tctl auth sign does not work when executed remotely via proxy

[webvictim]

Description

What happened: When logging into a cluster and then using Enterprise tctl to connect to the auth server remotely via the proxy, it isn't possible to use tctl auth sign even if the user you're logged in as has the admin role.

$ tctl auth sign --format=tls --user=access-plugin-slack --out=auth --ttl=8760h 
error: this request can be only executed by an admin

This makes installing Teleport plugins into Cloud instances impossible. It also makes automation use cases difficult to achieve.

What you expected to happen: If you're logged in as a user which has an admin role, you should be able to do everything you can do when running tctl locally on the auth server.

How to reproduce it (as minimally and precisely as possible): Log into a Teleport Cloud instance as an admin user using tsh, then use Enterprise tctl to try and sign a certificate remotely.

The issue seems to occur here -

teleport/lib/auth/auth_with_roles.go

Lines 1072 to 1073 in 46679fb

	// this error is vague on purpose, it should not happen unless someone is trying something out of loop
	return nil, trace.AccessDenied("this request can be only executed by an admin")

- when executed remotely, it seems that tctl doesn't have the built-in admin role whereas it does when running locally.

The built in admin role is allowed to do anything -

teleport/lib/auth/permissions.go

Line 440 in 46679fb

services.NewRule(services.Wildcard, services.RW()),

- which is why this works in that scenario.

Environment

• Teleport version (use teleport version): Teleport Enterprise v5.1.0 git:v5.1.0-0-g46679fb34 go1.15.5

• tctl version: Teleport Enterprise v5.1.0 git:v5.1.0-0-g46679fb34 go1.15.5

• Where are you running Teleport? (e.g. AWS, GCP, Dedicated Hardware): Teleport Cloud

[klizhentas]

Let's add impersonate section in the role for access controls:

spec: 
   allow:
      impersonate: 
         users: ['*']
         roles: ['*'] 
   deny:
     impersonate: 
         roles: ['admin']

[benarent]

+1, I was helping @Valien with this issue and we are unable to complete Database setup due to this.

$ tctl auth sign --format=db --host=db.example.com --out=server --ttl=8760h
ERROR: this request can only be executed by a database service or an admin

[webvictim]

This shouldn't be in a patch release, it should be in a minor. Patch releases are only for hotfixes.

[benarent]

I've tried this today with a Teleport Cloud instance 6.1.5 and tctl ~ Teleport v6.2.0-beta.1, and I've tried a few things, but I'm unable to use tctl auth sign.

➜  ~ tctl auth sign --format=db --host=db.example.com --out=server --ttl=8760h         
ERROR: this request can only be executed by a database service or an admin

[webvictim]

Reopening for tracking until this is resolved.

[benarent]

@r0mant Create a new ticket for this #6937 , I'll close this one for now.