Audit (streaming) session in progress, without joining active session.

[benarent]

Feature Request

Teleport currently lets admins view live session in progress, but that user has to join the session. This leads to some unexpected consequences, such as possible termination of the session for the initial user. The current system only lets auditors review the session after it's complete, with the introduction of Session streaming #3549, we have the ability to retrieve parts of the session prior to end of the session.

Other Request:

• Provide a RBAC Role for an auditor to monitor and watch live session in progress, and report or terminate https://github.com/gravitational/teleport/issues/3360 accordingly.

Product Considerations:

• Updates to the Session Player UI to include streaming of a live session.
• tsh observe - Possible ability to observe a live session in progress from the terminal.

Motivation

Request from prospect, and FedRAMP Customers.

Who's it for?

Community User, Pro, Enterprise

[zmb3]

@benarent would you say the spirit of this one is addressed by moderated sessions?

[zmb3]

This is mostly addressed today:

• instead of tsh observe it's tsh join --mode=observer
• The ability to terminate is included in moderated sessions