mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-03 16:38:35 +08:00
Brian JoergerandLisa Kim
704f3fccd3
* Add PromptMFA to tshd event service. * Add custom MFA prompt using the tshd event service PromptMFA method. * Generalize and reuse mfa prompt goroutine logic. * Use important modal sempahore for MFA prompts. * Update lib/client/api.go Co-authored-by: Lisa Kim <lisa@goteleport.com> * Fix file name. * Fix lint. --------- Co-authored-by: Lisa Kim <lisa@goteleport.com>
63 lines
2.3 KiB
Go
63 lines
2.3 KiB
Go
/*
|
|
* Teleport
|
|
* Copyright (C) 2023 Gravitational, Inc.
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Affero General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Affero General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
package client
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/gravitational/teleport/api/client/proto"
|
|
"github.com/gravitational/teleport/api/mfa"
|
|
wancli "github.com/gravitational/teleport/lib/auth/webauthncli"
|
|
wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
|
|
libmfa "github.com/gravitational/teleport/lib/client/mfa"
|
|
)
|
|
|
|
// WebauthnLoginFunc matches the signature of [wancli.Login].
|
|
type WebauthnLoginFunc func(ctx context.Context, origin string, assertion *wantypes.CredentialAssertion, prompt wancli.LoginPrompt, opts *wancli.LoginOpts) (*proto.MFAAuthenticateResponse, string, error)
|
|
|
|
// NewMFAPrompt creates a new MFA prompt from client settings.
|
|
func (tc *TeleportClient) NewMFAPrompt(opts ...mfa.PromptOpt) mfa.Prompt {
|
|
cfg := tc.newPromptConfig(opts...)
|
|
|
|
var prompt mfa.Prompt = libmfa.NewCLIPrompt(cfg, tc.Stderr)
|
|
if tc.MFAPromptConstructor != nil {
|
|
prompt = tc.MFAPromptConstructor(cfg)
|
|
}
|
|
|
|
return prompt
|
|
}
|
|
|
|
// PromptMFA runs a standard MFA prompt from client settings.
|
|
func (tc *TeleportClient) PromptMFA(ctx context.Context, chal *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
|
|
return tc.NewMFAPrompt().Run(ctx, chal)
|
|
}
|
|
|
|
func (tc *TeleportClient) newPromptConfig(opts ...mfa.PromptOpt) *libmfa.PromptConfig {
|
|
cfg := libmfa.NewPromptConfig(tc.WebProxyAddr, opts...)
|
|
cfg.AuthenticatorAttachment = tc.AuthenticatorAttachment
|
|
cfg.PreferOTP = tc.PreferOTP
|
|
cfg.AllowStdinHijack = tc.AllowStdinHijack
|
|
|
|
if tc.WebauthnLogin != nil {
|
|
cfg.WebauthnLoginFunc = tc.WebauthnLogin
|
|
cfg.WebauthnSupported = true
|
|
}
|
|
return cfg
|
|
}
|