DB multi-session MFA Part 2: MFA reuse for GenerateUserCerts

[greedy52]

related:

• Multi-session MFA for database access #51679
• RFD 202 - Database Multi-session MFA #52358
• DB multi-session MFA Part 1: implement basic "tsh db exec" #53296

Changelog: New tsh db exec that executes commands on multiple target databases. When per-session MFA is required, only a single MFA tap is needed every 5 minutes.

The change may seem big but most files are only touched because of refactoring.

Sample role:

kind: role
metadata:
  name: access-mysql
spec:
  allow:
    db_labels:
      env: dev 
    db_users: [teleport-admin]
    db_names: ["*"]
  options:
    require_session_mfa: true
version: v7

Sample tsh db exec run:

$ cat sleep.sql 
DO SLEEP(120);
SELECT @@hostname AS Hostname;

$ tsh db exec "source sleep.sql" --db-user teleport-admin --dbs mysql1,mysql2,mysql3,mysql4
Fetching databases by name ...

Executing command for "mysql1".
MFA is required to access Database "mysql1"
Tap any security key
Detected security key tap
Hostname
64f979fb76c9

Executing command for "mysql2".
Hostname
6bc83bfda8d1

Executing command for "mysql3".
Hostname
64f979fb76c9

Executing command for "mysql4".
Your MFA validation has timed out.
MFA is required to access Database "mysql4"
Tap any security key
Detected security key tap
Hostname
6bc83bfda8d1

Summary: 4 of 4 succeeded.

[greedy52]

moved from below

[greedy52]

@Joerger do you mind take a look at this implementation for reuse? thanks 🙏

[Tener]

first pass

[greedy52]

@Joerger @Tener PTAL 🙏