feat: role version V8 #47912
Draft
feat: role version V8 #47912
+782
−42
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
nklaassen
reviewed
Oct 24, 2024
| @@ -959,11 +959,11 @@ func (r *RoleV6) GetPrivateKeyPolicy() keys.PrivateKeyPolicy { | |||
| // setStaticFields sets static resource header and metadata fields. | |||
| func (r *RoleV6) setStaticFields() { | |||
| r.Kind = KindRole | |||
| if r.Version != V3 && r.Version != V4 && r.Version != V5 && r.Version != V6 { | |||
| if r.Version != V3 && r.Version != V4 && r.Version != V5 && r.Version != V6 && r.Version != V7 { | |||
| // When incrementing the role version, make sure to update the | |||
| // role version in the asset file used by the UI. | |||
| // See: web/packages/teleport/src/Roles/templates/role.yaml | |||
There was a problem hiding this comment.
was this done? or if the relevant file name changed can we update this comment?
| // maybeDowngradeRoleVersionToV7 downgrades the role version to V7 if | ||
| // the client version passed through the gRPC metadata is below the version | ||
| // specified in minSupportedRoleV8Version. | ||
| func maybeDowngradeRoleVersionToV7(role *types.RoleV6, clientVersion *semver.Version) *types.RoleV6 { |
There was a problem hiding this comment.
shouldn't you modify the role so that it won't grant access to the saml IDP apps if the v8 role wouldn't grant access?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
app_labelsmatcher forsaml_idp_service_providerkind. App label matchers will only be enforced in SAML service provider starting version rolev8. This is managed with a newCheckRoleSupportsSAMLIdPAppLabelMatchermethod which returns true when user is assigned with a role versionv8.v7andv8all remains the same. No new fields added to the role and rule spec. Does not affect any RBAC behaviour except forsaml_idp_service_providerresource.GetRoleis updated to downgrade the role versions fromv8tov7for clients that have version below than thev17.0.0.v8version.Not covered in this PR:
v7v8. Other presets remains as is.