Consider adding an OSS-specific guide to Role Access Requests

[ptgott]

Details

While there are a lot of restrictions around Role Access Requests in OSS Teleport, there could be enough things you can do—and enough real value to be had—that it's worth looking into writing a guide for how to achieve a Role Access Request workflow without Cloud/Enterprise. OSS Teleport users who rely on Role Access Requests can then graduate to Cloud/Enterprise for a smoother experience when the time comes. (We can also consider modifying the existing Role Access Request guide to add tabs for OSS users.)

The workflow would look like:

1. Set up RBAC: roles must only use the default request strategy, cannot define thresholds, and cannot include review_requests or search_as_roles. See the way we check Access Request support in the source.

   We'll need to see whether enabling creating/updating access request resources in a spec.allow.rules[*]resources rule can bypass the restriction against review_requests.

2. Request access via tsh login --request-roles (this uses the Auth Service and doesn't rely on plugins/Teleport Enterprise)

3. Approve/deny access requests via tctl (using tsh or the Web UI is not possible in OSS Teleport)

Category

• Improve Existing

[ptgott]

Marking this as "urgent" since Access Requests are a strong Teleport feature and we want to provide as much clarity into them as we can!