Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tsh attempts to relogin if mfa ceremony fails due to inactivity #35580

Closed
rosstimothy opened this issue Dec 8, 2023 · 0 comments · Fixed by #35581
Closed

tsh attempts to relogin if mfa ceremony fails due to inactivity #35580

rosstimothy opened this issue Dec 8, 2023 · 0 comments · Fixed by #35581
Labels
bug

Comments

@rosstimothy
Copy link
Contributor

When using per session mfa and connecting via tsh if the security key isn't tapped prior to the timeout from libfido tsh attempts to re-authenticate users instead of presenting them with an error.

[~]$ tsh ssh user@host
Tap any security key
### wait 30-40s here...

If browser window does not open automatically, open it by clicking on the link:
 http://127.0.0.1:61490/24e35ff2-a8de-469f-985f-8eed3ebc917a
ERROR: access denied to root connecting to host

This stems from racing direct and mfa connections and returning the error from the direct connection, making tsh think the problem was an access issue that might be resolved by re-authenticating. Any errors that are returned from the mfa ceremony should always be favored and returned to users.
@rosstimothy rosstimothy added the bug label Dec 8, 2023
rosstimothy added a commit that referenced this issue Dec 8, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails
431cc27 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
@rosstimothy rosstimothy mentioned this issue Dec 8, 2023
Merged
rosstimothy added a commit that referenced this issue Dec 11, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails
2787feb 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
rosstimothy added a commit that referenced this issue Dec 11, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails
da02578 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
github-merge-queue bot pushed a commit that referenced this issue Dec 14, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581)
435483e 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
rosstimothy added a commit that referenced this issue Dec 14, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581)
ad71434 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
rosstimothy added a commit that referenced this issue Dec 14, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581)
ef64c27 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
rosstimothy added a commit that referenced this issue Dec 14, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581)
3c6ed22 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
rosstimothy added a commit that referenced this issue Dec 14, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581)
4ab636d 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
rosstimothy added a commit that referenced this issue Dec 14, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581)
ebbe2d5 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
rosstimothy added a commit that referenced this issue Dec 14, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581)
7f42a60 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
rosstimothy added a commit that referenced this issue Dec 14, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581)
1009bcf 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
rosstimothy added a commit that referenced this issue Dec 14, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581)
b5f98ef 
Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
github-merge-queue bot pushed a commit that referenced this issue Dec 19, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581) (
70b5b27 
#35751)

Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
github-merge-queue bot pushed a commit that referenced this issue Dec 19, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581) (
1f9efb8 
#35750)

Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
github-merge-queue bot pushed a commit that referenced this issue Dec 19, 2023
@rosstimothy
Return the correct errors to users when an mfa ceremony fails (#35581) (
096e728 
#35752)

Errors returned from the mfa prompt are now wrapped to allow them
to be differentiated and acted upon accordingly by callers. No
further processing of the error is required in this change, the code
that examines the errors will already do the right thing.

Fixes #35580.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Return the correct errors to users when an mfa ceremony fails gravitational/teleport
1 participant
@rosstimothy