From 90eed993b69042f61a4f732bcaa5ddcef75fa7f3 Mon Sep 17 00:00:00 2001 From: Brian Joerger Date: Wed, 15 Jan 2025 18:21:20 -0800 Subject: [PATCH] Add SSO MFA test plan. (#51051) --- .github/ISSUE_TEMPLATE/testplan.md | 31 ++++++++++++++++++++++++++- .github/ISSUE_TEMPLATE/webtestplan.md | 2 +- 2 files changed, 31 insertions(+), 2 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/testplan.md b/.github/ISSUE_TEMPLATE/testplan.md index 7c3a507b43a..133a736752f 100644 --- a/.github/ISSUE_TEMPLATE/testplan.md +++ b/.github/ISSUE_TEMPLATE/testplan.md @@ -1644,6 +1644,35 @@ Verify SAML IdP service provider resource management. - [ ] Verify that when a SAML resource is created with preset value `preset: gcp-workforce`, Teleport adds relay state `relay_state: https://console.cloud.google/` value in the resulting resource spec. +## SSO MFA + +Verify SSO MFA core functionality. The tests below should be performed once +with OIDC and once with SAML. + +Configure both an OIDC connector and a SAML connector following the [Quick GitHub/SAML/OIDC Setup Tips] +and [enable MFA on them](https://goteleport.com/docs/ver/17.x/admin-guides/access-controls/sso/#configuring-sso-for-mfa-checks). + +For simplicity, you can use the same IdP App (client id/secret or entity descriptor) +for both login and MFA. This way, each Teleport MFA check will make you re-login via SSO. + +Ensure [SSO is allowed as a second factor](https://goteleport.com/docs/ver/17.x/admin-guides/access-controls/sso/#allowing-sso-as-an-mfa-method-in-your-cluster). +e.g. `cap.second_factors: ['webauthn', 'sso']`. + +The following should work with SSO MFA, automatically opening the SSO MFA redirect URL: + +- [ ] `tsh mfa ls` should display the SSO MFA device. + - [ ] SSO MFA device cannot be deleted or added +- [ ] Add another MFA device (`tsh mfa add`) +- [ ] Delete the other MFA device (`tsh --mfa-mode=sso mfa rm`) +- [ ] Moderated Sessions +- [ ] Admin Actions (e.g. `tctl tokens ls`) +- [ ] Per-session MFA + - [ ] Server Access + - [ ] File Transfers + - [ ] Kubernetes Access + - [ ] App Access + - [ ] Database Access + - [ ] Desktop Access ## Resources @@ -1652,4 +1681,4 @@ Verify SAML IdP service provider resource management. -[Quick GitHub/SAML/OIDC Setup Tips]: https://gravitational.slab.com/posts/quick-git-hub-saml-oidc-setup-6dfp292a +[Quick GitHub/SAML/OIDC Setup Tips]: https://www.notion.so/goteleport/Quick-SSO-setup-fb1a64504115414ca50a965390105bee diff --git a/.github/ISSUE_TEMPLATE/webtestplan.md b/.github/ISSUE_TEMPLATE/webtestplan.md index 5ef007db632..2537523d9fe 100644 --- a/.github/ISSUE_TEMPLATE/webtestplan.md +++ b/.github/ISSUE_TEMPLATE/webtestplan.md @@ -823,7 +823,7 @@ Add the following to enable read access to trusted clusters - [Authentication connectors](https://goteleport.com/docs/setup/reference/authentication/#authentication-connectors): - For those you might want to use clusters that are deployed on the web, specified in parens. Or set up the connectors on a local enterprise cluster following [the guide from - our wiki](https://gravitational.slab.com/posts/quick-git-hub-saml-oidc-setup-6dfp292a). + our wiki](https://www.notion.so/goteleport/Quick-SSO-setup-fb1a64504115414ca50a965390105bee). - [ ] GitHub (asteroid) - [ ] SAML (platform cluster) - [ ] OIDC (e-demo)