search

gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.
https://goteleport.com
GNU Affero General Public License v3.0
17.07k stars 1.71k forks source link

Teleport Connect not filtering SSH users like Web UI #23723

Open stevenGravy opened 1 year ago

stevenGravy commented 1 year ago

Expected behavior:

The list of users for SSH servers only include the applicable users

Current behavior:

All users can show when applying a Access Request.

Web UI

image

Same Access Request applied in Teleport Connect:

image

Bug details:

Create a Acess request to another role with different users. Request and be granted that access request. Apply within Teleport Connect. Note that you will see both the original certificate login users and the access request applied cert logins.

Related issues:

ravicious commented 1 month ago

I just tried to address this while fixing pagination (#42501). It's entirely doable as it's mostly a matter of extracting calculateSSHLogins to lib/client and changing it so that it accepts localLogins []string instead of a tlsca.Identity.

However, constructing all arguments this function accepts and the dependencies of those arguments requires adding a bunch of new methods. It's like a day of work, but I just don't have the time for that at the moment.