Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for Hardware Key PIN #31743

Merged
merged 14 commits into from Oct 13, 2023
Merged

Add support for Hardware Key PIN #31743

merged 14 commits into from Oct 13, 2023

Conversation

Joerger
Copy link
Contributor

@Joerger Joerger commented Sep 12, 2023

I recommend reviewing commit by commit.

Changes:

  • Update RFD 80 to cover changes below
  • Simplify policy/mfa logic to make the changes below smaller
  • Add require MFA types hardware_key_pin and hardware_key_touch. Like the existing hardware_key_touch, these types count as a replacement for MFA verification for per-session MFA and admin actions MFA.
  • Add support for PIV pin policies:
    • Prompt for PIN when needed
    • Require user pins to be non-default - prompt for new PIN when the default is given by the user.

Based off of #32275

@Joerger Joerger changed the base branch from joerger/refactor-hardware-key-mfa-verification to joerger/piv-pin-policy-base September 12, 2023 01:36
@Joerger Joerger force-pushed the joerger/piv-pin-policy branch 2 times, most recently from 4a5c870 to e9775e2 Compare September 15, 2023 02:17
@Joerger Joerger marked this pull request as ready for review September 15, 2023 02:23
@github-actions github-actions bot added rfd Request for Discussion size/md tsh tsh - Teleport's command line tool for logging into nodes running Teleport. labels Sep 15, 2023
@Joerger Joerger force-pushed the joerger/piv-pin-policy branch 4 times, most recently from 56efe16 to 0b7b62a Compare September 15, 2023 21:05
@Joerger Joerger force-pushed the joerger/piv-pin-policy branch 2 times, most recently from 32f914a to 157792b Compare September 20, 2023 01:28
@Joerger Joerger force-pushed the joerger/piv-pin-policy branch 2 times, most recently from e11026a to 157a6f7 Compare September 21, 2023 00:01
@Joerger Joerger changed the base branch from joerger/piv-pin-policy-base to joerger/custom-piv-slot September 27, 2023 19:58
@Joerger Joerger removed the request for review from klizhentas September 27, 2023 19:59
@Joerger Joerger added this pull request to the merge queue Oct 13, 2023
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Oct 13, 2023
@Joerger Joerger added this pull request to the merge queue Oct 13, 2023
Merged via the queue into master with commit c0b3299 Oct 13, 2023
34 checks passed
@Joerger Joerger deleted the joerger/piv-pin-policy branch October 13, 2023 19:26
Joerger added a commit that referenced this pull request Oct 13, 2023
Joerger added a commit that referenced this pull request Oct 13, 2023
Joerger added a commit that referenced this pull request Oct 14, 2023
* Add support for Hardware Key PIN (#31743)

* Enable hardware key support in the WebUI (#33483)
Joerger added a commit that referenced this pull request Oct 14, 2023
* Add support for Hardware Key PIN (#31743)

* Enable hardware key support in the WebUI (#33483)
Joerger added a commit that referenced this pull request Oct 16, 2023
* Add support for Hardware Key PIN (#31743)

* Enable hardware key support in the WebUI (#33483)
Joerger added a commit that referenced this pull request Oct 16, 2023
* Add support for Hardware Key PIN (#31743)

* Enable hardware key support in the WebUI (#33483)
github-merge-queue bot pushed a commit that referenced this pull request Oct 16, 2023
…33353)

* Remove deprecate function; update e ref. (#32275)

* [v14] Add support for Hardware Key PIN and WebUI (#33478)

* Add support for Hardware Key PIN (#31743)

* Enable hardware key support in the WebUI (#33483)
smallinsky pushed a commit that referenced this pull request Oct 17, 2023
* Update RFD with hardware key pin policies.

* Consolidate policy logic and update tests.

* Add pin private key policies; Make PIV PIN/Touch prompts work together.

* Prompt user to set pin/puk from default.

* Handle unexpected PIN auth errors.

* Resolve RFD password prompt comment.

* Handle incompatible private key policy in role sets (future-proof).

* Resolve comment on require mfa type string godocs and tests.

* A satisfying change.

* Address PIN/PUK prompt comments and other code suggestions.

* Resolve comments.

* Fix test that prompts for pin twice.

* Fix test.
smallinsky pushed a commit that referenced this pull request Oct 17, 2023
* Update RFD with hardware key pin policies.

* Consolidate policy logic and update tests.

* Add pin private key policies; Make PIV PIN/Touch prompts work together.

* Prompt user to set pin/puk from default.

* Handle unexpected PIN auth errors.

* Resolve RFD password prompt comment.

* Handle incompatible private key policy in role sets (future-proof).

* Resolve comment on require mfa type string godocs and tests.

* A satisfying change.

* Address PIN/PUK prompt comments and other code suggestions.

* Resolve comments.

* Fix test that prompts for pin twice.

* Fix test.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
rfd Request for Discussion size/md tsh tsh - Teleport's command line tool for logging into nodes running Teleport.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants