Skip to content

Add proxy and user_agent labels to user login counter metric #60239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add proxy and user_agent labels to user login counter metric #60239

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bb66d5c
Added user login counter metrics labels with proxy information and us…
vapopov Oct 14, 2025
3cc147e
Fixed defining default user-agent when `extraHeaders` map was nil
vapopov Oct 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ require (
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
github.com/grafana/pyroscope-go v1.2.7
github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1
github.com/gravitational/roundtrip v1.0.2
github.com/gravitational/roundtrip v1.0.3
github.com/gravitational/teleport/api v0.0.0
github.com/gravitational/trace v1.5.1
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1528,8 +1528,8 @@ github.com/gravitational/protobuf v1.3.2-teleport.2 h1:MO5eFXfGfDiAbBA7X8tDW2EML
github.com/gravitational/protobuf v1.3.2-teleport.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
github.com/gravitational/redis/v9 v9.6.1-teleport.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA=
github.com/gravitational/roundtrip v1.0.2 h1:eOCY0NEKKaB0ksJmvhO6lPMFz1pIIef+vyPBTBROQ5c=
github.com/gravitational/roundtrip v1.0.2/go.mod h1:fuI1booM2hLRA/B/m5MRAPOU6mBZNYcNycono2UuTw0=
github.com/gravitational/roundtrip v1.0.3 h1:n5JLvJVs8XrnJxXGYOzb8I9zGMEr5WVhSA1qGuxzwnU=
github.com/gravitational/roundtrip v1.0.3/go.mod h1:AR9OSmv3WN0qJObMyMYJUrPRXtzhdjAQSKIACv7F9b4=
github.com/gravitational/saml v0.4.15-teleport.2 h1:ruNtaIkDrCJ5eS+OBcKeER+P5ldDDys7SeCoyFJAX1o=
github.com/gravitational/saml v0.4.15-teleport.2/go.mod h1:wGckhUH/I+hcDR2uo9WC4GyL+o4rid5JUe1Ze/joarI=
github.com/gravitational/selinux v1.13.0-teleport h1:XZQpZK5tteK9ZV2wIC1avhagqoVghXYv+O21GOpG6wU=
Expand Down
2 changes: 1 addition & 1 deletion integrations/event-handler/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -218,7 +218,7 @@ require (
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/gosuri/uitable v0.0.4 // indirect
github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 // indirect
github.com/gravitational/roundtrip v1.0.2 // indirect
github.com/gravitational/roundtrip v1.0.3 // indirect
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see a tag for this but not a GH release. Do you plan on creating a new release?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right, I will draft release for this version

github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
Expand Down
4 changes: 2 additions & 2 deletions integrations/event-handler/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1316,8 +1316,8 @@ github.com/gravitational/protobuf v1.3.2-teleport.2 h1:MO5eFXfGfDiAbBA7X8tDW2EML
github.com/gravitational/protobuf v1.3.2-teleport.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
github.com/gravitational/redis/v9 v9.6.1-teleport.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA=
github.com/gravitational/roundtrip v1.0.2 h1:eOCY0NEKKaB0ksJmvhO6lPMFz1pIIef+vyPBTBROQ5c=
github.com/gravitational/roundtrip v1.0.2/go.mod h1:fuI1booM2hLRA/B/m5MRAPOU6mBZNYcNycono2UuTw0=
github.com/gravitational/roundtrip v1.0.3 h1:n5JLvJVs8XrnJxXGYOzb8I9zGMEr5WVhSA1qGuxzwnU=
github.com/gravitational/roundtrip v1.0.3/go.mod h1:AR9OSmv3WN0qJObMyMYJUrPRXtzhdjAQSKIACv7F9b4=
github.com/gravitational/saml v0.4.15-teleport.2 h1:ruNtaIkDrCJ5eS+OBcKeER+P5ldDDys7SeCoyFJAX1o=
github.com/gravitational/saml v0.4.15-teleport.2/go.mod h1:wGckhUH/I+hcDR2uo9WC4GyL+o4rid5JUe1Ze/joarI=
github.com/gravitational/trace v1.5.1 h1:CdSymAjkE1VOef+lsC5x29jX9WbgI0fBtnRqeT4Fh+c=
Expand Down
2 changes: 1 addition & 1 deletion integrations/terraform-mwi/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,7 +262,7 @@ require (
github.com/grafana/pyroscope-go v1.2.7 // indirect
github.com/grafana/pyroscope-go/godeltaprof v0.1.9 // indirect
github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 // indirect
github.com/gravitational/roundtrip v1.0.2 // indirect
github.com/gravitational/roundtrip v1.0.3 // indirect
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
Expand Down
4 changes: 2 additions & 2 deletions integrations/terraform-mwi/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1465,8 +1465,8 @@ github.com/gravitational/protobuf v1.3.2-teleport.2 h1:MO5eFXfGfDiAbBA7X8tDW2EML
github.com/gravitational/protobuf v1.3.2-teleport.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
github.com/gravitational/redis/v9 v9.6.1-teleport.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA=
github.com/gravitational/roundtrip v1.0.2 h1:eOCY0NEKKaB0ksJmvhO6lPMFz1pIIef+vyPBTBROQ5c=
github.com/gravitational/roundtrip v1.0.2/go.mod h1:fuI1booM2hLRA/B/m5MRAPOU6mBZNYcNycono2UuTw0=
github.com/gravitational/roundtrip v1.0.3 h1:n5JLvJVs8XrnJxXGYOzb8I9zGMEr5WVhSA1qGuxzwnU=
github.com/gravitational/roundtrip v1.0.3/go.mod h1:AR9OSmv3WN0qJObMyMYJUrPRXtzhdjAQSKIACv7F9b4=
github.com/gravitational/saml v0.4.15-teleport.2 h1:ruNtaIkDrCJ5eS+OBcKeER+P5ldDDys7SeCoyFJAX1o=
github.com/gravitational/saml v0.4.15-teleport.2/go.mod h1:wGckhUH/I+hcDR2uo9WC4GyL+o4rid5JUe1Ze/joarI=
github.com/gravitational/selinux v1.13.0-teleport h1:XZQpZK5tteK9ZV2wIC1avhagqoVghXYv+O21GOpG6wU=
Expand Down
2 changes: 1 addition & 1 deletion integrations/terraform/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,7 +263,7 @@ require (
github.com/grafana/pyroscope-go v1.2.7 // indirect
github.com/grafana/pyroscope-go/godeltaprof v0.1.9 // indirect
github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 // indirect
github.com/gravitational/roundtrip v1.0.2 // indirect
github.com/gravitational/roundtrip v1.0.3 // indirect
github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0 // indirect
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
Expand Down
4 changes: 2 additions & 2 deletions integrations/terraform/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1498,8 +1498,8 @@ github.com/gravitational/protobuf v1.3.2-teleport.2 h1:MO5eFXfGfDiAbBA7X8tDW2EML
github.com/gravitational/protobuf v1.3.2-teleport.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
github.com/gravitational/redis/v9 v9.6.1-teleport.1 h1:gPirfPKArN2nPhTKR3h9fnEg5YuYU933+CjlDJMo4H0=
github.com/gravitational/redis/v9 v9.6.1-teleport.1/go.mod h1:0C0c6ycQsdpVNQpxb1njEQIqkx5UcsM8FJCQLgE9+RA=
github.com/gravitational/roundtrip v1.0.2 h1:eOCY0NEKKaB0ksJmvhO6lPMFz1pIIef+vyPBTBROQ5c=
github.com/gravitational/roundtrip v1.0.2/go.mod h1:fuI1booM2hLRA/B/m5MRAPOU6mBZNYcNycono2UuTw0=
github.com/gravitational/roundtrip v1.0.3 h1:n5JLvJVs8XrnJxXGYOzb8I9zGMEr5WVhSA1qGuxzwnU=
github.com/gravitational/roundtrip v1.0.3/go.mod h1:AR9OSmv3WN0qJObMyMYJUrPRXtzhdjAQSKIACv7F9b4=
github.com/gravitational/saml v0.4.15-teleport.2 h1:ruNtaIkDrCJ5eS+OBcKeER+P5ldDDys7SeCoyFJAX1o=
github.com/gravitational/saml v0.4.15-teleport.2/go.mod h1:wGckhUH/I+hcDR2uo9WC4GyL+o4rid5JUe1Ze/joarI=
github.com/gravitational/selinux v1.13.0-teleport h1:XZQpZK5tteK9ZV2wIC1avhagqoVghXYv+O21GOpG6wU=
Expand Down
6 changes: 5 additions & 1 deletion lib/auth/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -953,11 +953,15 @@ var (
},
)
// UserLoginCount counts user logins
UserLoginCount = prometheus.NewCounter(
UserLoginCount = prometheus.NewCounterVec(
prometheus.CounterOpts{
Name: teleport.MetricUserLoginCount,
Help: "Number of times there was a user login",
},
[]string{
teleport.TagUserAgent,
teleport.TagProxy,
},
)

heartbeatsMissedByAuth = prometheus.NewGauge(
Expand Down
2 changes: 2 additions & 0 deletions lib/auth/authclient/clt.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1400,6 +1400,8 @@ type ForwardedClientMetadata struct {
// either from a direct client connection, or from a PROXY protocol header
// if the connection is forwarded through a load balancer.
RemoteAddr string `json:"remote_addr,omitempty"`
// ProxyPublicAddr is public address of the proxy service.
ProxyPublicAddr string `json:"proxy_public_addr,omitempty"`
}

// CheckAndSetDefaults checks and sets defaults
Expand Down
16 changes: 14 additions & 2 deletions lib/auth/methods.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ import (
"time"

"github.com/gravitational/trace"
"github.com/prometheus/client_golang/prometheus"

"github.com/gravitational/teleport"
"github.com/gravitational/teleport/api/client/proto"
Expand Down Expand Up @@ -695,19 +696,21 @@ func (a *Server) AuthenticateWebUser(ctx context.Context, req authclient.Authent
return nil, trace.Wrap(err)
}

var loginIP, userAgent string
var loginIP, userAgent, proxyPublicAddr string
if cm := req.ClientMetadata; cm != nil {
loginIP, _, err = net.SplitHostPort(cm.RemoteAddr)
if err != nil {
return nil, trace.Wrap(err)
}
userAgent = cm.UserAgent
proxyPublicAddr = cm.ProxyPublicAddr
}

sess, err := a.CreateWebSessionFromReq(ctx, NewWebSessionRequest{
User: user.GetName(),
LoginIP: loginIP,
LoginUserAgent: userAgent,
LoginProxyPublicAddr: proxyPublicAddr,
Roles: user.GetRoles(),
Traits: user.GetTraits(),
LoginTime: a.clock.Now().UTC(),
Expand Down Expand Up @@ -812,7 +815,16 @@ func (a *Server) AuthenticateSSHUser(ctx context.Context, req authclient.Authent
if err != nil {
return nil, trace.Wrap(err)
}
UserLoginCount.Inc()

var userAgent, proxyPublicAddr string
if req.ClientMetadata != nil {
userAgent = req.ClientMetadata.UserAgent
proxyPublicAddr = req.ClientMetadata.ProxyPublicAddr
}
UserLoginCount.With(prometheus.Labels{
teleport.TagUserAgent: userAgent,
teleport.TagProxy: proxyPublicAddr,
}).Inc()

var clientOptions authclient.ClientOptions
if o, err := a.ClientOptionsForLogin(user); err == nil {
Expand Down
15 changes: 13 additions & 2 deletions lib/auth/sessions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ import (
"time"

"github.com/gravitational/trace"
"github.com/prometheus/client_golang/prometheus"
"golang.org/x/crypto/ssh"

"github.com/gravitational/teleport"
Expand Down Expand Up @@ -58,6 +59,8 @@ type NewWebSessionRequest struct {
// LoginUserAgent is the user agent of the client's browser, as captured by
// the Proxy.
LoginUserAgent string
// LoginProxyPublicAddr is the proxy public address where request is generated.
LoginProxyPublicAddr string
// Roles optionally lists additional user roles
Roles []string
// Traits optionally lists role traits
Expand Down Expand Up @@ -344,7 +347,11 @@ func (a *Server) newWebSession(
IdleTimeout: types.Duration(idleTimeout),
HasDeviceExtensions: hasDeviceExtensions,
}
UserLoginCount.Inc()

UserLoginCount.With(prometheus.Labels{
teleport.TagUserAgent: "web/" + teleport.Version,
teleport.TagProxy: req.LoginProxyPublicAddr,
}).Inc()

sess, err := types.NewWebSession(token, types.KindWebSession, sessionSpec)
if err != nil {
Expand Down Expand Up @@ -609,7 +616,11 @@ func (a *Server) CreateAppSessionFromReq(ctx context.Context, req NewAppSessionR
return nil, trace.Wrap(err)
}
a.logger.DebugContext(ctx, "Generated application web session", "user", req.User, "ttl", req.SessionTTL)
UserLoginCount.Inc()

UserLoginCount.With(prometheus.Labels{
teleport.TagUserAgent: "web/" + teleport.Version,
teleport.TagProxy: req.LoginProxyPublicAddr,
}).Inc()

// Do not send app session start for MCP. They have their own events on
// connections.
Expand Down
11 changes: 11 additions & 0 deletions lib/client/weblogin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -448,6 +448,12 @@ type TOTPRegisterChallenge struct {
// initClient creates a new client to the HTTPS web proxy.
func initClient(proxyAddr string, insecure bool, pool *x509.CertPool, extraHeaders map[string]string, opts ...roundtrip.ClientParam) (*WebClient, *url.URL, error) {
log := slog.With(teleport.ComponentKey, teleport.ComponentClient)
if _, ok := extraHeaders["User-Agent"]; !ok {
if extraHeaders == nil {
extraHeaders = make(map[string]string)
}
extraHeaders["User-Agent"] = "api/" + teleport.Version
}
log.DebugContext(context.Background(), "Initializing proxy HTTPS client",
"proxy_addr", proxyAddr,
"insecure", insecure,
Expand Down Expand Up @@ -478,9 +484,14 @@ func initClient(proxyAddr string, insecure bool, pool *x509.CertPool, extraHeade
return nil, nil, trace.Wrap(err)
}

header := make(http.Header)
for k, v := range extraHeaders {
header.Set(k, v)
}
opts = append(opts,
roundtrip.HTTPClient(newClient(insecure, pool, extraHeaders)),
roundtrip.CookieJar(jar),
roundtrip.WithHeader(header),
)
clt, err := NewWebClient(proxyAddr, opts...)
if err != nil {
Expand Down
9 changes: 8 additions & 1 deletion lib/web/apiserver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2707,6 +2707,7 @@ func (h *Handler) createWebSession(w http.ResponseWriter, r *http.Request, p htt
}

clientMeta := clientMetaFromReq(r)
clientMeta.ProxyPublicAddr = h.cfg.PublicProxyAddr

var webSession types.WebSession
switch {
Expand Down Expand Up @@ -3092,6 +3093,8 @@ func (h *Handler) mfaLoginFinish(w http.ResponseWriter, r *http.Request, p httpr
}

clientMeta := clientMetaFromReq(r)
clientMeta.ProxyPublicAddr = h.cfg.PublicProxyAddr

cert, err := h.auth.AuthenticateSSHUser(r.Context(), *req, clientMeta)
if err != nil {
return nil, trace.Wrap(err)
Expand All @@ -3116,6 +3119,8 @@ func (h *Handler) mfaLoginFinishSession(w http.ResponseWriter, r *http.Request,
}

clientMeta := clientMetaFromReq(r)
clientMeta.ProxyPublicAddr = h.cfg.PublicProxyAddr

session, err := h.auth.AuthenticateWebUser(r.Context(), req, clientMeta)
switch {
// Since checking for private key policy meant that they passed authn,
Expand Down Expand Up @@ -4560,13 +4565,15 @@ func (h *Handler) headlessLogin(w http.ResponseWriter, r *http.Request, p httpro
}

authClient := h.cfg.ProxyClient
clientMeta := clientMetaFromReq(r)
clientMeta.ProxyPublicAddr = h.cfg.PublicProxyAddr

authSSHUserReq := authclient.AuthenticateSSHRequest{
AuthenticateUserRequest: authclient.AuthenticateUserRequest{
Username: req.User,
SSHPublicKey: req.SSHPubKey,
TLSPublicKey: req.TLSPubKey,
ClientMetadata: clientMetaFromReq(r),
ClientMetadata: clientMeta,
HeadlessAuthenticationID: req.HeadlessAuthenticationID,
},
CompatibilityMode: req.Compatibility,
Expand Down
6 changes: 6 additions & 0 deletions metrics.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,6 +316,12 @@ const (
// TagVersion is a prometheus label for version of Teleport built
TagVersion = "version"

// TagUserAgent is a prometheus laber for identifying user agent of Teleport client.
TagUserAgent = "user_agent"

// TagProxy is a prometheus label for identifying the proxy host
TagProxy = "proxy"

// TagOS is a prometheus label for indicating the Operating System
// where agent is running (e.g. Darwin, Linux).
TagOS = "os"
Expand Down
Loading