Add SSO MFA prompt for WebUI MFA flows by Joerger · Pull Request #49794 · gravitational/teleport

Joerger · 2024-12-04T21:19:14Z

Changelog: Add full SSO MFA support for the WebUI.

Extends SSO MFA support for:

Reauthenticate flows (Refactor Reauthenticate components to handle generic MFA challenges. #49680)
- device management
- password change
- account recovery
- connection tester (discover) with per-session MFA
app per-session MFA
file transfer per-session MFA
admin actions

Note: per-session SSO MFA for Node, Kube, and Desktop was already supported.

Depends on #49680

bl-nero · 2024-12-16T10:44:19Z

+          submitAttempt={ft.submitMfaAttempt}
+          onCancel={ft.clearMfaChallenge}
+        />
+      )}


Is there a scenario where we can get an mfaChallenge on both mfa and ft?

No, the mfa authndialog will always be handled and complete before we get to the ft authndialog. In the new updated code it would be easy to reuse the same mfa state if you're concerned about it though.

…x bug where MFA couldn't be retried after a failed attempt; Add extra tests.

public-teleport-github-review-bot · 2024-12-20T04:11:43Z

@Joerger See the table below for backport results.

Branch	Result
branch/v17	Failed

* Include sso channel ID in web mfa challenges. * Handle SSO MFA challenges. * Handle sso response in backend. * Handle non-webauthn mfa response for file transfer, admin actions, and app session. * Simplify useMfa with new helpers. * Fix lint. * Use AuthnDialog for file transfers; Fix json backend logic for file transfers. * Make useMfa and AuthnDialog more reusable and error proof. * Use AuthnDialog for App sessions. * Resolve comments. * Fix broken app launcher; improve mfaRequired logic in useMfa. * Fix AuthnDialog test. * Fix merge conflict with Db web access. * fix stories. * Refactor mfa required logic. * Address bl-nero's comments. * Address Ryan's comments. * Add useMfa unit test. * Fix story lint. * Replace Promise.withResolvers for compatiblity with older browers; Fix bug where MFA couldn't be retried after a failed attempt; Add extra tests.

zmb3 · 2024-12-23T17:42:30Z


 import { ButtonState } from 'teleport/lib/tdp';
-import { useMfa } from 'teleport/lib/useMfa';
+import { useMfaTty } from 'teleport/lib/useMfa';


@Joerger why is desktop session calling useMfaTty? There is no TTY for desktop sessions - this is SSH-only code, is it not?

Joerger · 2025-01-08T20:53:30Z

-  sendWebAuthn(data: WebauthnAssertionResponse) {
-    const msg = this.codec.encodeMfaJson({
-      mfaType: 'n',
-      jsonString: JSON.stringify(data),
-    });
-    this.send(msg);
-  }
-


Mistakenly removed, restored by #50793

* Include sso channel ID in web mfa challenges. * Handle SSO MFA challenges. * Handle sso response in backend. * Handle non-webauthn mfa response for file transfer, admin actions, and app session. * Simplify useMfa with new helpers. * Fix lint. * Use AuthnDialog for file transfers; Fix json backend logic for file transfers. * Make useMfa and AuthnDialog more reusable and error proof. * Use AuthnDialog for App sessions. * Resolve comments. * Fix broken app launcher; improve mfaRequired logic in useMfa. * Fix AuthnDialog test. * Fix merge conflict with Db web access. * fix stories. * Refactor mfa required logic. * Address bl-nero's comments. * Address Ryan's comments. * Add useMfa unit test. * Fix story lint. * Replace Promise.withResolvers for compatiblity with older browers; Fix bug where MFA couldn't be retried after a failed attempt; Add extra tests.

* Add SSO MFA prompt for WebUI MFA flows (#49794) * Include sso channel ID in web mfa challenges. * Handle SSO MFA challenges. * Handle sso response in backend. * Handle non-webauthn mfa response for file transfer, admin actions, and app session. * Simplify useMfa with new helpers. * Fix lint. * Use AuthnDialog for file transfers; Fix json backend logic for file transfers. * Make useMfa and AuthnDialog more reusable and error proof. * Use AuthnDialog for App sessions. * Resolve comments. * Fix broken app launcher; improve mfaRequired logic in useMfa. * Fix AuthnDialog test. * Fix merge conflict with Db web access. * fix stories. * Refactor mfa required logic. * Address bl-nero's comments. * Address Ryan's comments. * Add useMfa unit test. * Fix story lint. * Replace Promise.withResolvers for compatiblity with older browers; Fix bug where MFA couldn't be retried after a failed attempt; Add extra tests. * Fix Per-session MFA for desktops (#50793) * Add sendChallengeResponse implementation for desktop sessions. * Rename useMfaTty to useMfaEmitter. * Remove unused code. * Fix `useMfa` error handling (#50844) * Fix useMfa cancel logic to avoid duplicate error messages across dialog layers. * Add MfaCanceledError and use promise.reject for mfa cancel. * Address comments. * Fix test. * Remove outdated comment. * Add comment; Simplify who dialog logic. --------- Co-authored-by: Roman Tkachenko <roman@goteleport.com>

* Include sso channel ID in web mfa challenges. * Handle SSO MFA challenges. * Handle sso response in backend. * Handle non-webauthn mfa response for file transfer, admin actions, and app session. * Simplify useMfa with new helpers. * Fix lint. * Use AuthnDialog for file transfers; Fix json backend logic for file transfers. * Make useMfa and AuthnDialog more reusable and error proof. * Use AuthnDialog for App sessions. * Resolve comments. * Fix broken app launcher; improve mfaRequired logic in useMfa. * Fix AuthnDialog test. * Fix merge conflict with Db web access. * fix stories. * Refactor mfa required logic. * Address bl-nero's comments. * Address Ryan's comments. * Add useMfa unit test. * Fix story lint. * Replace Promise.withResolvers for compatiblity with older browers; Fix bug where MFA couldn't be retried after a failed attempt; Add extra tests.

Joerger requested a review from avatus December 4, 2024 21:19

Joerger mentioned this pull request Dec 4, 2024

SSO MFA tracker #46576

Closed

Joerger force-pushed the joerger/refactor-reauthenticate branch 4 times, most recently from 4abf873 to 42ba430 Compare December 6, 2024 00:11

Joerger force-pushed the joerger/sso-mfa-method branch 2 times, most recently from 5911b85 to 672dddb Compare December 9, 2024 22:11

Joerger force-pushed the joerger/refactor-reauthenticate branch from ea8e8eb to 40336ed Compare December 9, 2024 22:26

Joerger added the backport/branch/v17 label Dec 9, 2024

Joerger force-pushed the joerger/refactor-reauthenticate branch 2 times, most recently from af41a4e to bdd69ca Compare December 10, 2024 01:04

Joerger force-pushed the joerger/sso-mfa-method branch from 672dddb to 9ad6250 Compare December 10, 2024 01:18

Joerger force-pushed the joerger/refactor-reauthenticate branch from e60ec3d to 428e745 Compare December 11, 2024 02:41

Joerger force-pushed the joerger/sso-mfa-method branch from 9ad6250 to 213322c Compare December 11, 2024 02:42

Joerger marked this pull request as ready for review December 11, 2024 02:42

github-actions Bot added size/sm ui labels Dec 11, 2024

github-actions Bot requested a review from kiosion December 11, 2024 02:43

avatus requested a review from bl-nero December 12, 2024 17:06

Joerger force-pushed the joerger/refactor-reauthenticate branch 2 times, most recently from 8e2fb35 to 9e8ad10 Compare December 14, 2024 01:18

Joerger force-pushed the joerger/sso-mfa-method branch from 213322c to fb8c772 Compare December 14, 2024 02:16

bl-nero reviewed Dec 16, 2024

View reviewed changes

Joerger force-pushed the joerger/sso-mfa-method branch from 4182ae3 to e3c7edf Compare December 16, 2024 22:12

Joerger force-pushed the joerger/refactor-reauthenticate branch from 5d0f08d to 89e4639 Compare December 16, 2024 22:17

Joerger force-pushed the joerger/sso-mfa-method branch from e3c7edf to ff21791 Compare December 16, 2024 22:33

Joerger requested review from bl-nero and ryanclark December 16, 2024 22:39

Joerger force-pushed the joerger/sso-mfa-method branch from ff21791 to 99729ea Compare December 17, 2024 01:49

Joerger added 9 commits December 19, 2024 12:28

Fix AuthnDialog test.

817dc3e

Fix merge conflict with Db web access.

7025781

fix stories.

61d18c4

Refactor mfa required logic.

1921b95

Address bl-nero's comments.

c96e18b

Address Ryan's comments.

c1438ba

Add useMfa unit test.

d3d473d

Fix story lint.

353ffe9

Replace Promise.withResolvers for compatiblity with older browers; Fi…

e103a1f

…x bug where MFA couldn't be retried after a failed attempt; Add extra tests.

Joerger force-pushed the joerger/sso-mfa-method branch from 5ee3d03 to e103a1f Compare December 19, 2024 20:28

Joerger added this pull request to the merge queue Dec 20, 2024

Merged via the queue into master with commit 7269273 Dec 20, 2024

Joerger deleted the joerger/sso-mfa-method branch December 20, 2024 04:10

Joerger mentioned this pull request Dec 20, 2024

[v17] Add SSO MFA prompt for WebUI MFA flows #50529

Merged

zmb3 reviewed Dec 23, 2024

View reviewed changes

zmb3 mentioned this pull request Dec 23, 2024

Per-session MFA for desktops is broken #50557

Closed

ravicious mentioned this pull request Dec 30, 2024

Add a null check to getMfaChallengeResponse #50570

Merged

Joerger commented Jan 8, 2025

View reviewed changes

Joerger mentioned this pull request Jan 8, 2025

Fix Per-session MFA for desktops #50793

Merged

This was referenced Jan 31, 2025

File transfers in the WebUI always think MFA is required #51694

Closed

Fix MFA always required for file transfers #51740

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SSO MFA prompt for WebUI MFA flows#49794

Add SSO MFA prompt for WebUI MFA flows#49794
Joerger merged 20 commits intomasterfrom
joerger/sso-mfa-method

Joerger commented Dec 4, 2024 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bl-nero Dec 16, 2024

Uh oh!

Joerger Dec 16, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

public-teleport-github-review-bot Bot commented Dec 20, 2024

Uh oh!

zmb3 Dec 23, 2024

Uh oh!

Joerger Jan 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Joerger commented Dec 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bl-nero Dec 16, 2024

Choose a reason for hiding this comment

Uh oh!

Joerger Dec 16, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

public-teleport-github-review-bot Bot commented Dec 20, 2024

Uh oh!

zmb3 Dec 23, 2024

Choose a reason for hiding this comment

Uh oh!

Joerger Jan 8, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Joerger commented Dec 4, 2024 •

edited

Loading