0:26 Introduction to GitHub Authentication with Teleport SSO

0:26 Hello, and welcome back to the complete guide to Teleport. Today is a short tutorial on how you can take a existing Teleport cluster, which you've already seen many times now throughout this course, how to configure and get started. And we're going to, through the use of some YAML and the GitHub application, enable single sign on that works against teams and organizations on GitHub. So most likely where your developers already are or your operators, etcetera. Now, before we get started, I will say this was supposed to be the the first tutorial that was going to livestream to YouTube

1:10 where we are now, but also to Twitter and to LinkedIn and to somewhere else. But I made a boo boo. I accidentally hit start stream and end stream, which now means I can no longer send it to those other destinations. So we're gonna make YouTube. So if you're watching, thank you for joining. We're gonna get started right away. So we have a screen share here. Hopefully, this is still the same machine. It is indeed. What we have here is an Ubuntu box with Teleport already pre configured, web DNS enabled. Again, these have been covered in prior videos,

1:43 Prerequisites & Existing Teleport Setup

2:03 so we're not going to be doing that today. What we do have Where's my public IPv4 address? I'm being really silly. Alright. I'll just get it from here. This is my public IPv4 address. And we have a browser here where I have the documentation on setting up single sign on with GitHub, the IP address, which we actually don't need because I have this configured as Teleport.Rawkode.live. Now I haven't created a single user on this via the Teleport control command. So this is a working Teleport instance, but there are no users. I literally could not log into this if I

2:53 wanted to. So we're gonna work through the process, which is documented here for setting this up. Now the first thing the documentation wants you to do is is just to confirm some versions. We definitely could run this, but I I know that we run the latest version of Teleport nine, so I'm not gonna run the same commands again just now. We can run t control status, although I actually don't have my local machine configured with this Teleport cluster. So I'm not going to run that, but we could run it inside the cluster. And we can see there.

3:25 Perfect. Okay. So in order for this to work, we have to be able to create a GitHub authentication and what this let me make that a little bit bigger for you. Go. What this is telling us here is that we need a DNS name configured because GitHub is gonna redirect the traffic on the OAuth dance back to our Teleport server. I guess you could do this with just IP addresses, but doing this is a lot nicer. And we need the path postfix that we've got onto the end. So we need to create an OAuth application.

4:01 Creating the GitHub OAuth Application

4:01 This link goes to the documentation. I'm going to bypass that, copy this and just go straight to github.com where we have the Rawkode Academy GitHub. From here, we can go to settings. And if we scroll down and go to GitHub applications, Maybe I need my I'm trying to do this myself rather than as an organization. Oh, there we go. New OAuth application and we will call this Teleport Tutorial. And then let's just say Rawkode.live. Now the operation callback is this thing, but we need to swap out our proxy address for teleport.rockode.live. So if we zoom in on that, you'll

4:53 see our authorization callback is just our domain with the postfix. We can register this application and we're gonna get some secret details, which I can't remember are visually visible. Oh, okay. Cool. So we can copy this client ID and then generate a new secret when required. But we're gonna go back to the Teleport documentation first, and we're gonna start specking out this YAML. So everything in Teleport can be configured through t control apply and a YAML link interface. So I'll do this in the ATC directory because we actually already have our teleport.YAML here. So what I found works rather well is just

5:18 Configuring the Teleport GitHub Connector (YAML)

5:39 to do a teleport.GitHub.YAML, gif, gif hub. Yes. I am live now. I hope. Yeah. I'm live. Can't make it through. I should be. So teleport.gif.yaml. We will drop in all this YAML and we come up to the top. Now we can just remove the comments. Those are far from important just now. We can see here we need our client ID and client secrets. We'll come back to that. Displays us as GitHub. We add our redirect URL here. This is Teleport.Rawkode. Yeah. I'm live. Yeah. Thanks, Russell. I guess this this is the first tutorial that I've done live. Normally, I just prerecorded.

6:33 I decided to try and livestream this one today. So if you prefer the prerecorded, just let me know. I won't do it again. So organization is I'm going to allow the Rawkode Academy organization to log in to the best Teleport cluster. And then we can specify the teams or the team. And I'm going to say the team will be a tutorial. So I'll create a new team that gives me access to this when we're ready. And then we can decide what access we want to give to this. Now, of course we could do editor, audit,

7:14 etcetera. However, I'm just going to do access for now and remove that comment. So this is pretty close. So let's swap out these missing values. So let's grab our client ID from our newly created GitHub authentication app And we'll generate a secret, which I'll delete ASAP. We'll use it for today. Copy. There's no point in trying to hide this because I need to paste into them. Like so. So I think, don't wanna get too confident, but I think this is enough. So we save this file. You can cat it just so you can see that there's nothing changed. It's exactly what

8:07 as we did. And then we can do a t control apply dash f GitHub. Does it not apply? I'm not being silly. Create. Apply with b kip control. Like so. And now it's telling us that our authentication connected GitHub has been created. What this means is that if we come to this page and we refresh, that we will no longer be presented with the manual slash custom login screen like so. Now, of course, we can if we had local users, but we don't, so we get rid of it. And now we click the help button. Now I'm going to try and

8:08 Applying Configuration & Initial Login Attempt

8:52 log in with this. It's going to fail. I hope it's going to fail, but it should fail because I added as part of the configuration that our team has to be tutorial to get access to the cluster. So if I do this, this team doesn't exist yet. We haven't created it. But you'll see that my Teleport tutorial application by Rawkode Academy, I have lots of different organizations, but we'll skip past that. And we get unable to process callback. Is that the error message I'm expecting? Not sure, but we're gonna find out. I think that Teleport Rawkode is alive. I'm

8:54 Troubleshooting & Fixing the GitHub Team Requirement

9:36 gonna double check. There's config. Teleport Rawkode. Yeah. I think it's okay. And I didn't mess that up in here. Teleport.org. Yeah. I think we're good. I think that is just a weird error message for the team problem, but we're gonna fix that now. So we'll come back to those Rawkode Academy settings. We'll try no. We don't want team discussions. We want teams. Go to my profile, teams, new team, and we'll call this one tutorial and click create. Now I'm already a member of this because I am the owner of the organization. So let's try. Hopefully,

10:15 Successful Web UI Login via GitHub

10:21 again. Wonderful. And now we have access to Teleport. So now we can connect to the nodes. Oh, I haven't given myself user access, but that's okay. We can modify the GitHub configuration to support that there. Wonderful. So I do see that we have a question from Ali. Hello. Long one. First time I look the Teleport and it seems amazing. It is. However, I was wondering what is the difference between Hashicorp Vault and Teleport? Are there any pros and cons? Yeah. That's a good question. So Teleport cannot really be compared to HashiCorp Vault. Vault is a KMS system. It stores secrets,

10:44 Q&A: Vault vs. Teleport Comparison

11:17 encryption keys, and valuable information, which can be exposed to one or many users or groups depending on the level of access they have to the vault based on paths and prefixes. So you could probably actually use vault along with Teleport. However, you can compare Teleport to HashiCorp's boundary. Now, boundary is far from feature parity with what we get from Teleport. So really, I'm just gonna see Teleport is probably lead Teleport is leading here. And I would encourage everybody to really go down this path. With access to Linux systems, to databases, to Kubernetes, to applications, and even desktop, Windows desktop,

12:06 for example, which we did a video on recently with Ben from that team, from the Teleport team. So Teleport, it just went us hands down. Although there are a similar products out there, but we like Teleport. It's great. All right. Let's fix some stuff. If we come in here, We don't need to worry about this. I'm just curious about the spec for the users. Computer is being weird. Alright. Let's just find that. So one of my favorite pages in the documentation, if I can remember where it is. The architecture. Let's see. Reference. Oh, there's more references and then dot.

12:25 Granting SSH User Access by Modifying Teleport Role

13:28 Reference. And then we have the config fail. Does this include GitHub? Alright. Let's see. That's taking me back. Alright. Let's take a look at one I already use. I forgot I didn't remove all the SSH keys from the organization, but that's alright. We can take a look at the clustered setup because we already did this here. So if we come into clustered and take a look at the cluster automation and inside this, we have a whole bunch of cloud edit scripts and a whole bunch of main setup, Teleport. And if we take a look at

14:38 Nope, not Teleport install. I don't think it's the agent actually either. Not yet. Oh, maybe? No. Teleport server. There you go. I wrote these scripts. Okay. So what we do here is you see logins Rawkode. So we're using the access role. So we could modify that. That's a good point, actually. Or we could create a new role. Let's create a new role. Let's do it in a proper way. So what I'm gonna do here is copy this rule template and we'll just do this. I think we can get away with just doing this all in the water.

15:36 We use three lanes as a separator, and I'm gonna have to swap out some stuff that I normally interpret and manually manually automatically. And we'll create this rule here. So this is a very inclusive rule. This is my super special rule when I am filming clustered. And we actually did a Teleport Rback deep dive session, which you can find at Rawkode.live if you just search for Teleport Rback. But here, we're saying, okay, we have a team, and I'm gonna call this team Rawkode. And this is the bit that was missing from just using the straight access rule is

16:11 that we have to tell it which logins we have access to. So by default with the access role, it becomes a service. You'll see that when I click connect, I get my own username. That just means that that username actually needs to exist on the host or the login will fail. And in fact, I think the error message is user unknown. So here, if we just say that actually this person can access or communicate using the root user, which is what we wanna use here. Of course, there are pros and cons to this. As far as node labels go, I'm gonna go

16:46 with wonderful star star for today. It should be here. And I'm not fussed about app labels. We don't have any applications exposed at the moment. Okay. This is my super role, which I don't think we are going to need right now. So we can just remove this. But this is just very explicit and allowing me to actually manage the Teleport cluster. This is a modified editor role. So there's a lot of permissions here, but we don't need that for today's session. Bigger than I remember. There we go. Really, I should have been using some VEM key vagrants here. Key

17:33 the. Okay. So now we're gonna get myself the Rawkode role. So this role should be able see any machine and log in as rich. Let's try that again. Teleport.get up. Seems nicer. Okay. Let's do a refresh. Now do I need to log out and then perhaps, so let's sign out, refresh my credentials. And now we have access to root and now we are on our machine. Simple. So thanks for tuning in. That is our GitHub authentication web Teleport video. We got Ali says, thanks for the explanation. No problem. That's why I like doing these things live

18:27 so we can get some questions and hopefully make your life a little bit easier. All right. We've got another big question. Will it fit in the screen? Yeah, I'll get there. I also started testing Teleport as our access management solution. I'm wondering how others handle joining all scaling group instances when scaling happens or EKS node groups. For EKS, you can deploy remove that off my face. For EKS, you could deploy Teleport inside of your Kubernetes cluster using some privileged access to get anything that you need onto the host is one way. With the auto scaling grip, you're gonna wanna use

18:34 Q&A: Auto-scaling, Machine ID & Other Features

19:04 custom launch configuration, which may configure Teleport to which will mean the machines when they spin up automatically add the things that you need for Teleport for that to work. I'll link to one thing really quickly before I go off there, which is machine ID. So this is a really new feature. Go. This is a really new feature with Teleport nine. We actually did a session on this with Ben as well. So there's like that. Teleport nine. Yeah, go to this Q and A with Ben Adams from the Teleport team. We actually do a demo and talk about machine

19:50 ID in much more detail, but machine ID will allow you to use cloud, KMS, etcetera, to kind of broker that initial connection and a machine configuration also works with CICD. So it's worth looking at and playing with an experiment with. Okay. A question from Russell. Assume on the screen, I assume that all the other features of Teleport are available when using GitHub authentication, I e, simply access via approvals. Yeah. So the OAuth Dance just gets you mapped to a Teleport role and then all the other features will function as normal. So any of those cool features like privilege

20:33 elevation, etcetera, all just work. Alright. Well, thanks for your time today. We've got another three videos left in this Teleport course coming within the next two weeks. All juggles around KubeCon, but I'm excited. And we'll get you more because let's face it, right? We've already seen in the six months that I've been working on this course that Teleport have shipped three major versions. So when Teleport ten ships, I'll be sure to update this course and keep the content coming. So if you like these videos, thumb it up, share it with your friends and colleagues, and

20:41 Conclusion & Wrap-up

21:10 remember to subscribe to the channel. And I'll see you all soon. Thanks for your time. Bye.