${TARBALL}

integration/integration_test.go

@@ -44,7 +44,6 @@ import (
 	"github.com/gravitational/teleport/lib"
 	"github.com/gravitational/teleport/lib/auth"
 	"github.com/gravitational/teleport/lib/auth/testauthority"
-	"github.com/gravitational/teleport/lib/backend"
 	"github.com/gravitational/teleport/lib/bpf"
 	"github.com/gravitational/teleport/lib/client"
 	"github.com/gravitational/teleport/lib/defaults"
@@ -3795,70 +3794,6 @@ func (s *IntSuite) TestList(c *check.C) {
 	}
 }
 
-// TestMultipleSignup makes sure that multiple users can create Teleport accounts.
-func (s *IntSuite) TestMultipleSignup(c *check.C) {
-	tr := utils.NewTracer(utils.ThisFunction()).Start()
-	defer tr.Stop()
-
-	type createNewUserReq struct {
-		InviteToken string `json:"invite_token"`
-		Pass        string `json:"pass"`
-	}
-
-	// Create and start a Teleport cluster.
-	makeConfig := func() (*check.C, []string, []*InstanceSecrets, *service.Config) {
-		clusterConfig, err := services.NewClusterConfig(services.ClusterConfigSpecV3{
-			SessionRecording: services.RecordAtNode,
-			LocalAuth:        services.NewBool(true),
-		})
-		c.Assert(err, check.IsNil)
-
-		tconf := service.MakeDefaultConfig()
-		tconf.Auth.Preference.SetSecondFactor("off")
-		tconf.Auth.Enabled = true
-		tconf.Auth.ClusterConfig = clusterConfig
-		tconf.Proxy.Enabled = true
-		tconf.Proxy.DisableWebService = false
-		tconf.Proxy.DisableWebInterface = true
-		tconf.SSH.Enabled = true
-		return c, nil, nil, tconf
-	}
-	main := s.newTeleportWithConfig(makeConfig())
-	defer main.Stop(true)
-
-	mainAuth := main.Process.GetAuthServer()
-
-	// Create a few users to make sure the proxy uses the correct identity
-	// when connecting to the auth server.
-	for i := 0; i < 5; i++ {
-		// Create a random username.
-		username, err := utils.CryptoRandomHex(16)
-		c.Assert(err, check.IsNil)
-
-		// Create signup token, this is like doing "tctl users add foo foo".
-		token, err := mainAuth.CreateSignupToken(services.UserV1{
-			Name:          username,
-			AllowedLogins: []string{username},
-		}, backend.Forever)
-		c.Assert(err, check.IsNil)
-
-		// Create client that will simulate web browser.
-		clt, err := createWebClient(main)
-		c.Assert(err, check.IsNil)
-
-		// Render the signup page.
-		_, err = clt.Get(context.Background(), clt.Endpoint("webapi", "users", "invites", token), url.Values{})
-		c.Assert(err, check.IsNil)
-
-		// Make sure signup is successful.
-		_, err = clt.PostJSON(context.Background(), clt.Endpoint("webapi", "users"), createNewUserReq{
-			InviteToken: token,
-			Pass:        "fake-password-123",
-		})
-		c.Assert(err, check.IsNil)
-	}
-}
-
 // TestDataTransfer makes sure that a "session.data" event is emitted at the
 // end of a session that matches the amount of data that was transferred.
 func (s *IntSuite) TestDataTransfer(c *check.C) {

lib/auth/api.go

@@ -62,7 +62,7 @@ type ReadAccessPoint interface {
 	// GetNamespace returns namespace by name
 	GetNamespace(name string) (*services.Namespace, error)
 
-	// GetServers returns a list of registered servers
+	// GetNodes returns a list of registered servers for this cluster.
 	GetNodes(namespace string, opts ...services.MarshalOption) ([]services.Server, error)
 
 	// GetProxies returns a list of proxy servers registered in the cluster