teleport-plugin-slack-access-request

📝 Table of Contents

What is this?
Why Use This Plugin?
Installation with ArgoCD
How to use
How to Contribute
Directory Structure
License
Acknowledgements
Reference

What is This?

teleport-plugin-slack-access-request is
Go-based Teleport plugin server developed by teletwoboy.

It provides convenient Slack-based features
integrated with the open-source version of Teleport.

Find us also at Dockerhub

Why Use This Plugin?

We have two powerful features.

/access-request
- Neither the requester nor the reviewer needs to log in to the Teleport Web UI.
  They only need to be connected to Slack.
- All request and review records are stored in the plugin server's database, Slack messages, and Teleport Server, making it easy to track and audit the history.
- Only users in the Slack channel mapped to the requested role can review the request. This enables clear management of reviewers for each role.
/access-policy : ABAC-based Access Request Auto-Review Policy
- Reviewers can create auto-review policies for requests that do not require manual review every time.
- Policies can be configured based on specific channels, roles, users, time windows, and whether to automatically approve or deny the request.

Installation with ArgoCD

teletwoboy aims for GitOps-based infrastructure management.

Prerequisites Before Installation

Kubernetes
ArgoCD
Teleport OpenSource Cluster and Teleport Operator in k8s
Permission to create Teleport roles, users, tbot
Permission to create Slack App, Channel etc
Two Slack users (If testing alone, you will act as both the Requester and the Reviewer)
A domain name for the slack-plugin server

1️⃣ Setting up Teleport Tbot

Define the role that the Teleport Bot will impersonate

apiVersion: resources.teleport.dev/v1
kind: TeleportRoleV7
metadata:
  name: access-plugin
  namespace: teleport
spec:
  allow:
    rules:
      - resources:
          - access_request
        verbs:
          - list
          - read
          - update
          - submit
          - create
      - resources:
          - access_plugin_data
        verbs:
          - update
      - resources:
          - user
        verbs:
          - read
          - list
      - resources:
          - role
        verbs:
          - read
          - list
      - resources:
          - event
        verbs:
          - list
          - read
      - resources:
          - user_login_state
        verbs:
          - list
          - read
          - delete

These rules define the minimum required permissions for the Tbot

Create Tbot via CLI

kubectl exec -it -n teleport deploy/teleport-auth -- \
  tctl bots add access-plugin --roles=access-plugin

Copy the bot token value

Deploy Tbot Server

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: teleport-tbot
  namespace: argocd
spec:
  project: <Project Name>
  destination:
    server: https://kubernetes.default.svc
    namespace: <Namespace to deploy>
  source:
    repoURL: https://charts.releases.teleport.dev
    targetRevision: <Same version as the Teleport Cluster server>
    chart: tbot
    helm:
      values: |-
        clusterName: <clusterName used during Teleport Cluster deployment>
        teleportAuthAddress: <Auth Server Service Name>.<Namespace>.svc.cluster.local:3025

        defaultOutput:
          enabled: false

        persistence: "secret"
        joinMethod: "token"
        token: <The bot token>

        outputs:
          - type: identity
            destination:
              type: kubernetes_secret
              name: <Name of the Kubernetes Secret to be created>
            roles:
              - access-plugin

        tbotConfig:
          credential_ttl: "10h"
          renewal_interval: "20m"

Check if the Secret Has Been Created
```
kubectl get secrets -n teleport
kubectl describe secret <created Secret> -n teleport
```
- The identity Data field must be populated for it to be considered valid
- If it doesn't work as expected, please check the tbot pod logs

2️⃣ Creating Teleport User

Define the Role to be obtained through an Access Request

apiVersion: resources.teleport.dev/v1
kind: TeleportRoleV7
metadata:
  name: dev-role
  namespace: teleport
spec:
  allow:
    kubernetes_labels:
      "*": "*"
    kubernetes_groups:
      - "<Role the user will assume in Kubernetes>"
      # This is related to Kubernetes RBAC.
      # Please configure it manually.
  options:
    max_session_ttl: 30m

Define the Role that is allowed to request an Access Request for the target Role

apiVersion: resources.teleport.dev/v1
kind: TeleportRoleV7
metadata:
  name: dev-role-requester
  namespace: teleport
spec:
  allow:
    request:
      roles:
        - dev-role
      reason:
        mode: "optional" or "required"
        # This determines whether providing an Access Request reason is optional or required
  options:
    max_session_ttl: 1h

Define the User who is allowed to request the specified Role

apiVersion: resources.teleport.dev/v2
kind: TeleportUser
metadata:
  name: <requester slack user email username>
  namespace: teleport
spec:
  roles:
    - dev-role-requester
  traits:
    logins:
      - root
      - ubuntu

3️⃣ Setting up Slack App

Add a Slack App
- Go to api.slack.com/apps
- Click the Create New App button
- Select From scratch
- Enter an App Name, select the Workspace, and click Create App
- After creation, you’ll be redirected to the App Information page:
  - Under Basic Information, copy and securely store the Signing Secret
  - In the left sidebar, click OAuth & Permissions, scroll down to the Bot Token Scopes section, and add the following permissions:
    - channels:read
    - chat:write
    - commands
    - groups:read
    - pins:write
    - users.profile:read
    - users:read
    - users:read.email
  - Scroll up and click the Install to <Workspace> button to add the app to your workspace
  - After installation, copy and securely store the Bot User OAuth Token

Add Slash Commands
- In the left sidebar, click Slash Commands, then click the Create New Command button
- Fill in the required fields and click the Save button:
  - Command : The command users will type in Slack chat
    - /access-request
    - /access-policy
  - Request URL : The endpoint that Slack will send requests to when the command is used
    - https://<your-plugin-domain>/api/v1/access-request
    - https://<your-plugin-domain>/api/v1/access-policy
  - Short Description : A brief description of the command

Enable Slack Interactivity
- In the left sidebar, click Interactivity & Shortcuts
- Toggle the switch from Off to On
- In the Request URL field, enter the following and click Save Changes button:
  - https://<your-plugin-domain>/api/v1/interaction

4️⃣ Setting up Slack Channel

Create Slack Channels

1. Plugin server notification channel (used for general alerts)
1. dev-role-requester # Optional, but you must add the app to at least one channel
2. dev-role-reviewers
   # ‼️ Must follow the format: <Role Name + '-reviewers'> ‼️
   # Please make the Reviewers channel private so that the requester cannot access it.

Add your Slack app to each of the above channels
```
/invite @<Your App Name>
```

Add reviewers to the dev-role-reviewers channel
```
/invite @<Reviewer>
```

Copy and store the Channel ID of the plugin server's notification channel
- Select the channel in Slack
- Click the # Channel Name at the top of the message view
- Scroll down and copy the Channel ID

5️⃣ Installing the Plugin Server

Write the application.yaml for ArgoCD

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: teleport-plugin-slack-access-request
  namespace: argocd
spec:
  project: <Project Name>
  destination:
    server: https://kubernetes.default.svc
    namespace: <Namespace to deploy>
  source:
    repoURL: https://github.com/teletwoboy/teleport-plugin-slack-access-request-helm.git
    targetRevision: 0.1.0
    path: .
    helm:
      values: |-
        server:
          port: <Server Container Port>
          secret:
            slackToken: <Copied Bot User OAuth Token>
            slackSigningSecret: <Copied Signing Secret>
            slackDefaultNotifChannelID: <Copied notification channel ID>
            teleportAddress: <Teleport Cluster Server Address>
          
          teleport:
            identity:
              secretName: <Tbot Secret generated by the Tbot Server>

        postgres:
          auth:
            username: <Username to be created>
            password: <Password for the user>
            database: <Database name>

If you want to pass sensitive information via Kubernetes Secrets,
configure ingress settings directly in values.yaml,
or explore other configuration options,
please refer to the Chart's Values.yaml file

Note: Ingress setup is not covered in this guide.

How to use

Access Request

Requester
- type /access-request
- Select Requeted Role and Reviewers Channel
- Select Start Date
- Select Access Duration
- Select Request TTL
- Review the summary, fill in the request reason, and click the Submit button
- Check the request creation message in the channel

Reviewer (in the Reviewers Channel)
- See the Access Request notification and click Review Request button
- Fill in the review reason and select Allow or Deny
- Check the review result message in the channel

Requester
- Check if the request has been reviewed
  1. APPROVED
  2. DENIED

Access Policy

Reviewer in Reviewers Channel
- type /access-policy
- Select the target channel, role, and user
- Choose the start date/time, end date/time, and effect (Allow or Deny)
- Review the summary, write a title and reason, then click Submit button
- Check the created Access Policy Message in the channel
  - The policy is automatically pinned for easier management.

Requester
- Perform the /access-request process as usual
- Check that the request was automatically reviewed
  1. APPROVED
  2. DENIED

Reviewer in Reviewers Channel
- Check the information for the request that was auto-reviewed

How to Contribute

This project was created by university student developers.
If you find any mistakes,
have ideas for new features,
or suggestions for improvements,
we welcome your contributions!

🙏 HOW TO CONTRIBUTE

Directory Structure

.
├── db                # Database schema and migration files
├── cmd               # Application entry points (main executables)
├── internal          # Internal application packages (not for public use)
│   ├── api           # API route handlers and related logic
│   ├── app           # Application startup and lifecycle management
│   ├── config        # Configuration loading and management
│   ├── database      # Database connection and query logic
│   ├── events        # Teleport Event handling and dispatching
│   ├── logging       # Logging utilities and setup
│   ├── policy        # Access policy logic and enforcement
│   ├── seedinit      # Initial data seeding scripts
│   ├── slack         # Slack integration logic
│   ├── teleport      # Teleport integration logic
│   ├── user          # User management and related logic
│   └── util          # Utility/helper functions

License

This project is licensed under the Apache License 2.0.

Acknowledgements

🦫 Go Gopher image by Renee French, licensed under CC BY 3.0.
💜 Teleport and 🟢 Slack logos are trademarks of their respective owners.
This project is an unofficial open-source plugin extending Teleport Community Edition with Slack integration.

Reference

Teleport Github Repository
Teleport Official Website
Slack API methods

🔝 Back to Top

Name		Name	Last commit message	Last commit date
.github		.github
.idea		.idea
THIRDPARTY-LICENSES		THIRDPARTY-LICENSES
cmd		cmd
db		db
internal		internal
.env.example		.env.example
.gitignore		.gitignore
.golangci.yaml		.golangci.yaml
CONTRIBUTING.md		CONTRIBUTING.md
Dockerfile		Dockerfile
LICENSE		LICENSE
NOTICE		NOTICE
README.md		README.md
THIRD_PARTY_NOTICES.md		THIRD_PARTY_NOTICES.md
go.mod		go.mod
go.sum		go.sum
prompt.md		prompt.md
sqlc.yaml		sqlc.yaml
teleport-plugin-slack-access-request		teleport-plugin-slack-access-request

Navigation Menu

Uh oh!

Repository files navigation

teleport-plugin-slack-access-request

📝 Table of Contents

What is This?

Why Use This Plugin?

Installation with ArgoCD

How to use

How to Contribute

🙏 HOW TO CONTRIBUTE

Directory Structure

License

Acknowledgements

Reference

About

Releases

Packages

Contributors

Languages

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

teleport-plugin-slack-access-request

📝 Table of Contents

What is This?

Why Use This Plugin?

Installation with ArgoCD

How to use

How to Contribute

🙏 HOW TO CONTRIBUTE

Directory Structure

License

Acknowledgements

Reference

About

Resources

Contributing

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages