MFA for Admin Actions: CreateResetPasswordToken

lib/auth/auth_with_roles.go

@@ -3122,6 +3122,10 @@ func (a *ServerWithRoles) CreateResetPasswordToken(ctx context.Context, req Crea
 		return nil, trace.AccessDenied("access denied")
 	}
 
+	if err := authz.AuthorizeAdminAction(ctx, &a.context); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
 	return a.authServer.CreateResetPasswordToken(ctx, req)
 }
 

tool/tctl/common/admin_action_test.go

@@ -87,6 +87,12 @@ func (s *adminActionTestSuite) testAdminActionMFA_Users(t *testing.T) {
 			setup:      createUser,
 			cleanup:    deleteUser,
 		},
+		"tctl users reset": {
+			command:    "users reset teleuser",
+			cliCommand: &tctl.UserCommand{},
+			setup:      createUser,
+			cleanup:    deleteUser,
+		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			s.runTestCase(t, ctx, tc)

web/packages/teleport/src/services/api/api.ts

@@ -97,12 +97,22 @@ const api = {
     if (!shouldRetry) {
       throw new ApiError(parseError(json), response);
     }
+
+    let webauthnResponse;
+    try {
+      webauthnResponse = await auth.getWebauthnResponse();
+    } catch (err) {
+      throw new Error(
+        'Failed to fetch webauthn credentials, please connect a registered hardware key and try again. If you do not have a hardware key registered, you can add one from your account settings page.'
+      );
+    }
+
     const paramsWithMfaHeader = {
       ...params,
       headers: {
         ...params.headers,
         [MFA_HEADER]: JSON.stringify({
-          webauthnAssertionResponse: await auth.getWebauthnResponse(),
+          webauthnAssertionResponse: webauthnResponse,
         }),
       },
     };