desktop access: enhanced labeling support

[zmb3]

The current mechanism for labeling Windows Desktops is to run a regex against the desktop's name:

  # Rules for applying labels to Windows hosts based on regular expressions
  # matched against the host name. If multiple rules match, the desktop will
  # get the union of all matching labels.
  host_labels:
  - match: '^.*\.dev\.example\.com$'
    labels:
      environment: dev
  - match: '^.*\.prod\.example\.com$'
    labels:
      environment: prod

If you're using labels for access control like we recommend, then this means your desktops must follow a naming convention where similar desktops are named in a common way so that they can be grouped by label. In many cases, desktop names are randomly assigned and don't follow a particular pattern.

This request includes 3 enhancements for labeling Windows desktops that are discovered via LDAP:

• Always include the Organizational Unit (OU) as a new teleport.dev/ou label. This will allow organizations who don't have a formal naming standard but do organize desktops by OU to label desktops accordingly.
• Provide a regex-based labeling system similar to today's host_labels feature, but allow the regex to match against the full distinguished name (DN) of the desktop, not just the hostname. This will allow further customization for cases where option 1 alone is not sufficient.
• Allow for pulling in custom LDAP attributes and adding them as labels. This is similar to the labeling work we're doing based on AWS tags in Automatically add AWS tags to servers #11627. The proposal is to extend the discovery section of the config to allow users to specify a set of additional LDAP attributes that should be included on the query and set as labels on the host:

  discovery:
    base_dn: '*'
    filters:
    - '(location=Oakland)'
    - '(!(primaryGroupID=516))' # exclude domain controllers
    
    # new: specify LDAP attributes that should be turned into labels
    attribute_labels:
    - location    
    - department