Zac Bergquist
e174004612
We haven't been good about going back and marking RFDs as implemented, and it's helpful when looking at old designs to know if they ever made their way into the product.
2.9 KiB
authors, state
| authors | state |
|---|---|
| Lisa Kim ([email protected]) | implemented |
RFD 0111 - Support connection testers when per-session MFA is enabled
What
Add a MFAAuthenticateResponse field to GenerateUserCerts request.
Related issues
Why
As mentioned in the related issue, when a role or config has enabled the require_session_mfa field, users were not able to proceed testing connections to their newly added resource in the web UI, because we didn't implement a way for users to provide and authenticate their MFA device.
Details
The Test Connection feature requires establishing a brief session with the target resource which requires generating a short lived user certificate. If the require_mfa_session is enabled, the certs mfaVerified field must be set.
Upon testing, the mfaVerified field could potentially be set to any string value (and still be qualified as verified), so it's important how we set this field. By accepting a MFAAuthenticateResponse, the GenerateUserCerts request will be responsible for validating the response (if provided), and upon success will capture the verified MFA device ID which will be used to set the mfaVerified field. If validation failed, the request will return an authentication error.
How it relates to web UI
In the web UI, when a user clicks on the test connection button, we will make a call to this existing endpoint IsMFARequired that checks whether MFA is required to access the specified resource.
Then depending on the response:
- If MFA wasn't required, proceed to make a request to test connection as we did before
- If MFA is required, we will ask the user to enter their MFA credentials, take the response and send it off with the request to test connection