disconnect_expired_cert: yes and require_session_mfa: yes can't harmoniously exist on one cluster

[ibeckermayer]

If an auth service has both disconnect_expired_cert and require_session_mfa enabled, users are consistently kicked out of their sessions after about a minute (across features). The issue is that with per-session mfa we typically issue 1 minute-lived certs per session, which disconnect_expired_cert then identifies as expired and boots the user out.

The proposed solution is that some metadata can be added to the MFA cert that contains the original TTL of the user cert that made the request. New sessions using the MFA cert can still be denied based on the MFA cert TTL, but existing sessions can be closed based on the original TTL of the user cert when disconnected_expired_certs is enabled and the original TTL of the user cert is present. (credit to @dboslee for this proposal).

[ibeckermayer]

@claudioscalzo @daquinoaldo do you know which major version of teleport you're using (v11/v10/v9)?

[daquinoaldo]

@ibeckermayer, CLI v11, Agent v10, Cloud cluster v10 (it should auto-update soon to v11 as per Agent documentation, then we will bump agents).

[daquinoaldo]

@ibeckermayer could you ping me when you release it on v10/v11?

[ibeckermayer]

@daquinoaldo v11's backport is merged and so this will available in the next release. I'm planning to get v10 merged today and so it should be in the next v10 release.

v10 and v11 backports are merged so the fix will be in the next release. There will be a bullet point in the respective release notes to confirm.

[daquinoaldo]

Thank you