Closed r0mant closed 1 month ago
Should we pick a name that clarifies that all ports will be allowed for those addresses? Do we care about restricting ports in some way?
Is https allowed for these CIDR ranges?
Are we ok with only CIDRs or should we allow for more flexibility with a regexp on hostnames instead? (which would make it possible but quite a bit more annoying to configure a specific local range, admittedly: ^192\.168\.3\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])$
)
We should ensure that the CIDR parsing works with ipv6 addresses as hostnames, too.
@capnspacehook FYI^
Teleport SSO connectors currently support specifying allowed https redirect domains that are used in conjunction with tsh --callback flag to allow redirecting SSO callback to an address other than localhost:
https://github.com/gravitational/teleport/blob/fa64296694a824e58bdea9d999ec8edc9b9ce0e3/api/proto/teleport/legacy/types/types.proto#L4436-L4439
Currently only redirects to https addresses on port 443 are supported, however some customers that use tsh login callback functionality to implement headless login pattern on their engineers' dev instances require support for plain http redirect to a set of arbitrary IPs. To solve this, add a new
insecure_allowed_cidr_ranges
field to client redirect settings that accepts a list of CIDR ranges that are valid for the redirect.To do that we need to: