[Browser MFA] Add browser MFA path to MFA finish flow by danielashare · Pull Request #64523 · gravitational/teleport

danielashare · 2026-03-11T16:53:28Z

This PR adds the Browser MFA path to /webapi/mfa/login/finish to finish the authentication flow for tsh. The RFD for this feature can be found here. Tracking issue here.

These changes address this part of the flow from the above RFD:

sequenceDiagram
    participant tsh
    participant browser as Browser
    participant proxy as Proxy
    participant auth as Auth

    tsh->>proxy: POST /webapi/mfa/login/finish
    proxy->>auth: AuthenticateSSHUser
    auth->>auth: ValidateMFAAuthResponse()
    auth->>auth: Generate SSH certificates
    auth-->>proxy: SSH Login Response
    proxy-->>tsh: Return certificates

Manual Test Plan

Test Environment

Running branch locally that has this feature with PoC code to enable starting the Browser MFA flow. Per-session being tested by connecting back to my Mac through Teleport.

Test Cases

Webauthn unaffected via browser and tsh
OTP unaffected via browser and tsh
Browser MFA works for login
Browser MFA works for per-session MFA
Audit event mfa_via_browser logged for Browser MFA

danielashare · 2026-03-11T16:58:43Z

 		auditEvent.Code = events.ValidateMFAAuthResponseCode
 		auditEvent.Success = true
 		deviceMetadata := mfaDeviceEventMetadata(authData.Device)
+		deviceMetadata.MFAViaBrowser = authData.MFAViaBrowser


I don't love that I set the MFAViaBrowser field here. But, to add this field to the event via mfaDeviceEventMetadata I would have to add proto to MFADevice that isn't really related to an MFA device, or I could change mfaDeviceEventMetadata to accept authData and change everywhere that uses this function. Any strong opinions on this?

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e3c7c2746d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ce7262614

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7dabf4b777

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9a119cc7c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b33fdd2ee3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4fa72ee04b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f9fa43310b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Joerger · 2026-03-25T18:36:39Z

+	}
+
+	// Verify this is a Browser MFA session and not an SSO MFA session.
+	if mfaSess.TSHRedirectURL == "" || mfaSess.ConnectorType != constants.BrowserMFA {


Should we add this same check in VerifySSOMFASession?

Joerger · 2026-03-25T19:16:24Z

accidental e ref update?

backport-bot-workflows · 2026-03-28T12:00:06Z

@danielashare See the table below for backport results.

Branch	Result
branch/v18	Failed

[Browser MFA] Add protobuf and config (#63831) [Browser MFA] Add proto for Browser MFA feature (#64048) [Browser MFA] Add CompleteBrowserMFAChallenge gRPC (#63873) [Browser MFA] Rename browser mfa config name (#64980) [Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#63945) [Browser MFA] Add Browser MFA to challenge request flow (#63936) [Browser MFA] Add initial requests for browser MFA process to client tools (#64301) [Browser MFA] Add tsh callback handling for webauthn response (#64461) [Browser MFA] Add Browser MFA to presence checks (#65052) [Browser MFA] Add browser MFA path to MFA finish flow (#64523) [Browser MFA] Add Browser MFA to Connect (#64887) [Browser MFA] Add Browser MFA UI (#64692) [Browser MFA] Fix formatting in moderated sessions (#65236) [Browser MFA] Add Browser MFA ceremony tests

[Browser MFA] Add protobuf and config (gravitational#63831) [Browser MFA] Add proto for Browser MFA feature (gravitational#64048) [Browser MFA] Add CompleteBrowserMFAChallenge gRPC (gravitational#63873) [Browser MFA] Rename browser mfa config name (gravitational#64980) [Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (gravitational#63945) [Browser MFA] Add Browser MFA to challenge request flow (gravitational#63936) [Browser MFA] Add initial requests for browser MFA process to client tools (gravitational#64301) [Browser MFA] Add tsh callback handling for webauthn response (gravitational#64461) [Browser MFA] Add Browser MFA to presence checks (gravitational#65052) [Browser MFA] Add browser MFA path to MFA finish flow (gravitational#64523) [Browser MFA] Add Browser MFA to Connect (gravitational#64887) [Browser MFA] Add Browser MFA UI (gravitational#64692) [Browser MFA] Fix formatting in moderated sessions (gravitational#65236) [Browser MFA] Add Browser MFA ceremony tests

danielashare self-assigned this Mar 11, 2026

danielashare added no-changelog Indicates that a PR does not require a changelog entry backport/branch/v18 labels Mar 11, 2026

github-actions Bot requested review from rudream and ryanclark March 11, 2026 16:54

github-actions Bot added the size/md label Mar 11, 2026

danielashare commented Mar 11, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Mar 11, 2026

View reviewed changes

Comment thread lib/auth/browser_mfa.go

Comment thread lib/auth/methods.go

chatgpt-codex-connector Bot reviewed Mar 13, 2026

View reviewed changes

Comment thread lib/auth/browser_mfa.go

Comment thread lib/auth/browser_mfa.go

danielashare force-pushed the danielashare/browser-mfa-login-finish branch from 8ce7262 to 84589cd Compare March 13, 2026 21:17

danielashare mentioned this pull request Mar 14, 2026

Browser MFA Feature #63987

Open

chatgpt-codex-connector Bot reviewed Mar 14, 2026

View reviewed changes

Comment thread lib/auth/browser_mfa.go

tigrato self-requested a review March 16, 2026 16:26

danielashare force-pushed the danielashare/browser-mfa-client-mfa-receive branch 2 times, most recently from 8d6f4eb to d8311c3 Compare March 23, 2026 15:06

danielashare force-pushed the danielashare/browser-mfa-login-finish branch from 7dabf4b to c9a119c Compare March 23, 2026 16:50

chatgpt-codex-connector Bot reviewed Mar 23, 2026

View reviewed changes

Comment thread lib/auth/browser_mfa.go

Comment thread lib/auth/browser_mfa.go

chatgpt-codex-connector Bot reviewed Mar 23, 2026

View reviewed changes

Comment thread lib/auth/auth.go

zmb3 reviewed Mar 24, 2026

View reviewed changes

Comment thread api/proto/teleport/legacy/types/events/events.proto

Comment thread lib/auth/browser_mfa.go Outdated

Comment thread lib/auth/browser_mfa.go Outdated

Comment thread lib/auth/browser_mfa.go Outdated

Comment thread lib/services/local/users.go

chatgpt-codex-connector Bot reviewed Mar 25, 2026

View reviewed changes

Comment thread lib/auth/browser_mfa.go Outdated

danielashare force-pushed the danielashare/browser-mfa-client-mfa-receive branch from f3b8de7 to f540b6f Compare March 25, 2026 15:24

chatgpt-codex-connector Bot reviewed Mar 25, 2026

View reviewed changes

Comment thread lib/client/sso/ceremony.go Outdated

zmb3 approved these changes Mar 25, 2026

View reviewed changes

danielashare force-pushed the danielashare/browser-mfa-client-mfa-receive branch 2 times, most recently from 8fc32c9 to c9fe8ce Compare March 26, 2026 22:04

Base automatically changed from danielashare/browser-mfa-client-mfa-receive to master March 27, 2026 07:59

danielashare force-pushed the danielashare/browser-mfa-login-finish branch from f9fa433 to bdcba07 Compare March 27, 2026 12:28

Joerger approved these changes Mar 27, 2026

View reviewed changes

public-teleport-github-review-bot Bot removed request for ryanclark and tigrato March 27, 2026 22:03

public-teleport-github-review-bot Bot removed the request for review from rudream March 27, 2026 22:03

[Browser MFA] Add browser MFA path to MFA finish flow

a12fb73

danielashare force-pushed the danielashare/browser-mfa-login-finish branch from 5ff3627 to a12fb73 Compare March 27, 2026 22:28

danielashare added this pull request to the merge queue Mar 28, 2026

Merged via the queue into master with commit 8812b53 Mar 28, 2026
45 checks passed

danielashare deleted the danielashare/browser-mfa-login-finish branch March 28, 2026 11:58

danielashare added a commit that referenced this pull request Mar 31, 2026

[Browser MFA] Add browser MFA path to MFA finish flow (#64523)

9d3f5e8

danielashare added a commit that referenced this pull request Apr 2, 2026

[Browser MFA] Add browser MFA path to MFA finish flow (#64523)

f0faef6

danielashare added a commit that referenced this pull request Apr 7, 2026

[Browser MFA] Add browser MFA path to MFA finish flow (#64523)

10df211

danielashare added a commit that referenced this pull request Apr 17, 2026

[Browser MFA] Add browser MFA path to MFA finish flow (#64523)

be94bae

mmcallister pushed a commit that referenced this pull request Apr 24, 2026

[Browser MFA] Add browser MFA path to MFA finish flow (#64523)

5e8bce0

mmcallister pushed a commit that referenced this pull request Apr 28, 2026

[Browser MFA] Add browser MFA path to MFA finish flow (#64523)

44d7116

danielashare added a commit that referenced this pull request Apr 30, 2026

[Browser MFA] Add browser MFA path to MFA finish flow (#64523)

f990b64

danielashare added a commit that referenced this pull request May 5, 2026

[Browser MFA] Add browser MFA path to MFA finish flow (#64523)

964b505

Conversation

danielashare commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Manual Test Plan

Test Environment

Test Cases

Uh oh!

danielashare Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Joerger Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Joerger Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

backport-bot-workflows Bot commented Mar 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

danielashare commented Mar 11, 2026 •

edited

Loading