MFA Auth Audit Events

api/proto/teleport/legacy/types/events/events.proto

@@ -1231,6 +1231,64 @@ message UserLogin {
   repeated string AppliedLoginRules = 9 [(gogoproto.jsontag) = "applied_login_rules,omitempty"];
 }
 
+// CreateMFAAuthChallenge records the creation of an MFA auth challenge.
+message CreateMFAAuthChallenge {
+  // Metadata is a common event metadata.
+  Metadata Metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // User is a common user event metadata.
+  UserMetadata User = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Scope is the authorization scope for this MFA challenge.
+  // Only applies to WebAuthn challenges.
+  string ChallengeScope = 3 [(gogoproto.jsontag) = "challenge_scope"];
+
+  // ChallengeAllowReuse defines whether the MFA challenge allows reuse.
+  bool ChallengeAllowReuse = 4 [(gogoproto.jsontag) = "challenge_allow_reuse"];
+}
+
+// ValidateMFAAuthResponse records the validation of an MFA auth callenge response.
+message ValidateMFAAuthResponse {
+  // Metadata is a common event metadata.
+  Metadata Metadata = 1 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // User is a common user event metadata.
+  UserMetadata User = 2 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // Status contains common command or operation status fields
+  Status Status = 3 [
+    (gogoproto.nullable) = false,
+    (gogoproto.embed) = true,
+    (gogoproto.jsontag) = ""
+  ];
+
+  // MFADevice is the MFA device used.
+  MFADeviceMetadata MFADevice = 4 [(gogoproto.jsontag) = "mfa_device,omitempty"];
+
+  // ChallengeScope is the authorization scope of the MFA challenge used for authentication.
+  // Only applies to WebAuthn challenges.
+  string ChallengeScope = 5 [(gogoproto.jsontag) = "challenge_scope"];
+
+  // ChallengeAllowReuse defines whether the MFA challenge used for authentication can be reused.
+  bool ChallengeAllowReuse = 6 [(gogoproto.jsontag) = "challenge_allow_reuse"];
+}
+
 // ResourceMetadata is a common resource metadata
 message ResourceMetadata {
   // ResourceName is a resource name
@@ -3863,6 +3921,8 @@ message OneOf {
     events.BotCreate BotCreate = 143;
     events.BotDelete BotDelete = 144;
     events.BotUpdate BotUpdate = 145;
+    events.CreateMFAAuthChallenge CreateMFAAuthChallenge = 146;
+    events.ValidateMFAAuthResponse ValidateMFAAuthResponse = 147;
   }
 }