Skip to main content
Version: 19.x (unreleased)

Application Resources

Report an Issue

A role of version v9 denies every HTTP request to an application it grants, unless a rule under spec.allow.app_resources or spec.allow.app_resources_expressions authorizes the request. Earlier role versions authorize an application as a whole, so a user who reaches the application can send any request to it. Role v9 does not affect TCP, MCP, cloud (AWS console, Azure, and GCP), LLM, or Identity Center applications.

Rules​

The app_resources field is valid only under allow, and any matching rule allows the request. A rule sets paths, a list of path patterns, optionally narrowed by methods and where, or allow_all: true, which stands alone and authorizes every request.

The role below authorizes every request to the applications it grants:

kind: role
version: v9
metadata:
  name: gitlab-dev
spec:
  allow:
    app_labels:
      vendor: [gitlab]
    app_resources:
      - allow_all: true

Teleport removes the following headers from a request a rule allows, because they can bypass the rule:

  • X-HTTP-Method
  • X-HTTP-Method-Override
  • X-Method-Override
  • X-Original-URI
  • X-Original-URL
  • X-Rewrite-URL

Teleport keeps these headers on a request that an allow_all rule allows, because that rule matches every method and path. An app's rewrite.headers configuration is applied after the removal, so a rewrite of one of these names reaches the app.

The app_resources_expressions field is a list of string predicates. Every app_resources rule can be written as an app_resources_expressions predicate, but not the reverse.

When a v9 role and a v8 or older role both grant the same application, Teleport drops the older roles from the decision, so they cannot restore unrestricted access to an application a v9 role restricts.

Agent version requirements​

Upgrade all Application Service agents to Teleport 19 before using role v9. An agent on Teleport 18 or earlier cannot evaluate app_resources, so the Auth Service serves it a downgraded v8 copy of each v9 role. For a role with an allow_all rule the copy grants the same access as v9. For any other role the copy moves the allow app_labels and app_labels_expression to the deny side, so the older agent denies those applications instead of granting them. A role does not record which application types it grants, so a downgraded role also denies the TCP, MCP, and cloud applications it selects, and can deny more applications than the v9 role restricts.