Skip to content

Make tctl users add prompt for MFA just once #36997

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Joerger merged 5 commits into from
Jan 23, 2024
Merged

Make tctl users add prompt for MFA just once #36997

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8f3f0d1
Refactor MFA prompt logic for the API client to enable various MFA
Joerger Jan 12, 2024
98254ee
Address comments.
Joerger Jan 22, 2024
d495149
Prompt for MFA before creating a user with tctl.
Joerger Jan 12, 2024
6f2e6fe
Check if AdminActionMFA is enforced before attempting to create an MF…
Joerger Jan 22, 2024
e1ec275
Merge branch 'master' into joerger/reuse-mfa-tctl-users-add
Joerger Jan 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions api/types/authentication.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,8 @@ type AuthPreference interface {
// IsSecondFactorWebauthnAllowed checks if users are allowed to register
// Webauthn devices.
IsSecondFactorWebauthnAllowed() bool
// IsAdminActionMFAEnforced checks if admin action MFA is enforced.
IsAdminActionMFAEnforced() bool

// GetConnectorName gets the name of the OIDC or SAML connector to use. If
// this value is empty, we fall back to the first connector in the backend.
Expand Down Expand Up @@ -325,6 +327,12 @@ func (c *AuthPreferenceV2) IsSecondFactorWebauthnAllowed() bool {
c.Spec.SecondFactor == constants.SecondFactorOn
}

// IsAdminActionMFAEnforced checks if admin action MFA is enforced. Currently, the only
// prerequisite for admin action MFA enforcement is whether Webauthn is enabled.
func (c *AuthPreferenceV2) IsAdminActionMFAEnforced() bool {
return c.IsSecondFactorWebauthnAllowed()
}

// GetConnectorName gets the name of the OIDC or SAML connector to use. If
// this value is empty, we fall back to the first connector in the backend.
func (c *AuthPreferenceV2) GetConnectorName() string {
Expand Down
5 changes: 2 additions & 3 deletions lib/authz/permissions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,6 @@ import (

"github.com/gravitational/teleport"
"github.com/gravitational/teleport/api/client/proto"
"github.com/gravitational/teleport/api/constants"
"github.com/gravitational/teleport/api/defaults"
mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
"github.com/gravitational/teleport/api/mfa"
Expand Down Expand Up @@ -444,8 +443,8 @@ func (a *authorizer) isAdminActionAuthorizationRequired(ctx context.Context, aut
return false, trace.Wrap(err)
}

// Admin actions do not require MFA when Webauthn is not enabled.
if authpref.GetPreferredLocalMFA() != constants.SecondFactorWebauthn {
// Check if this cluster enforces MFA for admin actions.
if !authpref.IsAdminActionMFAEnforced() {
return false, nil
}

Expand Down
11 changes: 11 additions & 0 deletions tool/tctl/common/user_command.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ import (

"github.com/gravitational/teleport"
"github.com/gravitational/teleport/api/constants"
"github.com/gravitational/teleport/api/mfa"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/lib/asciitable"
"github.com/gravitational/teleport/lib/auth"
Expand Down Expand Up @@ -297,6 +298,16 @@ func (u *UserCommand) Add(ctx context.Context, client auth.ClientI) error {
user.SetTraits(traits)
user.SetRoles(u.allowedRoles)

// Prompt for admin action MFA if required, allowing reuse for CreateResetPasswordToken.
if u.config.Auth.Preference.IsAdminActionMFAEnforced() {
mfaResponse, err := mfa.PerformAdminActionMFACeremony(ctx, client, "CreateUser", true /*allowReuse*/)
if err != nil {
return trace.Wrap(err)
} else if mfaResponse != nil {
ctx = mfa.ContextWithMFAResponse(ctx, mfaResponse)
}
}

if _, err := client.CreateUser(ctx, user); err != nil {
if trace.IsAlreadyExists(err) {
fmt.Printf(`NOTE: To update an existing local user:
Expand Down