Set up a Teleport connector

Capabilities

The Teleport connector supports automatic account provisioning.

Due to Teleport’s security rules, it is not possible to auto-generate and assign passwords to newly created accounts. When a new Teleport account is created by ConductorOne, a password reset link (associated with a token) will be sent to a vault. This allows the user to configure the password for their new account.

Gather Teleport credentials

Configuring the connector requires you to pass in credentials generated in Teleport. Gather these credentials before you move on.

Generate an identity file

Follow this process to set up a local Teleport instance and generate an auth.pem identity file. You can follow other procedures to generate the auth.pem file: see the baton-teleport README for instructions.

1. Install Teleport: curl https://goteleport.com/static/install.sh | bash -s 15.1.4

2. Add a Teleport .yaml file. Replace <email_account> and <cluster_name> with your cluster credentials and add the port number (:443) to your cluster name.

   sudo teleport configure -o file \
   --acme --acme-email=<email_account> \
   --cluster-name=<cluster_name>
   

3. Log your Teleport cluster:

   tsh login --proxy=<cluster_name> --user=<email_account>
   TELEPORT_CONFIG_FILE="" tctl status
   

4. Start Teleport, using the .yaml file: sudo teleport start --config="/etc/teleport.yaml"

5. Generate an invitation token with roles for the host. The invitation token is required for the local computer to join the cluster.

   TELEPORT_CONFIG_FILE="" tctl tokens add --type=user,role,node,app,db
   

   You’ll receive an output that looks like this:

   teleport start \
   --roles=node \
   `--token=dd5f637d11e94c3fb2ed3516b9482e74` \
   `--ca-pin=sha256:5fc6849caaf45eb70fb564224b727dbce31a32f2a8329910fcebc84aaaee7160` \
   --auth-server=baton-conductorone.teleport.sh:443
   

6. Open the Teleport configuration file /etc/teleport.yaml in an editor on the computer where you installed the Teleport agent and replace token and ca-pin with the values from the invitation token.

7. Stop and restart Teleport: sudo teleport start --config="/etc/teleport.yaml"

8. Finally, generate an auth.pem identity file using the tctl admin tool:

   TELEPORT_CONFIG_FILE="" tctl auth sign --ttl=8h --user=<email_account> --out=auth.pem
   

9. Save the auth.pem file and make a note of the file path.

That’s it! Next, move on to the connector configuration instructions.

Configure the Teleport connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in ConductorOne

# baton-teleport-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-teleport-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>
  
  # Teleport credentials
  BATON_TELEPORT_KEY_PATH: <Path to the auth.pm Teleport file>
  BATON_TELEPORT_PROXY_ADDRESS: <Fully qualified address of your Teleport proxy service>

  # Optional: include if you want ConductorOne to provision access using this connector
  BATON_PROVISIONING: true

# baton-teleport.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-teleport
  labels:
    app: baton-teleport
spec:
  selector:
    matchLabels:
      app: baton-teleport
  template:
    metadata:
      labels:
        app: baton-teleport
        baton: true
        baton-app: teleport
    spec:
      containers:
      - name: baton-teleport
        image: ghcr.io/conductorone/baton-teleport:latest
        imagePullPolicy: IfNotPresent
        envFrom:
        - secretRef:
            name: baton-teleport-secrets