Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v10] Document new pin_source_ip role option #13939

Merged
merged 4 commits into from
Jul 1, 2022
Merged

[v10] Document new pin_source_ip role option #13939

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
58e4ae5
Document new pin_source_ip role option (#13495)
zmb3 Jun 28, 2022
9f7c3f9
Merge branch 'branch/v10' into zmb3/v10-docs-pin-source-ip
zmb3 Jun 29, 2022
d9e660c
Merge branch 'branch/v10' into zmb3/v10-docs-pin-source-ip
zmb3 Jul 1, 2022
5ffae0a
Merge branch 'branch/v10' into zmb3/v10-docs-pin-source-ip
zmb3 Jul 1, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/pages/access-controls/reference.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,8 +213,8 @@ RBAC lets teams limit what resources are available to Teleport users. This can b
you don't want regular users editing SSO (`auth_connector`) or creating and editing new roles
(`role`).

Below is an example `allow` section that illustrates commonly used `rules`.
Each rule includes a list of Teleport resources and the CRUD
Below is an example `allow` section that illustrates commonly used `rules`.
Each rule includes a list of Teleport resources and the CRUD
operations that a user is allowed to execute on them:

```yaml
Expand Down Expand Up @@ -347,5 +347,5 @@ Here is an explanation of the fields used in the `where` and `filter` conditions
| `ssh_session.participants` | The list of participants from an SSH session |
| `user.metadata.name` | The user's name |

Check out our [predicate language](../setup/reference/predicate-language.mdx#scoping-allowdeny-rules-in-role-resources)
Check out our [predicate language](../setup/reference/predicate-language.mdx#scoping-allowdeny-rules-in-role-resources)
guide for a more in depth explanation of the language.
4 changes: 4 additions & 0 deletions docs/pages/includes/role-spec.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,10 @@ spec:
# if unspecified. If one or more of the user's roles has disabled
# the clipboard, then it will be disabled.
desktop_clipboard: true
# When enabled, the source IP that was used to log in is embedded in the SSH
# certificate, preventing a compromised certificate from being used on other
# devices. The default is false.
pin_source_ip: true
# Specify a list of names and associated values to be included in user SSH keys.
# The key type can only be "ssh" and the mode can only be "extension".
# The name and value fields can be arbitrary strings and the value field
Expand Down