[Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge by danielashare · Pull Request #63945 · gravitational/teleport

danielashare · 2026-02-18T20:10:24Z

This PR adds the BrowserMFARequestID field to the POST /webapi/mfa/authenticatechallenge call so that the correct challenge extensions can be set when requesting an MFA challenge through the browser. The RFD for this addition can be found here. Needs to be merged after #63831.

These changes address this part of the flow from the above RFD:

sequenceDiagram
    participant browser as Browser
    participant proxy as Proxy
    participant auth as Auth

    browser->>proxy: POST /webapi/mfa/authenticatechallenge<br/>w/ browser_mfa_request_id
    proxy->>auth: rpc CreateAuthenticateChallenge<br/>w/ browser_mfa_request_id
    auth->>auth: Lookup SSOMFASession<br/>Get challenge extensions
    auth->>proxy: MFA Challenge
    proxy->>browser: MFA Challenge

Manual tests:

MFA prompt for per-session still works
MFA prompt for creating Passkeys and MFA devices still works
MFA prompt for admin actions still works (creating new auth connector)

nicholasmarais1158

I didn't manual test, but code looks good.

codingllama · 2026-03-25T18:52:05Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3dd7938fa2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

codingllama

Please resolve merge conflicts and address the codex review.

codingllama · 2026-03-25T19:30:08Z

+
+		// Replace the challenge extensions with the ones found in the SSO MFA object.
+		// These are the ones from the original tsh request.
+		challengeExtensions = mfatypes.ChallengeExtensionsToProto(chalExts)


Should we make sure that SSO MFA sessions record all ChallengeExtensions fields as well? It appears we do not record UserVerificationRequirement:

teleport/lib/auth/sso_mfa.go

Lines 158 to 161 in 6382ef5

ChallengeExtensions: &mfatypes.ChallengeExtensions{

Scope: ext.Scope,

AllowReuse: ext.AllowReuse,

},

OK if you want to follow up separately.

Yes, I'll include this in an upstream PR, thanks

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d0542e9d88

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

backport-bot-workflows · 2026-03-26T11:05:08Z

@danielashare See the table below for backport results.

Branch	Result
branch/v18	Failed

…63945)

[Browser MFA] Add protobuf and config (#63831) [Browser MFA] Add proto for Browser MFA feature (#64048) [Browser MFA] Add CompleteBrowserMFAChallenge gRPC (#63873) [Browser MFA] Rename browser mfa config name (#64980) [Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#63945) [Browser MFA] Add Browser MFA to challenge request flow (#63936) [Browser MFA] Add initial requests for browser MFA process to client tools (#64301) [Browser MFA] Add tsh callback handling for webauthn response (#64461) [Browser MFA] Add Browser MFA to presence checks (#65052) [Browser MFA] Add browser MFA path to MFA finish flow (#64523) [Browser MFA] Add Browser MFA to Connect (#64887) [Browser MFA] Add Browser MFA UI (#64692) [Browser MFA] Fix formatting in moderated sessions (#65236) [Browser MFA] Add Browser MFA ceremony tests

[Browser MFA] Add protobuf and config (gravitational#63831) [Browser MFA] Add proto for Browser MFA feature (gravitational#64048) [Browser MFA] Add CompleteBrowserMFAChallenge gRPC (gravitational#63873) [Browser MFA] Rename browser mfa config name (gravitational#64980) [Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (gravitational#63945) [Browser MFA] Add Browser MFA to challenge request flow (gravitational#63936) [Browser MFA] Add initial requests for browser MFA process to client tools (gravitational#64301) [Browser MFA] Add tsh callback handling for webauthn response (gravitational#64461) [Browser MFA] Add Browser MFA to presence checks (gravitational#65052) [Browser MFA] Add browser MFA path to MFA finish flow (gravitational#64523) [Browser MFA] Add Browser MFA to Connect (gravitational#64887) [Browser MFA] Add Browser MFA UI (gravitational#64692) [Browser MFA] Fix formatting in moderated sessions (gravitational#65236) [Browser MFA] Add Browser MFA ceremony tests

danielashare requested review from Joerger and codingllama February 18, 2026 20:10

danielashare self-assigned this Feb 18, 2026

danielashare added no-changelog Indicates that a PR does not require a changelog entry backport/branch/v18 labels Feb 18, 2026

github-actions Bot added the size/md label Feb 18, 2026

github-actions Bot requested review from kimlisa and nicholasmarais1158 February 18, 2026 20:10

codingllama reviewed Feb 19, 2026

View reviewed changes

Comment thread lib/auth/auth.go Outdated

Comment thread lib/auth/auth.go Outdated

Comment thread lib/auth/auth.go Outdated

Comment thread lib/auth/browser_mfa_test.go Outdated

Comment thread lib/auth/browser_mfa_test.go Outdated

Comment thread lib/auth/browser_mfa_test.go Outdated

kimlisa removed their request for review February 19, 2026 16:56

danielashare mentioned this pull request Feb 19, 2026

Browser MFA Feature #63987

Open

codingllama reviewed Feb 20, 2026

View reviewed changes

danielashare force-pushed the danielashare/browser-mfa-proto branch 4 times, most recently from 0cb377a to 8a5561b Compare March 2, 2026 07:40

Base automatically changed from danielashare/browser-mfa-proto to master March 2, 2026 09:08

danielashare force-pushed the danielashare/browser-mfa-auth-chal-with-req-id branch from 3d30faf to e9e925e Compare March 3, 2026 12:51

nicholasmarais1158 approved these changes Mar 4, 2026

View reviewed changes

Comment thread lib/auth/browser_mfa_test.go Outdated

codingllama reviewed Mar 5, 2026

View reviewed changes

Joerger reviewed Mar 6, 2026

View reviewed changes

Comment thread lib/auth/auth.go

Comment thread lib/auth/auth.go

Joerger approved these changes Mar 25, 2026

View reviewed changes

codingllama reviewed Mar 25, 2026

View reviewed changes

Comment thread lib/auth/auth.go Outdated

chatgpt-codex-connector Bot reviewed Mar 25, 2026

View reviewed changes

Comment thread lib/web/mfa.go

codingllama reviewed Mar 25, 2026

View reviewed changes

zmb3 approved these changes Mar 25, 2026

View reviewed changes

[Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge

d0542e9

danielashare force-pushed the danielashare/browser-mfa-auth-chal-with-req-id branch from 3dd7938 to d0542e9 Compare March 26, 2026 08:37

chatgpt-codex-connector Bot reviewed Mar 26, 2026

View reviewed changes

Comment thread lib/auth/auth.go

Comment thread lib/auth/auth.go

danielashare added this pull request to the merge queue Mar 26, 2026

Merged via the queue into master with commit c289ef5 Mar 26, 2026
42 checks passed

danielashare deleted the danielashare/browser-mfa-auth-chal-with-req-id branch March 26, 2026 11:03

danielashare added a commit that referenced this pull request Mar 31, 2026

[Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#…

ab0827a

…63945)

danielashare added a commit that referenced this pull request Apr 2, 2026

[Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#…

c04db00

…63945)

danielashare added a commit that referenced this pull request Apr 7, 2026

[Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#…

b6446ff

…63945)

danielashare added a commit that referenced this pull request Apr 17, 2026

[Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#…

0edeb25

…63945)

mmcallister pushed a commit that referenced this pull request Apr 28, 2026

[Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#…

84cd237

…63945)

danielashare added a commit that referenced this pull request Apr 30, 2026

[Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#…

111b98e

…63945)

danielashare added a commit that referenced this pull request May 5, 2026

[Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#…

a4b2fc3

…63945)

	ChallengeExtensions: &mfatypes.ChallengeExtensions{
	Scope: ext.Scope,
	AllowReuse: ext.AllowReuse,
	},

Conversation

danielashare commented Feb 18, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nicholasmarais1158 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codingllama commented Mar 25, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

codingllama left a comment

Choose a reason for hiding this comment

Uh oh!

codingllama Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

danielashare Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

backport-bot-workflows Bot commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants