Skip to content

Add second_factors #47169

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Joerger wants to merge 8 commits into from
Closed

Add second_factors #47169

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
499db47
Add proto.
Joerger Sep 12, 2024
949f538
Refactor enum decoding for reusability and use it for SecondFactorType.
Joerger Sep 12, 2024
6e00700
Replace usage of cap.GetSecondFactor.
Joerger Sep 12, 2024
2dc6ea8
Update validation logic.
Joerger Sep 30, 2024
3ee5e5d
Add SecondFactorTypeString representation; Update second factor relat…
Joerger Sep 30, 2024
dca7da4
Replace useage and deprecate old SecondFactor methods; Derive SecondF…
Joerger Oct 3, 2024
dd46cb5
Add fileconf and warning logs.
Joerger Oct 3, 2024
9dd277c
Undo gofumpt edits.
Joerger Oct 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion api/client/webclient/webclient.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -401,7 +401,7 @@ type AuthenticationSettings struct {
// PreferredLocalMFA is a server-side hint for clients to pick an MFA method
// when various options are available.
// It is empty if there is nothing to suggest.
PreferredLocalMFA constants.SecondFactorType `json:"preferred_local_mfa,omitempty"`
PreferredLocalMFA string `json:"preferred_local_mfa,omitempty"`
// AllowPasswordless is true if passwordless logins are allowed.
AllowPasswordless bool `json:"allow_passwordless,omitempty"`
// AllowHeadless is true if headless logins are allowed.
Expand Down
2 changes: 1 addition & 1 deletion api/client/webclient/webconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@ type WebConfigAuthSettings struct {
// PreferredLocalMFA is a server-side hint for clients to pick an MFA method
// when various options are available.
// It is empty if there is nothing to suggest.
PreferredLocalMFA constants.SecondFactorType `json:"preferredLocalMfa,omitempty"`
PreferredLocalMFA string `json:"preferredLocalMfa,omitempty"`
// LocalConnectorName is the name of the local connector.
LocalConnectorName string `json:"localConnectorName,omitempty"`
// PrivateKeyPolicy is the configured private key policy for the cluster.
Expand Down
1 change: 1 addition & 0 deletions api/constants/constants.go
View file
Open in desktop
Copy link
Copy Markdown
Contributor

@codingllama codingllama Oct 4, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and deprecate second_factor

Do we have to? Every config out there uses it, plus I see little harm in keeping it around.

Original file line number Diff line number Diff line change
Expand Up @@ -191,6 +191,7 @@ var SystemConnectors = []string{
}

// SecondFactorType is the type of 2FA authentication.
// Deprecated: Use types.SecondFactorType
Copy link
Copy Markdown
Contributor

@codingllama codingllama Oct 4, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will this cause problems on e/ ?

(I'm not sure deprecating this is wise, see other comment threads.)

type SecondFactorType string

const (
Expand Down
14 changes: 14 additions & 0 deletions api/proto/teleport/legacy/types/types.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2099,6 +2099,20 @@ message AuthPreferenceSpecV2 {
// SignatureAlgorithmSuite is the configured signature algorithm suite for the cluster.
// The current default value is "legacy". This field is not yet fully supported.
SignatureAlgorithmSuite signature_algorithm_suite = 20;

// SecondFactors is a list of supported second factor types.
Copy link
Copy Markdown
Contributor

@codingllama codingllama Oct 4, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// SecondFactors is a list of supported second factor types.
// SecondFactors is a list of supported second factor types, in ascending
// order of preference (first item is preferred).

repeated SecondFactorType SecondFactors = 21 [(gogoproto.jsontag) = "second_factors,omitempty"];
}

// SecondFactorType is a type of second factor.
enum SecondFactorType {
SECOND_FACTOR_TYPE_UNSPECIFIED = 0;
// SECOND_FACTOR_TYPE_OTP is OTP second factor.
SECOND_FACTOR_TYPE_OTP = 1;
// SECOND_FACTOR_TYPE_WEBAUTHN is WebAuthn second factor.
SECOND_FACTOR_TYPE_WEBAUTHN = 2;
// SECOND_FACTOR_TYPE_SSO is SSO second factor.
SECOND_FACTOR_TYPE_SSO = 3;
}

// U2F defines settings for U2F device.
Expand Down
Loading