Skip to content

Commit

Permalink
Respond to PR feedback
Browse files Browse the repository at this point in the history
  • Loading branch information
ptgott committed Jun 8, 2022
1 parent cd67d48 commit d83f7f9
Showing 1 changed file with 5 additions and 18 deletions.
23 changes: 5 additions & 18 deletions docs/pages/includes/node-logins.mdx
Original file line number Diff line number Diff line change
@@ -1,30 +1,17 @@
When Teleport's Auth Service receives a request to list Teleport Nodes (e.g., to
display Nodes in the Web UI or via `tsh ls`), it only returns the Nodes that the
current user is authorized to access.
current user is authorized to view.

For each Node in the user's Teleport cluster, the Auth Service applies the
following checks in order and, if one check fails, hides the Node from the user:

{/*
TODO: We might want to mention that the Auth Service checks the resource's
namespace as well, but we currently do not document resource namespaces.
This would not be the appropriate place to include our only namespace
documentation. See gravitational/teleport issue #12580.
*/}

- None of the user's roles contains a `deny` rule that matches the Node's labels.
- None of the user's roles contains a `deny` rule that matches the user's
`traits.logins`.
- None of the user's roles contain a `deny` rule that matches the Node's labels.
- None of the user's roles contain a `deny` rule that matches the user's login.
- At least one of the user's roles contains an `allow` rule that matches the
Node's labels.
- At least one of the user's roles contains an `allow` rule that matches the
user's `traits.logins`.
user's login.

If you are not seeing Nodes when expected, make sure that your user's roles
include the appropriate `allow` and `deny` rules as documented in the
[Teleport Access Controls Reference](/docs/access-controls/reference).

{/* TODO: Change the link above to a relative MDX file link when remark-includes
supports this. */}
[Teleport Access Controls Reference](../access-controls/reference.mdx).

0 comments on commit d83f7f9

Please sign in to comment.