[entraid] ask for mfa reuse during entraid plugin setup

This PR fixes a bug where MFA for admin actions prevents creating multiple objects during the entra id setup guide. Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
gravitational · Nov 5, 2024 · a3f4640 · a3f4640
1 parent cbbf915
commit a3f4640
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 5 deletions.
diff --git a/tool/tctl/common/plugin/entraid.go b/tool/tctl/common/plugin/entraid.go
@@ -36,6 +36,7 @@ import (
 	"github.com/gravitational/trace"
 
 	pluginspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
+	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/types"
 	entraapiutils "github.com/gravitational/teleport/api/utils/entraid"
 	"github.com/gravitational/teleport/lib/integrations/azureoidc"
@@ -65,7 +66,7 @@ To rerun the script, type 'exit' to close and then restart the process.
 `
 
 	step2Template = `
-	
+
 ` + bold("Step 2: Input Tenant ID and Client ID") + `
 
 With the output of Step 1, please copy and paste the following information:
@@ -120,9 +121,7 @@ type entraSettings struct {
 	tenantID         string
 }
 
-var (
-	errCancel = trace.BadParameter("operation canceled")
-)
+var errCancel = trace.BadParameter("operation canceled")
 
 func (p *PluginsCommand) entraSetupGuide(proxyPublicAddr string) (entraSettings, error) {
 	pwd, err := os.Getwd()
@@ -234,6 +233,14 @@ func (p *PluginsCommand) InstallEntra(ctx context.Context, args installPluginArg
 		}
 	}
 
+	// Prompt for admin action MFA if required, allowing reuse for UpsertToken and CreateBot.
+	mfaResponse, err := mfa.PerformAdminActionMFACeremony(ctx, args.authClient.PerformMFACeremony, true /*allowReuse*/)
+	if err == nil {
+		ctx = mfa.ContextWithMFAResponse(ctx, mfaResponse)
+	} else if !errors.Is(err, &mfa.ErrMFANotRequired) && !errors.Is(err, &mfa.ErrMFANotSupported) {
+		return trace.Wrap(err)
+	}
+
 	saml, err := types.NewSAMLConnector(inputs.entraID.authConnectorName, types.SAMLConnectorSpecV2{
 		AssertionConsumerService: strings.TrimRight(proxyPublicAddr, "/") + "/v1/webapi/saml/acs/" + inputs.entraID.authConnectorName,
 		AllowIDPInitiated:        true,

diff --git a/tool/tctl/common/plugin/plugins_command.go b/tool/tctl/common/plugin/plugins_command.go
@@ -32,6 +32,7 @@ import (
 	"github.com/gravitational/teleport"
 	"github.com/gravitational/teleport/api/client/proto"
 	pluginsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/plugins/v1"
+	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/service/servicecfg"
@@ -128,7 +129,6 @@ func (p *PluginsCommand) initInstallSCIM(parent *kingpin.CmdClause) {
 		Short('f').
 		Default("false").
 		BoolVar(&p.install.scim.force)
-
 }
 
 func (p *PluginsCommand) initDelete(parent *kingpin.CmdClause) {
@@ -208,6 +208,7 @@ type authClient interface {
 	GetIntegration(ctx context.Context, name string) (types.Integration, error)
 	UpdateIntegration(ctx context.Context, ig types.Integration) (types.Integration, error)
 	Ping(ctx context.Context) (proto.PingResponse, error)
+	PerformMFACeremony(ctx context.Context, challengeRequest *proto.CreateAuthenticateChallengeRequest, promptOpts ...mfa.PromptOpt) (*proto.MFAAuthenticateResponse, error)
 }
 
 type pluginsClient interface {