Expose --compat certificate flag to Web users

[kontsevoy]

Problem

Older versions of OpenSSH have a bug which prevents them from consuming SSH certificates that contain metadata. For this purpose, tsh login uses --compat flag to issue certificates that trade functionality (cross-cluster trust) for compatibility with older sshd.

But when a Web UI user logs in, there's no equivalent to --compat option. This leads to web users not having access to legacy sshd hosts.

Solution

TBD [by @klizhentas ] But one challenge I see is that it would be nice to make this work for open source users too, i.e. adding a role-hosted flag is not ideal.

[russjones]

We can extend the functionality we currently have in the --compatibility flag by adding compatibility to options in the role.

kind: role
version: v3
metadata:
  name: admin
spec:
  ...
  options:
    compatibility: ["oldssh"|"off"]

By default roles would have compatibility: off unless compatibility: oldssh is explicitly specified in the role. This would work well with both Teleport and Enterprise because by default they would have new style certificates.

The Web UI would always use the compatibility value in the role, but with tsh if --compatibility is set, we would override whatever value is in the role with what is passed in giving the user more control over how the certificate is generated.

This would be backward compatible for existing users but also allow users to update how the Web UI requests certificates.

@kontsevoy @klizhentas What do you think?

[klizhentas]

this looks good to me

[kontsevoy]

How about:

options:
   cert_format: ["compat" | "standard"]  

This way in the docs I can say cert_format: compat is equivalent to tsh login --compat. Same words, learn two bits at once.

[russjones]

Talked about this with @kontsevoy offline, we'll change "compat" to "oldssh" so we can support multiple compatibility modes in the future.

options:
   cert_format: ["oldssh" | "standard"]  

tsh will similarly support --cert-format=["oldssh" | "standard"] as the new supported way to pick the certificate format, but will continue to support --compat=oldssh as a hidden option for backward compatibility.