Chris ThachandZac Bergquist 918f1a4e71 Store ValidatedMFAChallenge resource after successful MFA challenge validation (#62494) ...

* Add ValidatedMFAChallenge backend storage service and wire to MFA gRPC service to store on create/validate MFA challenge.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Rename to just local.MFAService. More polish.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Refactor for begin SSO to use params struct.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Ensure target cluster is valid. Add more test coverage. Improve consistency.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Make consistent.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Fixed wrong refs.

* Add backend MFA service for managing MFA resources.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Extract backend MFA service.

* Address comments from peer review.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Use cmp.Diff for comparing want and got.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Apply suggestions from code review

* Apply suggestions from code review

Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>

* Remove non-idiomatic ctx nil check.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Remove alias in comment.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Remove fake clock.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Remove testing t param. Fix missing whitespace before package.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Simplify and use proto.Clone.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Use assert to keep tests going after failure.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Create sso.go. Remove redundant user comment. Use authz.MFAAuthData for consistency.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Verify challenge is stored after validate.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Make challenge construction more readable. Simplify tests and use helpers.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Split emit audit event into helper to simplify.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Use GetRemoteCluster to simplify.

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Clean up and polish

Signed-off-by: Chris Thach <chris.thach@goteleport.com>

* Apply suggestions from code review

Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>

---------

Signed-off-by: Chris Thach <chris.thach@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>

2026-01-09 15:42:38 +00:00

..

accessmonitoringrules/accessmonitoringrulesv1

Modernize lib/auth and lib/utils (#55976)

2025-06-22 10:53:52 +00:00

accesspoint

Add app auth config backend service (#61688)

2025-12-03 23:09:01 +00:00

appauthconfig/appauthconfigv1

Add app auth config backend service (#61688)

2025-12-03 23:09:01 +00:00

authcatest

Add strict CA checks on newKeySet() and address test code duplication (#62177)

2025-12-12 18:08:26 +00:00

authclient

expose instance inventory to client and add web endpoint (#61657)

2025-12-19 17:48:54 +00:00

authtest

Allow nodes to join the cluster based on their AWS Organization (#62023)

2026-01-08 10:46:16 +00:00

autoupdate/autoupdatev1

MWI: Add /webapi/.../machine-id/bot-instance/metrics endpoint (#59896)

2025-10-08 09:47:34 +00:00

clusterconfig/clusterconfigv1

Add missing handling for recording encryption configs and keys (#57279)

2025-08-13 15:14:20 +00:00

crownjewel

Bump golangci-lint to v2 (#54410)

2025-05-07 22:14:51 +00:00

dbobject/dbobjectv1

Modernize lib/auth and lib/utils (#55976)

2025-06-22 10:53:52 +00:00

dbobjectimportrule/dbobjectimportrulev1

Modernize lib/auth and lib/utils (#55976)

2025-06-22 10:53:52 +00:00

discoveryconfig/discoveryconfigv1

AWS EC2 Discovery: discover in all enabled regions (#61337)

2025-12-02 13:12:12 +00:00

dynamicwindows/dynamicwindowsv1

Update several admin actions to allow reusable MFA challenges (#49095)

2024-11-19 18:56:32 +00:00

gitserver/gitserverv1

Add paginated ListAuthServers/ListProxies (#61702)

2025-12-12 21:42:28 +00:00

healthcheckconfig/healthcheckconfigv1

Enable health checks for Kubernetes with virtual defaults (#60544)

2025-10-27 17:19:06 +00:00

integration

Add paginated ListAuthServers/ListProxies (#61702)

2025-12-12 21:42:28 +00:00

inventory/inventoryv1

implement inventorycache for instances (#60535)

2025-12-01 18:49:08 +00:00

join

support new AWS asia regions with IAM join method (#62593)

2026-01-05 22:31:21 +00:00

keygen

Remove (auth.Server) SetClock (#60526)

2025-10-29 15:19:44 +00:00

keystore

keystore: add active health checker (#61962)

2026-01-05 15:35:08 +00:00

kubewaitingcontainer/kubewaitingcontainerv1

Modernize lib/auth and lib/utils (#55976)

2025-06-22 10:53:52 +00:00

loginrule/loginrulev1

Unify naming and location of auth RPC services (#46559)

2024-09-12 22:34:58 +00:00

machineid

Fix issuance of wildcard DNS SANs for X509 SVIDs (#62665)

2026-01-07 11:30:55 +00:00

mfa/mfav1

Store ValidatedMFAChallenge resource after successful MFA challenge validation (#62494)

2026-01-09 15:42:38 +00:00

mfatypes

Store ValidatedMFAChallenge resource after successful MFA challenge validation (#62494)

2026-01-09 15:42:38 +00:00

migration

Introduce logtest package (#56741)

2025-07-15 18:11:10 +00:00

mocku2f

Changes to support login loadtest agent (#62075)

2025-12-15 12:46:21 +00:00

moderation

feat: expand Session recording RBAC support (#58114)

2025-08-29 19:17:50 +00:00

notifications/notificationsv1

Deflake TestCreateAccessListReminderNotifications (#61826)

2025-12-02 16:26:08 +00:00

okta

Okta: Don't allow creating user_group Access Request in RO (#55420)

2025-06-10 11:09:04 +00:00

presence/presencev1

Close auth servers in tests (#62051)

2025-12-14 20:48:53 +00:00

recordingencryption

support session metadata generation for encrypted sessions (#60838)

2025-11-03 12:12:03 +00:00

recordingmetadata

support session metadata generation for encrypted sessions (#60838)

2025-11-03 12:12:03 +00:00

scopes

moving scoped token secret into the scoped token spec in order to make the resource (#62112)

2026-01-05 18:53:19 +00:00

secreports/secreportsv1

Register unimplemented secreportsv1 RPC service in OSS builds (#55056)

2025-05-22 16:30:33 +00:00

stableunixusers

Introduce logtest package (#56741)

2025-07-15 18:11:10 +00:00

state

adding support for scoped joining of SSH nodes using dynamic tokens (#60362)

2025-10-28 22:00:18 +00:00

storage

use new join service for host joins (#59778)

2025-10-15 18:48:04 +00:00

summarizer

Expose a flag that tells if session summarizer is enabled (#57992)

2025-08-20 17:04:12 +00:00

testauthority

Add host fields and protos for ssh identities (#51024)

2025-01-27 18:51:37 +00:00

touchid

Modernize lib/auth and lib/utils (#55976)

2025-06-22 10:53:52 +00:00

trust/trustv1

scoped access resource verbs (#60066)

2025-10-28 19:10:58 +00:00

userloginstate

Extend user_login_state with SAML connector info and grants (#58581)

2025-12-10 17:20:55 +00:00

userpreferences/userpreferencesv1

Convert auth rpc services to use slog (#50513)

2024-12-20 20:28:23 +00:00

userprovisioning/userprovisioningv2

feat: expand Session recording RBAC support (#58114)

2025-08-29 19:17:50 +00:00

users/usersv1

Include roles in server side match for users (#62466)

2025-12-23 19:25:21 +00:00

usertasks/usertasksv1

WebAPI: Add state as filter for UserTasks listing endpoint (#52191)

2025-02-20 09:24:06 +00:00

vnetconfig/vnetconfigv1

add vnet config audit events (#62383)

2026-01-03 01:02:10 +00:00

webauthn

Store ValidatedMFAChallenge resource after successful MFA challenge validation (#62494)

2026-01-09 15:42:38 +00:00

webauthncli

Bump golangci-lint to v2 (#54410)

2025-05-07 22:14:51 +00:00

webauthntypes

Store ValidatedMFAChallenge resource after successful MFA challenge validation (#62494)

2026-01-09 15:42:38 +00:00

webauthnwin

fix: Set the security-key hint when using cross-platform mode on Windows (#62105)

2025-12-10 13:10:49 +00:00

access_request_test.go

Refactor auth test helpers (#56491)

2025-07-21 17:32:26 +00:00

access_test.go

Remove (auth.Server) SetClock (#60526)

2025-10-29 15:19:44 +00:00

access.go

Adds Conditional Update support for Access Lists with members (#60309)

2025-10-28 23:37:02 +00:00

accountrecovery_test.go

Add paginated ListAuthServers/ListProxies (#61702)

2025-12-12 21:42:28 +00:00

accountrecovery.go

Modernize lib/auth and lib/utils (#55976)

2025-06-22 10:53:52 +00:00

apiserver_test.go

Add paginated ListAuthServers/ListProxies (#61702)

2025-12-12 21:42:28 +00:00

apiserver.go

Add paginated ListAuthServers/ListProxies (#61702)

2025-12-12 21:42:28 +00:00

app_access_aws_credentials.go

Fix AWS CLI access using AWS OIDC integration (#57843)

2025-08-15 00:04:24 +00:00

auth_iamjoin_organizations_test.go

Allow nodes to join the cluster based on their AWS Organization (#62023)

2026-01-08 10:46:16 +00:00

auth_login_test.go

fix flaky scoped login test (#62221)

2025-12-15 20:23:33 +00:00

auth_test.go

Re-introduce access list read rate limiting (#62670)

2026-01-07 17:42:48 +00:00

auth_with_roles_okta_rbac_test.go

Refactor auth test helpers (#56491)

2025-07-21 17:32:26 +00:00

auth_with_roles_test.go

Close auth servers in tests (#62051)

2025-12-14 20:48:53 +00:00

auth_with_roles.go

Add support to sign MCP egress JWT with OIDC CA (#62043)

2026-01-02 15:16:23 +00:00

auth.go

Store ValidatedMFAChallenge resource after successful MFA challenge validation (#62494)

2026-01-09 15:42:38 +00:00

autoupdate_agent_version_report_test.go

Introduce logtest package (#56741)

2025-07-15 18:11:10 +00:00

autoupdate_agent_version_report.go

autoupdate canary support: inventory and auth primitives (#56261)

2025-07-03 19:36:35 +00:00

autoupdate_rollout_test.go

Fix autoupdate canary sampling for the catch-all group (#57035)

2025-07-22 16:36:39 +00:00

autoupdate_rollout.go

Fix autoupdate canary sampling for the catch-all group (#57035)

2025-07-22 16:36:39 +00:00

bot_test.go

Azure method support in new join service (#61129)

2025-12-10 18:40:33 +00:00

bot.go

core scope pinning logic (#58377)

2025-10-01 20:30:50 +00:00

bound_keypair_tokens.go

feat: bound keypair support in new join service (#58963)

2025-10-01 19:48:51 +00:00

client_tls_config_generator.go

verify cluster name of TLS peer certificates (#52128)

2025-02-13 21:25:52 +00:00

db_test.go

winpki: prevent CRL common names from overflowing (#57867)

2025-08-14 15:52:55 +00:00

db.go

Make crlKeyName strict (#62369)

2025-12-18 20:35:15 +00:00

desktop_test.go

Remove (auth.Server) SetClock (#60526)

2025-10-29 15:19:44 +00:00

desktop.go

Make crlKeyName strict (#62369)

2025-12-18 20:35:15 +00:00

export_test.go

Add paginated ListAuthServers/ListProxies (#61702)

2025-12-12 21:42:28 +00:00

externalauditstorage.go

Fix EAS Token generation (#40154)

2024-04-05 13:06:03 +00:00

github_test.go

MWI: Generate AutoUpdateBotInstanceReport resource (#59738)

2025-10-07 14:32:36 +00:00

github.go

Scopes: Pin SSO logins via tsh login (#61576)

2025-12-12 23:19:18 +00:00

grpcserver_test.go

Close auth servers in tests (#62051)

2025-12-14 20:48:53 +00:00

grpcserver.go

Store ValidatedMFAChallenge resource after successful MFA challenge validation (#62494)

2026-01-09 15:42:38 +00:00

init_test.go

Close auth servers in tests (#62051)

2025-12-14 20:48:53 +00:00

init.go

Allow nodes to join the cluster based on their AWS Organization (#62023)

2026-01-08 10:46:16 +00:00

join_azure_devops.go

azure devops support in new join service (#61545)

2025-11-21 17:13:10 +00:00

join_azure_legacy.go

Azure method support in new join service (#61129)

2025-12-10 18:40:33 +00:00

join_bitbucket.go

Port bitbucket join method to the new join service (#61082)

2025-11-08 00:50:04 +00:00

join_bound_keypair_adapter.go

feat: bound keypair support in new join service (#58963)

2025-10-01 19:48:51 +00:00

join_bound_keypair_test.go

port bound keypair tests to new join service (#59512)

2025-10-08 18:42:52 +00:00

join_circleci.go

Port circleci join method to new join service (#61130)

2025-11-18 02:42:24 +00:00

join_ec2.go

feat: EC2 method support in new join service (#60385)

2025-10-23 21:58:20 +00:00

join_env0.go

Add Env0 join method (#60386)

2025-10-27 23:02:20 +00:00

join_gcp.go

Port gcp join method to new join service (#61205)

2025-11-18 00:46:04 +00:00

join_github.go

Port github join method to new join service (#60898)

2025-11-06 05:08:34 +00:00

join_gitlab.go

Port gitlab join method to new join service (#61203)

2025-11-13 02:12:57 +00:00

join_iam.go

Allow nodes to join the cluster based on their AWS Organization (#62023)

2026-01-08 10:46:16 +00:00

join_kubernetes.go

Port kubernetes join method family to new join service (#61464)

2025-12-02 00:57:53 +00:00

join_oracle_test.go

feat: oracle join tokens scoped to specific instance IDs (#60888)

2025-11-05 17:18:41 +00:00

join_oracle.go

feat: new oracle join method (#60601)

2025-11-03 17:52:06 +00:00

join_spacelift.go

Port spacelift join method to new join service (#61652)

2025-11-27 02:31:56 +00:00

join_terraformcloud.go

Port terraform_cloud join method to new join service (#61589)

2025-11-22 03:07:09 +00:00

join_test.go

Remove (auth.Server) SetClock (#60526)

2025-10-29 15:19:44 +00:00

join_tpm.go

TPM method support in new join service (#61075)

2025-11-19 21:46:19 +00:00

join.go

adding support for scoped joining of SSH nodes using dynamic tokens (#60362)

2025-10-28 22:00:18 +00:00

methods_test.go

Refactor auth test helpers (#56491)

2025-07-21 17:32:26 +00:00

methods.go

Scopes: Pin SSO logins via tsh login (#61576)

2025-12-12 23:19:18 +00:00

middleware_test.go

Refactor auth test helpers (#56491)

2025-07-21 17:32:26 +00:00

middleware.go

Introduce metrics.Registry to pass down registries (#61239)

2025-11-12 21:38:47 +00:00

moderated_sessions_test.go

Refactor auth test helpers (#56491)

2025-07-21 17:32:26 +00:00

notification_test.go

Close auth servers in tests (#62051)

2025-12-14 20:48:53 +00:00

oidc.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

password_test.go

Add strict CA checks on newKeySet() and address test code duplication (#62177)

2025-12-12 18:08:26 +00:00

password.go

Fix violations of non-constant format strings linter (#51812)

2025-02-04 16:43:35 +00:00

periodic_test.go

Add status label to teleport_upgrader_counts metrics (#60119)

2025-10-16 18:16:09 +00:00

periodic.go

Add status label to teleport_upgrader_counts metrics (#60119)

2025-10-16 18:16:09 +00:00

recording_authorizer_test.go

Close auth servers in tests (#62051)

2025-12-14 20:48:53 +00:00

recording_authorizer.go

Implement the session recording metadata service (#58031)

2025-08-19 16:32:19 +00:00

register.go

adding support for scoped joining of SSH nodes using dynamic tokens (#60362)

2025-10-28 22:00:18 +00:00

requestable_roles_test.go

implement paginated requestable roles listing (#56695)

2025-08-12 21:09:04 +00:00

rotate.go

fix: increase usable keys alert expiry (#61827)

2025-11-27 18:54:49 +00:00

saml.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

server_info_test.go

Reduce testing symbols in production binaries (#55360)

2025-06-09 16:51:12 +00:00

server_info.go

Change the inventory to use modern protobuf types and codegen (#54977)

2025-05-23 07:47:39 +00:00

server_monitor.go

Change the inventory to use modern protobuf types and codegen (#54977)

2025-05-23 07:47:39 +00:00

services.go

Add backend MFA service for managing MFA resources (#62553)

2026-01-08 00:57:29 +00:00

sessions_test.go

Pass navigator.maxTouchPoints from Web UI to auth service (#61777)

2025-12-02 10:07:18 +00:00

sessions.go

Add support to sign MCP egress JWT with OIDC CA (#62043)

2026-01-02 15:16:23 +00:00

sso_diag_context_test.go

…

sso_diag_context.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

sso_mfa_test.go

Close auth servers in tests (#62051)

2025-12-14 20:48:53 +00:00

sso_mfa.go

Store ValidatedMFAChallenge resource after successful MFA challenge validation (#62494)

2026-01-09 15:42:38 +00:00

tls_test.go

Add support to sign MCP egress JWT with OIDC CA (#62043)

2026-01-02 15:16:23 +00:00

transport_credentials_test.go

Refactor test assertions to use consistent variable naming in require.EventuallyWithT calls (#58997)

2025-09-15 15:19:53 +00:00

transport_credentials.go

scoped ssh access core (#60629)

2025-11-18 00:26:12 +00:00

trustedcluster_test.go

Close auth servers in tests (#62051)

2025-12-14 20:48:53 +00:00

trustedcluster.go

improve trusted cluster updates (#58008)

2025-09-05 21:39:15 +00:00

usage_test.go

Remove (auth.Server) SetClock (#60526)

2025-10-29 15:19:44 +00:00

user.go

Convert lib/auth to use slog (#50577)

2025-01-06 21:31:53 +00:00

usertoken_test.go

Add paginated ListAuthServers/ListProxies (#61702)

2025-12-12 21:42:28 +00:00

usertoken.go

Add paginated ListAuthServers/ListProxies (#61702)

2025-12-12 21:42:28 +00:00

version.go

Changed error message for major version downgrade (#54767)

2025-05-13 19:57:58 +00:00

windows-configure-ad.ps1

Refactor lib/auth/windows package (#54963)

2025-05-23 23:21:20 +00:00