Make tctl users add prompt for MFA just once#36997
Conversation
Joerger
added
no-changelog
| user.SetRoles(u.allowedRoles) | ||
|
|
||
| // Prompt for admin action MFA if required, allowing reuse for CreateResetPasswordToken. | ||
| mfaResponse, err := mfa.PerformAdminActionMFACeremony(ctx, client, "CreateUser", true /*allowReuse*/) |
There was a problem hiding this comment.
Does this mean users who do not use MFA are going to incur an additional "cost" in the form of one extra call to the cluster in order to get the MFA challenge?
I know that in the past we've been trying to avoid it. I remember Michael dealing with this around file transfer in moderated sessions. But maybe nowadays it's not that big of a deal since we want to encourage people to use MFA anyway.
There was a problem hiding this comment.
maybe we can also cache the challenge (chal.MFARequired)?
There was a problem hiding this comment.
You're absolutely right. I've updated it to check the cached auth pref to see if MFA is enforced for admin actions.
maybe we can also cache the challenge (
chal.MFARequired)?
It's true that even with the change above we will sometimes check if MFA is required when we already know it is/is not. However, I'd like to keep this PR simple and not add a potentially finicky cache system. I'll consider making a follow up for this.
Joerger
force-pushed
the
joerger/reuse-mfa-tctl-users-add
branch
from
2b3715b to
b64ab83
Compare
Joerger
force-pushed
the
joerger/client-mfa-ceremony-refactor
branch
from
7fede37 to
ac2f794
Compare
Joerger
force-pushed
the
joerger/reuse-mfa-tctl-users-add
branch
from
b64ab83 to
3c4c44f
Compare
Joerger
force-pushed
the
joerger/client-mfa-ceremony-refactor
branch
from
ac2f794 to
98254ee
Compare
Joerger
force-pushed
the
joerger/reuse-mfa-tctl-users-add
branch
from
3c4c44f to
6f2e6fe
Compare
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
* Refactor MFA prompt logic for the API client to enable various MFA ceremony use cases. * Address comments. * Prompt for MFA before creating a user with tctl. * Check if AdminActionMFA is enforced before attempting to create an MFA auth challenge.
* Refactor MFA prompt logic for the API client to enable various MFA ceremony use cases. * Address comments. * Prompt for MFA before creating a user with tctl. * Check if AdminActionMFA is enforced before attempting to create an MFA auth challenge.
3 participants
Updates
tctl users addto perform the admin action MFA ceremony upfront, allowing reuse soCreateUserandCreateResetPasswordTokenonly require one prompt.Based on #36996