Teleport: Disabling port forwarding via RBAC doesn't work

[webvictim]

What happened:

Given this role, both agent forwarding and port forwarding should be disabled:

kind: role
metadata:
  id: 1578419329305509600
  name: clusteradmin
spec:
  allow:
    kubernetes_groups:
    - system:masters
    logins:
    - root
    - '{{external.login}}'
    node_labels:
      '*': '*'
    rules:
    - resources:
      - '*'
      verbs:
      - '*'
  deny:
    logins: null
  options:
    cert_format: standard
    forward_agent: false
    max_session_ttl: 12h0m0s
    port_forwarding: false
version: v3

This is not actually the case when logging into the cluster.

> Profile URL:  https://example.gravitational.co:3080
  Logged in as: [email protected]
  Cluster:      gus-main.gravitational.co
  Roles:        clusteradmin*
  Logins:       root
  Valid until:  2020-01-08 01:59:09 -0400 AST [valid for 12h0m0s]
  Extensions:   permit-port-forwarding, permit-pty


* RBAC is only available in Teleport Enterprise
  https://gravitational.com/teleport/docs/enterprise

Changing forward_agent works fine. Changing port_forwarding does not.

What you expected to happen: Setting port_forwarding to false should remove the permit-port-forwarding trait and disable port forwarding.

How to reproduce it (as minimally and precisely as possible): Use the example role above and try logging into a cluster.

Environment:

• Teleport version (use teleport version): Teleport Enterprise v4.1.4git:v4.1.4-0-gc487a75c go1.13.2
• Tsh version (use tsh version): Teleport v4.1.4 git:v4.1.4-0-gc487a75c go1.13.2
• OS (e.g. from /etc/os-release): Fedora 30

[fspmarshall]

Try upgrading to v4.1.7 or newer; this sounds a lot like the issue fixed in #3208.

[webvictim]

Absolutely correct. Thanks.