From af6bc4da598dfd1b0dd9fc3ac80aa02705c0422b Mon Sep 17 00:00:00 2001 From: Paul Gottschling Date: Tue, 22 Aug 2023 10:15:14 -0400 Subject: [PATCH] Recommend writing the client secret to a file (#29919) * Recommend writing the client secret to a file Fixes #29278 Edit OIDC guides to recommmend writing the user's client secret to a file before running `tctl sso configure oidc`. This way, the client secret does not appear in the user's shell history. * Respond to feedback --- docs/pages/access-controls/sso/github-sso.mdx | 14 +++++++++----- docs/pages/access-controls/sso/gitlab.mdx | 7 +++++-- .../access-controls/sso/google-workspace.mdx | 9 ++++++--- docs/pages/access-controls/sso/oidc.mdx | 16 ++++++++++------ 4 files changed, 30 insertions(+), 16 deletions(-) diff --git a/docs/pages/access-controls/sso/github-sso.mdx b/docs/pages/access-controls/sso/github-sso.mdx index f83ce92b7463..3f745611166f 100644 --- a/docs/pages/access-controls/sso/github-sso.mdx +++ b/docs/pages/access-controls/sso/github-sso.mdx @@ -50,8 +50,12 @@ Create a client secret to use along with the client ID in the next step: ## Step 2/3. Create a GitHub authentication connector -Define a GitHub authentication connector using `tctl`. Update this example -command with: +In this section, you will define a GitHub authentication connector using `tctl`. + +On your workstation, create a file called `client-secret.txt` consisting only of +your client secret. + +Update this example command with: - Your OAuth app's client ID and client secret created during the previous step. - The roles you want to map from your GitHub organization to Teleport roles. @@ -64,7 +68,7 @@ for a full reference of flags for this command: ```code $ tctl sso configure github \ --id= \ ---secret= \ +--secret=$(cat client-secret.txt) \ --teams-to-roles= \ > github.yaml ``` @@ -128,7 +132,7 @@ file to define multiple mappings. For example: ```code $ tctl sso configure github \ --id= \ ---secret= \ +--secret=$(cat client-secret.txt) \ --teams-to-roles= \ --teams-to-roles="ORG-NAME,administrators,admins \ --teams-to-roles="DIFFERENT-ORG,developers,dev \ @@ -163,7 +167,7 @@ instance endpoints with the `--endpoint-url`, `--api-endpoint-url` parameters: ```code $ tctl sso configure github \ --id= \ ---secret= \ +--secret=$(cat client-secret.txt) \ --teams-to-roles= \ --endpoint-url=https:// --api-endpoint-url=https:// diff --git a/docs/pages/access-controls/sso/gitlab.mdx b/docs/pages/access-controls/sso/gitlab.mdx index 61fb54825a71..6ba23a696424 100644 --- a/docs/pages/access-controls/sso/gitlab.mdx +++ b/docs/pages/access-controls/sso/gitlab.mdx @@ -59,6 +59,9 @@ to each of these groups. Create an OIDC connector resource using `tctl`. +On your workstation, create a file called `client-secret.txt` consisting only of +your client secret. + Replace the application ID and secret with the values from GitLab: @@ -66,7 +69,7 @@ Replace the application ID and secret with the values from GitLab: ```code $ tctl sso configure oidc --preset gitlab \ --id \ ---secret \ +--secret $( cat client-secret.txt) \ --claims-to-roles groups,company/admin,admin \ --claims-to-roles groups,company/dev,dev > oidc.yaml ``` @@ -80,7 +83,7 @@ Replace the application ID and secret with the values from GitLab, and replace $ tctl sso configure oidc --preset gitlab \ --id \ --issuer-url https://gitlab.company.com \ ---secret \ +--secret $( cat client-secret.txt) \ --claims-to-roles groups,company/admin,admin \ --claims-to-roles groups,company/dev,dev > oidc.yaml ``` diff --git a/docs/pages/access-controls/sso/google-workspace.mdx b/docs/pages/access-controls/sso/google-workspace.mdx index 89a72a24c778..377796d3650e 100644 --- a/docs/pages/access-controls/sso/google-workspace.mdx +++ b/docs/pages/access-controls/sso/google-workspace.mdx @@ -298,6 +298,9 @@ The alternative to creating the OIDC connector with embedded JSON is to upload t If you have a self-hosted Teleport cluster, you can upload the service account JSON file to all hosts running the Teleport Auth Service. +On your workstation, create a file called `client-secret.txt` consisting only of +your client secret. + @@ -306,7 +309,7 @@ With this method, you don't have to provide the JSON file to all of the hosts ru ```code $ tctl sso configure oidc --preset google --id \ ---secret \ +--secret $( cat client-secret.txt) \ --claims-to-roles groups,auditor@example.com,auditor \ --claims-to-roles groups,teleport-developers@example.com,access \ --google-admin= \ @@ -379,8 +382,8 @@ make the JSON file available to all hosts running the Teleport Auth Service. ```code $ tctl sso configure oidc --preset google --id \ ---secret \ ---google-acc-uri .json \ +--secret $( cat client-secret.txt) \ +--google-acc-uri .json \ --claims-to-roles groups,auditor@example.com,auditor \ --claims-to-roles groups,teleport-developers@example.com,access \ --google-admin= > gworkspace-connector.yaml diff --git a/docs/pages/access-controls/sso/oidc.mdx b/docs/pages/access-controls/sso/oidc.mdx index 545795fc00a5..1c772fd69425 100644 --- a/docs/pages/access-controls/sso/oidc.mdx +++ b/docs/pages/access-controls/sso/oidc.mdx @@ -37,11 +37,11 @@ For Google Workspace, see [Teleport Authentication with Google Workspace](google Save the relevant information from your identity provider. To make following -this guide easier, you can add the values here and they will be included in the +this guide easier, you can add the Client ID here and it will be included in the example commands below: -- Client ID: -- Client secret: +Client ID: ## OIDC Redirect URL @@ -57,8 +57,11 @@ with your Teleport Cloud tenant or Proxy Service address. ## OIDC connector configuration The next step is to add an OIDC connector to Teleport. The connectors are -created, tested, and added or removed using `tctl` [resource commands](../../reference/resources.mdx) -or the Teleport Web UI. +created, tested, and added or removed using `tctl` [resource +commands](../../reference/resources.mdx) or the Teleport Web UI. + +On your workstation, create a file called `client-secret.txt` consisting only of +your client secret. To create a new connector, use `tctl sso configure`. The following example creates a connector resource file in YAML format named `oidc-connector.yaml`: @@ -66,7 +69,8 @@ connector resource file in YAML format named `oidc-connector.yaml`: ```code $ tctl sso configure oidc --name \ --issuer-url \ - --id --secret \ + --id \ + --secret $(cat client-secret.txt) \ --claims-to-roles ,,access \ --claims-to-roles ,,editor > oidc-connector.yaml ```