MFA for Admin Actions: CreateResetPasswordToken

[Joerger]

Require MFA for CreateResetPasswordToken.

Part of RFD 131.

Based off #35386 to use the same test helpers.

[kimlisa]

i was trying to test this in the web UI and i get this, am i missing something? (also i had otp setup)

[Joerger]

@kimlisa It's expected that OTP wouldn't work on the WebUI. This is something I hope to add after the initial v15 release if it can be prioritized.

[kimlisa]

@kimlisa It's expected that OTP wouldn't work on the WebUI. This is something I hope to add after the initial v15 release if it can be prioritized.

hrm, i think we should render an actionable message that the user can take to fix this problem, like telling them that this action requires re-auth and OTP is not supported so they should add a hardware key (and maybe link them to the https://localhost:3080/web/account/twofactor)? idk about CLI, but in the web UI we can tell what kind of second factor the cluster has, so even before the user performs the action, we can tell them it won't work (eg: clusters that only have otp enabled?)

[Joerger]

@kimlisa I added an actionable error message. If you think we should link them to their account page directly could you share a commit/diff to make that work?

Also note that we are reducing the scope to only clusters that support webauthn, so TOTP only clusters will avoid this MFA flow entirely.

[kimlisa]

this is much better, thanks 👍