Teleport Access Requests

kind: role
version: v5
metadata:
  name: contractor
spec:
  allow:
    request:
      roles: ['dba']
    # ...
  deny:
    # ...
  options:
    # ...

kind: role
version: v5
metadata:
  name: dba
spec:
  allow:
    # ...
  deny:
    # ...
  options:
    # ...
    # Only allows the contractor to use this role for 1 hour from time of request.
    max_session_ttl: 1h

kind: role
version: v5
metadata:
  name: admin
spec:
  allow:
    # `review_requests` permits the listed roles to be approved
    review_requests:
      roles:
      - 'dba'
    rules:
    # `access_request` is part of Access Workflows introduced in 4.2
    # `access_request` should only be given to Teleport Admins.
    # For a full list of allow-rules, see
    # https://goteleport.com/docs/access-controls/reference/
    - resources:
      - access_request
      verbs:
      - list
      - read
      - update
      - delete
  deny:
    # ...
  options:
    # ...

# Example role that explicitly denies a contractor from requesting the admin
# role.
kind: role
version: v5
metadata:
name: contractor
spec:
options:
    # ...
allow:
    # ...
deny:
    request:
    roles: ['admin']

kind: role
metadata:
  name: employee
spec:
  allow:
    request:
      # the `roles` list can now be a mixture of literals and wildcard matchers
      roles: ['common', 'dev-*']
      # the `claims_to_roles` mapping works the same as it does in
      # the OIDC connector, with the added benefit that the roles being mapped to
      # can also be matchers. the below mapping says that users with
      # the claims `groups: admins` can request any role in the system.
      claims_to_roles:
        - claim: groups
          value: admins
          roles: ['*']
      # Teleport can attach annotations to pending access requests. these
      # annotations may be literals, or be variable interpolation expressions,
      # effectively creating a means for propagating selected claims from an
      # external identity provider to the plugin system.
      annotations:
        foo: ['bar']
        groups: ['{{external.groups}}']
  options:
    # the `request_access` field can be set to 'always' or 'reason' to tell
    # tsh or the web UI to always create an access request on login. If it is
    # set to 'reason', the user will be required to indicate *why* they are
    # generating the access request.
    request_access: reason
    # the `request_prompt` field can be used to tell the user what should
    # be supplied in the request reason field.
    request_prompt: Please provide your ticket ID
version: v3