Skip to content

[v15]: Backport the new wizard for adding authentication devices#38535

Merged
bl-nero merged 5 commits intobranch/v15from
bl-nero/backport-AddAuthDeviceWizard-to-v15
Feb 23, 2024
Merged

[v15]: Backport the new wizard for adding authentication devices#38535
bl-nero merged 5 commits intobranch/v15from
bl-nero/backport-AddAuthDeviceWizard-to-v15

Conversation

@bl-nero
Copy link
Copy Markdown
Contributor

@bl-nero bl-nero commented Feb 22, 2024

This is a combined backport of the following pull requests:

There was 1 conflict to resolve - between #38393 and #37743. The conflict appeared in the code that is being removed, as the conflicting PR was a bugfix on the old dialog. The conflict was resolved by removing the file.

Do not submit until tested by @avatus.

Contributes to #37616

Changelog: Updated the dialog for adding new authentication methods in the account settings screen.

bl-nero and others added 5 commits February 22, 2024 09:33
* Add an option to enable a new Add Device dialog design

Also deduplicate code from storageService functions that parse JSON.

* lint
* A wizard for adding authentication devices

* Hide changes between localStorage flag

* Review
* Add capability of adding MFA to the new auth device wizard

* Review

* Review

* License
* Add capability of adding MFA to the new auth device wizard

* Review

* Review

* Make the auth device wizard look pretty

* License

* Review

* Fix lint
…#38393)

* Remove the old AddDevice dialog

Also cleans up the accompanying local storage flag.

* Rename `canAddMFA`

Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>

* Update a success message

Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>

* review

* Review

---------

Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
@bl-nero
Copy link
Copy Markdown
Contributor Author

bl-nero commented Feb 22, 2024

@avatus To test it, please go to the account settings screen and try adding passkeys and MFA devices. Make sure that you can verify your identity using various methods. Corner cases:

  • A user that doesn't have any MFA device or passkey registered (possible if MFA is set to optional in the auth server settings), in which case there should be no verification step.
  • Passkeys disabled in the auth server settings (auth_service.authentication.passwordless set to false
  • MFA turned off completely (auth_service.authentication.second_factor set to "off").

@avatus
Copy link
Copy Markdown
Contributor

avatus commented Feb 22, 2024

I tested as many paths as I could think of and didn't run into anything that seemed out of the ordinary. So, LGTM.

a couple things that errored for me (but i believe are expected and/or my fault)

  1. how do i log in as a user without a key if i already have a user created and then passwordless/mfa is turned on? my guess is this wouldn't happen in a normal deployment and would probably have to do a "set to optional and then have a deadline for everyone to add". so, not part of this project
  2. i added an mfa device and it wouldn't let me have the same name as my passwordless device. which makes sense i guess but just pointing it out

@bl-nero
Copy link
Copy Markdown
Contributor Author

bl-nero commented Feb 23, 2024

Thank you, @avatus!

  1. how do i log in as a user without a key if i already have a user created and then passwordless/mfa is turned on? my guess is this wouldn't happen in a normal deployment and would probably have to do a "set to optional and then have a deadline for everyone to add". so, not part of this project

Yeah, we have never supported this scenario in any way other than relying on internal processes in users' organizations.

  1. i added an mfa device and it wouldn't let me have the same name as my passwordless device. which makes sense i guess but just pointing it out

That's a good point. I'll look into it, but my gut says it's not worth changing the data model constraints just because of this.

Copy link
Copy Markdown
Contributor

@gzdunek gzdunek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't tested it and only went over the commits, everything appears to be fine.

@bl-nero bl-nero added this pull request to the merge queue Feb 23, 2024
Merged via the queue into branch/v15 with commit fc19f19 Feb 23, 2024
@bl-nero bl-nero deleted the bl-nero/backport-AddAuthDeviceWizard-to-v15 branch February 23, 2024 14:11
@camscale camscale mentioned this pull request Feb 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants