self-hosted/teleport
self-hosted/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport synced 2024-10-21 09:44:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
teleport/examples/go-client
History
Andrew Lytvynov 5bd66a396e Plumb caller username for CRUD events via contexts 
Our auth middleware already attaches a TLS identity as context value.
Plumb contexts through and extract the username when recording events.
If the received context doesn't have an identity attached, use "system"
as username.

Lots of noise here due to missing context.Context plumbing :(
We should eventually plumb contexts to all those RPC interfaces.

Updates #3816
2020-06-18 19:01:35 +00:00
..
main.go Plumb caller username for CRUD events via contexts 2020-06-18 19:01:35 +00:00
README.md Updated README for go-client (auth server API example) 2018-02-14 10:26:23 -08:00

README.md

Teleport Auth Go Client

Introduction

Teleport Auth Server has an API which hasn't been officially documented (yet). Both tctl and tsh use the Auth API to:

  • Request certificates (tsh login or tctl auth sign)
  • Add nodes and users (tctl users and tctl nodes)
  • Manipulate cluster state (tctl resources)

API Authentication

Auth API clients must perform two-way authentication using x509 certificates:

  1. They have to validate the auth server x509 certificate to make sure the API endpoint can be trusted.
  2. They must offer their x509 certificate, which has been previously issued by the auth sever.

Demo

This little program demonstrates how to:

  1. Authenticate against the Auth API using two certificates.
  2. Makes an API call to issue a server join token, i.e. an equivalent of tctl node add

Before running it, you have to use tctl to issue an API certificate, i.e. on the auth server:

$ tctl auth export --type=tls > /var/lib/teleport/ca.cert

This should work as long as you execute it on the same auth server:

$ go get github.com/gravitational/teleport/lib/auth
$ go run main.go

TODO

This Auth server API allows clients to "jump" to API endpoints of all trusted clusters connected to it. We need to add a snippet how to enumerate trusted clusters and connect to their API endpoints later.