[Browser MFA] Rename browser mfa config name by danielashare · Pull Request #64980 · gravitational/teleport

danielashare · 2026-03-24T12:26:52Z

Deprecate AllowBrowserAuthentication and add AllowCLIAuthViaBrowser to replace it, to make it clearer to the user what is being enabled.

Manual Test Plan

Test Environment

Running local Teleport

Test Cases

WebAuthn enabled, Browser MFA unspecified enables Browser MFA
WebAuthn disabled, Browser MFA enabled causes an error

github-actions · 2026-03-24T12:28:16Z

Amplify deployment status

Branch	Commit	Job ID	Status	Preview	Updated (UTC)
danielashare/browser-mfa-config-rename	`b0d6bf6`	13	✅SUCCEED	danielashare-browser-mfa-config-rename	2026-03-25 22:03:08

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f2d190e283

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b00c76f40

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aebf3d0c76

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c8099c5a40

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

codingllama · 2026-03-25T18:05:14Z

-  // When set to false, authentication flows that require a browser will be disabled.
-  // Defaults to true.
  BoolValue AllowBrowserAuthentication = 23 [
+    deprecated = true,


Just a heads up that deprecations can break e/ if the field is used there, due to failing linters. (Not a problem if it's only used in OSS.)

Thankfully it isn't used by e

codingllama · 2026-03-25T18:05:51Z

  // authenticating CLI sessions.
-  // When set to false, authentication flows that require a browser will be disabled.
-  // Defaults to true.
  BoolValue AllowBrowserAuthentication = 23 [


Could we delete/reserve this instead?

+1, I would just remove this completely, and then add

reserve 23; reserve AllowBrowserAuthentication;

Like Alan said, we can go a step further and just reuse message 23 for AllowCLIAuthViaBrowser since there is no releases depending on it.

I would just do the new tag. Reusing means a whole lot of fighting with the breaking changes linter, which is likely not worth it to save a single tag number. When Dan I discussed this out-of-band I suggested him to follow the "normal" deprecation process.

Thanks guys, I've gone the reserve route to get rid of this field

codingllama · 2026-03-25T18:08:33Z

+	if c.Spec.AllowCLIAuthViaBrowser != nil {
+		return c.Spec.AllowCLIAuthViaBrowser.Value


If this wasn't part of an active release we can delete the old field and "replace" it with the new one.

If it were part of an active release then it's a different conversation.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b9519c906c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-25T21:50:43Z

-  BoolValue AllowBrowserAuthentication = 23 [
+  // Defaults to true if the Webauthn is configured, defaults to false
+  // otherwise.
+  BoolValue AllowCLIAuthViaBrowser = 24 [


Keep AuthPreference protobuf tag stable for browser auth

Changing AllowCLIAuthViaBrowser to protobuf field 24 (while reserving 23) breaks binary compatibility for mixed-version clients and servers that still send AllowBrowserAuthentication on tag 23 through clusterconfigv1 gRPC (Get/Update/UpsertAuthPreference use types.AuthPreferenceV2). Fresh evidence: this commit now reserves tag 23, so legacy values can no longer populate a known field and GetAllowCLIAuthViaBrowser() falls back to the WebAuthn-derived default, which can silently re-enable browser-based CLI auth after upgrade.

Useful? React with 👍 / 👎.

backport-bot-workflows · 2026-03-26T09:22:25Z

@danielashare See the table below for backport results.

Branch	Result
branch/v18	Failed

[Browser MFA] Add protobuf and config (#63831) [Browser MFA] Add proto for Browser MFA feature (#64048) [Browser MFA] Add CompleteBrowserMFAChallenge gRPC (#63873) [Browser MFA] Rename browser mfa config name (#64980) [Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (#63945) [Browser MFA] Add Browser MFA to challenge request flow (#63936) [Browser MFA] Add initial requests for browser MFA process to client tools (#64301) [Browser MFA] Add tsh callback handling for webauthn response (#64461) [Browser MFA] Add Browser MFA to presence checks (#65052) [Browser MFA] Add browser MFA path to MFA finish flow (#64523) [Browser MFA] Add Browser MFA to Connect (#64887) [Browser MFA] Add Browser MFA UI (#64692) [Browser MFA] Fix formatting in moderated sessions (#65236) [Browser MFA] Add Browser MFA ceremony tests

[Browser MFA] Add protobuf and config (gravitational#63831) [Browser MFA] Add proto for Browser MFA feature (gravitational#64048) [Browser MFA] Add CompleteBrowserMFAChallenge gRPC (gravitational#63873) [Browser MFA] Rename browser mfa config name (gravitational#64980) [Browser MFA] Add BrowserMFARequestID to CreateAuthenticateChallenge (gravitational#63945) [Browser MFA] Add Browser MFA to challenge request flow (gravitational#63936) [Browser MFA] Add initial requests for browser MFA process to client tools (gravitational#64301) [Browser MFA] Add tsh callback handling for webauthn response (gravitational#64461) [Browser MFA] Add Browser MFA to presence checks (gravitational#65052) [Browser MFA] Add browser MFA path to MFA finish flow (gravitational#64523) [Browser MFA] Add Browser MFA to Connect (gravitational#64887) [Browser MFA] Add Browser MFA UI (gravitational#64692) [Browser MFA] Fix formatting in moderated sessions (gravitational#65236) [Browser MFA] Add Browser MFA ceremony tests

danielashare self-assigned this Mar 24, 2026

danielashare added no-changelog Indicates that a PR does not require a changelog entry backport/branch/v18 labels Mar 24, 2026

danielashare temporarily deployed to docs-amplify March 24, 2026 12:26 — with GitHub Actions Inactive

github-actions Bot requested review from bernardjkim, hugoShaka, marcoandredinis, mmcallister, ptgott, r0mant, tigrato and zmb3 March 24, 2026 12:27

github-actions Bot added documentation size/sm labels Mar 24, 2026

chatgpt-codex-connector Bot reviewed Mar 24, 2026

View reviewed changes

Comment thread lib/config/fileconf.go Outdated

Comment thread api/proto/teleport/legacy/types/types.proto Outdated

danielashare force-pushed the danielashare/browser-mfa-config-rename branch from f2d190e to 3b00c76 Compare March 24, 2026 14:48

danielashare temporarily deployed to docs-amplify March 24, 2026 14:48 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Mar 24, 2026

View reviewed changes

Comment thread integrations/terraform/tfschema/types_terraform.go Outdated

danielashare force-pushed the danielashare/browser-mfa-config-rename branch from 3b00c76 to b5005f9 Compare March 24, 2026 16:57

danielashare temporarily deployed to docs-amplify March 24, 2026 16:57 — with GitHub Actions Inactive

danielashare mentioned this pull request Mar 24, 2026

Browser MFA Feature #63987

Open

danielashare force-pushed the danielashare/browser-mfa-config-rename branch from b5005f9 to aebf3d0 Compare March 24, 2026 17:20

danielashare temporarily deployed to docs-amplify March 24, 2026 17:20 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Mar 24, 2026

View reviewed changes

Comment thread integrations/terraform/tfschema/types_terraform.go

danielashare force-pushed the danielashare/browser-mfa-config-rename branch from aebf3d0 to c8099c5 Compare March 24, 2026 17:53

danielashare had a problem deploying to docs-amplify March 24, 2026 17:53 — with GitHub Actions Error

chatgpt-codex-connector Bot reviewed Mar 24, 2026

View reviewed changes

Comment thread api/proto/teleport/legacy/types/types.proto

danielashare force-pushed the danielashare/browser-mfa-config-rename branch from c8099c5 to 6edf70c Compare March 24, 2026 18:04

danielashare had a problem deploying to docs-amplify March 24, 2026 18:04 — with GitHub Actions Error

codingllama reviewed Mar 25, 2026

View reviewed changes

danielashare force-pushed the danielashare/browser-mfa-config-rename branch from 2baa264 to b9519c9 Compare March 25, 2026 21:46

chatgpt-codex-connector Bot reviewed Mar 25, 2026

View reviewed changes

[Browser MFA] Rename browser mfa config name

b0d6bf6

danielashare force-pushed the danielashare/browser-mfa-config-rename branch from b9519c9 to b0d6bf6 Compare March 25, 2026 21:57

danielashare temporarily deployed to docs-amplify March 25, 2026 21:57 — with GitHub Actions Inactive

codingllama approved these changes Mar 25, 2026

View reviewed changes

Joerger approved these changes Mar 25, 2026

View reviewed changes

public-teleport-github-review-bot Bot removed request for hugoShaka, marcoandredinis, mmcallister, ptgott, r0mant and tigrato March 25, 2026 22:48

danielashare added this pull request to the merge queue Mar 26, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Mar 26, 2026

danielashare added this pull request to the merge queue Mar 26, 2026

Merged via the queue into master with commit 50e1ca5 Mar 26, 2026
46 checks passed

danielashare deleted the danielashare/browser-mfa-config-rename branch March 26, 2026 09:20

danielashare added a commit that referenced this pull request Mar 31, 2026

[Browser MFA] Rename browser mfa config name (#64980)

1d05b4d

danielashare added a commit that referenced this pull request Apr 2, 2026

[Browser MFA] Rename browser mfa config name (#64980)

21307e5

danielashare added a commit that referenced this pull request Apr 7, 2026

[Browser MFA] Rename browser mfa config name (#64980)

ce44104

danielashare added a commit that referenced this pull request Apr 17, 2026

[Browser MFA] Rename browser mfa config name (#64980)

0bc589b

mmcallister pushed a commit that referenced this pull request Apr 28, 2026

[Browser MFA] Rename browser mfa config name (#64980)

837a77f

danielashare added a commit that referenced this pull request Apr 30, 2026

[Browser MFA] Rename browser mfa config name (#64980)

73cf202

danielashare added a commit that referenced this pull request May 5, 2026

[Browser MFA] Rename browser mfa config name (#64980)

0b9755a

		if c.Spec.AllowCLIAuthViaBrowser != nil {
		return c.Spec.AllowCLIAuthViaBrowser.Value

Conversation

danielashare commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Manual Test Plan

Test Environment

Test Cases

Uh oh!

github-actions Bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

backport-bot-workflows Bot commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

danielashare commented Mar 24, 2026 •

edited

Loading

github-actions Bot commented Mar 24, 2026 •

edited

Loading