Session Access Controls

[russjones]

Problem

At the moment we use a mix of services.KindSession and services.KindEvent used to control access to active and recorded sessions. We need to differentiate between active and recorded sessions internally as well as only expose services.KindSession to users to control access to recorded sessions.

In addition right now the client we use to access a remote cluster (and fetch sessions) takes the role of the proxy not of the user making the request. We need the client use the role of the logged in user so we can only see recorded sessions if their role has access to them.

Proposed Solution

Split rules into three rules:

• services.KindSSHSession this controls active sessions. This should be hidden from user roles because this is only used by proxies and nodes.
• services.KindSession this controls recorded sessions. This should be exposed to users and used to gate access to endpoints from the audit log where we fetch session playback related events.
• services.KindEvent which is used to access the full audit log and emit events to the audit log.

In addition, update the remote tunnel server to return a net.Conn for the remote auth server so we can build a SSH connection with the appropriate authMethods in the web/proxy server.