[v12] Fix issuing credentials for non SSH protocols #25430
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When MFA is not required for protocols other than SSH `tsh` needs to fallback to reissuing certificates without MFA instead of preventing access. Closes #25419
rosstimothy
changed the title
rosstimothy
commented
May 1, 2023
Comment on lines
545
to
+554
| if !check.Required { | ||
| return nil, trace.Wrap(services.ErrSessionMFANotRequired) | ||
| log.Debug("MFA not required for access.") | ||
| // MFA is not required. | ||
| // SSH certs can be used without embedding the node name. | ||
| if params.usage() == proto.UserCertsRequest_SSH && key.Cert != nil { | ||
| return key, nil | ||
| } | ||
| // All other targets need their name embedded in the cert for routing, | ||
| // fall back to non-MFA reissue. | ||
| return proxy.reissueUserCerts(ctx, CertCacheKeep, params) |
There was a problem hiding this comment.
This now matches the behavior on branch/v13 and master:
Lines 499 to 509 in a0773f9
r0mant
approved these changes
May 1, 2023
zmb3
approved these changes
May 1, 2023
rosstimothy
added a commit
that referenced
this pull request
May 8, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When MFA is not required for protocols other than SSH
tshneeds to fallback to reissuing certificates without MFA instead of preventing access.Closes #25419
Note: This applies directly to v12 and is not a backport. The issue only exists on branch/v12 and branch/v11 due to incorrectly backporting the logic in #24250 to these branches.