diff --git a/lib/auth/auth.go b/lib/auth/auth.go index fd8f453321eae..909a523f61378 100644 --- a/lib/auth/auth.go +++ b/lib/auth/auth.go @@ -6299,7 +6299,66 @@ func (a *Server) validateMFAAuthResponseForRegister(ctx context.Context, resp *p // required challenge extensions will be checked against the stored challenge when // applicable (webauthn only). Returns the authentication data derived from the solved // challenge. -func (a *Server) ValidateMFAAuthResponse(ctx context.Context, resp *proto.MFAAuthenticateResponse, user string, requiredExtensions *mfav1.ChallengeExtensions) (mfaAuthData *authz.MFAAuthData, err error) { +func (a *Server) ValidateMFAAuthResponse( + ctx context.Context, + resp *proto.MFAAuthenticateResponse, + user string, + requiredExtensions *mfav1.ChallengeExtensions, +) (*authz.MFAAuthData, error) { + + authData, validateErr := a.validateMFAAuthResponseInternal(ctx, resp, user, requiredExtensions) + // validateErr handled after audit. + + // Read ClusterName for audit. + var clusterName string + if cn, err := a.GetClusterName(); err != nil { + log.WithError(err).Warn("Failed to read cluster name") + // err swallowed on purpose. + } else { + clusterName = cn.GetClusterName() + } + + // Take the user from the authData if the user param is empty. + // This happens for passwordless. + if user == "" && authData != nil { + user = authData.User + } + + // Emit audit event. + auditEvent := &apievents.ValidateMFAAuthResponse{ + Metadata: apievents.Metadata{ + Type: events.ValidateMFAAuthResponseEvent, + ClusterName: clusterName, + }, + UserMetadata: authz.ClientUserMetadataWithUser(ctx, user), + ChallengeScope: requiredExtensions.Scope.String(), + } + if validateErr != nil { + auditEvent.Code = events.ValidateMFAAuthResponseFailureCode + auditEvent.Success = false + auditEvent.UserMessage = validateErr.Error() + auditEvent.Error = validateErr.Error() + } else { + auditEvent.Code = events.ValidateMFAAuthResponseCode + auditEvent.Success = true + deviceMetadata := mfaDeviceEventMetadata(authData.Device) + auditEvent.MFADevice = &deviceMetadata + auditEvent.ChallengeAllowReuse = authData.AllowReuse == mfav1.ChallengeAllowReuse_CHALLENGE_ALLOW_REUSE_YES + } + if err := a.emitter.EmitAuditEvent(ctx, auditEvent); err != nil { + log.WithError(err).Warn("Failed to emit ValidateMFAAuthResponse event") + // err swallowed on purpose. + } + + return authData, trace.Wrap(validateErr) +} + +func (a *Server) validateMFAAuthResponseInternal( + ctx context.Context, + resp *proto.MFAAuthenticateResponse, + user string, + requiredExtensions *mfav1.ChallengeExtensions, +) (*authz.MFAAuthData, error) { if requiredExtensions == nil { return nil, trace.BadParameter("required challenge extensions parameter required") } @@ -6311,38 +6370,6 @@ func (a *Server) ValidateMFAAuthResponse(ctx context.Context, resp *proto.MFAAut return nil, trace.BadParameter("user required") } - clusterName, err := a.GetClusterName() - if err != nil { - return nil, trace.Wrap(err) - } - - defer func() { - auditEvent := &apievents.ValidateMFAAuthResponse{ - Metadata: apievents.Metadata{ - Type: events.ValidateMFAAuthResponseEvent, - ClusterName: clusterName.GetClusterName(), - }, - UserMetadata: authz.ClientUserMetadataWithUser(ctx, user), - ChallengeScope: requiredExtensions.Scope.String(), - } - if err != nil { - auditEvent.Code = events.ValidateMFAAuthResponseFailureCode - auditEvent.Success = false - auditEvent.UserMessage = err.Error() - auditEvent.Error = err.Error() - } else { - auditEvent.Code = events.ValidateMFAAuthResponseCode - auditEvent.Status.Success = true - deviceMetadata := mfaDeviceEventMetadata(mfaAuthData.Device) - auditEvent.MFADevice = &deviceMetadata - auditEvent.ChallengeAllowReuse = mfaAuthData.AllowReuse == mfav1.ChallengeAllowReuse_CHALLENGE_ALLOW_REUSE_YES - } - - if err := a.emitter.EmitAuditEvent(ctx, auditEvent); err != nil { - log.WithError(err).Warn("Failed to emit ValidateMFAAuthResponse event.") - } - }() - switch res := resp.Response.(type) { // cases in order of preference case *proto.MFAAuthenticateResponse_Webauthn: diff --git a/web/packages/teleport/src/Audit/__snapshots__/Audit.story.test.tsx.snap b/web/packages/teleport/src/Audit/__snapshots__/Audit.story.test.tsx.snap index 4a4703479b05f..29f107ddfdf77 100644 --- a/web/packages/teleport/src/Audit/__snapshots__/Audit.story.test.tsx.snap +++ b/web/packages/teleport/src/Audit/__snapshots__/Audit.story.test.tsx.snap @@ -406,12 +406,12 @@ exports[`list of all events 1`] = ` - - 237 + 239 of - 237 + 239 + + + + +
+ + + + + + + + MFA Authentication Attempt +
+ + + User [llama] requested an MFA authentication challenge + + + 2024-04-16T21:46:59.317Z + + + + + - `User [${user}] requested an MFA authentication challenge`, + format: ({ user }) => { + if (user) { + return `User [${user}] requested an MFA authentication challenge`; + } + return `Passwordless user requested an MFA authentication challenge`; + }, }, [eventCodes.VALIDATE_MFA_AUTH_RESPONSE]: { type: 'mfa_auth_challenge.validate',