Multi-session MFA for database access

[r0mant]

A customer is looking for multi-session MFA - a relaxed version of per-session MFA. If this setting is on in RBAC, tsh mysql run --env=labels <command>, asks for MFA tap, runs command on multiple hosts, asks for each multi-command execution.

[milos-teleport]

Somewhat related #52352

In the ticket I linked, Instead of tsh mysql, the existing tsh db connect which already detects the correct database client could be extended to support extra, arbitrary, parameters. This simplifies our implementation, reduces the chance of bugs and allows the greatest level of flexibility to the user.

This, current, ticket aside dealing with per-session MFA (which tsh db connect already supports), also has the component of running the client on multiple databases based on the tags. Because of this added complexity on this request, I feel the related ticket is doubly-so worth considering, as well as merging both tickets into one, if it makes sense.

Using something like tsh mysql (MFA or not), does allow for a much easier usage, but my concern is that it might be more difficult to implement.

[milos-teleport]

Hi @greedy52 thank you for the RFD and your work!

Reading the RFD:

Prompt MFA:

• If per-session MFA is required.
• Or, if first time requesting MFA for multi-session or shared multi-session response is expired.
• No MFA if not required.

Just to confirm this due to a customer query: tsh db exec will not explicitly require MFA. Is this a correct statement?

[greedy52]

Hi @greedy52 thank you for the RFD and your work!

Reading the RFD:

Prompt MFA:

• If per-session MFA is required.
• Or, if first time requesting MFA for multi-session or shared multi-session response is expired.
• No MFA if not required.

Just to confirm this due to a customer query: tsh db exec will not explicitly require MFA. Is this a correct statement?

First of all, the RFD is yet to be discussed so certain things may change. But at least on the MFA side, 100% no MFA prompt if MFA is not required.