-
Notifications
You must be signed in to change notification settings - Fork 13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ZDEW: Creating a MFA enabled ID does not prompt user to configure MFA upon installation of the ID, or prior to first use #685
Comments
Thanks @gooseleggs, for the steps to reproduce. I'll try to reproduce this tomorrow. |
Thanks @dovholuknf Note that I did not apply any services to the identity. This does not change the fault, ie even if I associate a service I still get the issue. This has happened on two windows clients. |
Thanks. I'll see if I can try to use the zac and an old controller. Is the zac equally as old? Would you be willing to send me one or a few identities which I could test with? Could you capture a feedback zip file and somehow get it to me so I could look at the logs? (Ideally with trace mode enabled) |
i ran the ziti-edge-tunnel that comes with ZDEW 2.1.16 and it for me, it has the same behavior as the latest ZDEW does. You were able to get the 2.1.16 version of ZDEW to behave correctly, per your initial post but I could not. Could you perhaps have created the identity with the default or NON-mfa-required auth policy, enrolled it, then updated the identity to use that mfa-enforced policy? It looks to me that the issue here is that the auth policy as you show ends up getting TOTP as required for secondary auth. That means it's a bit of a chicken/egg issue going on. I personally do think this is a flow we should support though, but I don't know if it's ever actually been used. I see most people using posture checks for TOTP, not as part of the authentication policy, but it makes to me that this flow should be supported. Can you review my gif and steps and make sure I'm doing it how you're doing it? In it I do the following:
|
BTW that's the relatively trivial workaround to this too. Make the identity, enroll it, ensure it has TOTP enabled, THEN move the identity's auth policy to the MFA_enforced policy. But that's a bigger pain on the ziti operator. I'd still like to know if you could reproduce how it worked before though, it feels like this might just be a long-standing bug? |
So, I went through all permutations of this.
Then, as you described - create a default ID - import into client...manually enable MFA, then enable MFA enforcement onto the identity and it works. So, I will change the title of this Issue to be reflective of the issue. That is creating a MFA enabled ID does not prompt user to configure MFA upon installation of the ID, or prior to first use". |
Thanks for confirming, that makes me feel better in some ways. This appears to be a codepath nobody has excercised until now but it's proving tricky to find and fix. I am hoping to get it sorted soon so that it'll work like the Mac ZDEM does (I DID confirm the ZDEM works properly). |
Thanks - Just tried it with my Sons MacBook, and it correct - it works as expected. |
I have two pr's up to fix this . one for the UI: #686 and one for ziti-edge-tunnel: openziti/ziti-tunnel-sdk-c#882 I'll try to get a beta build out here tomorrow or monday |
The 2.4.0.0 build of the ZDEW should resolve this issue. If you want to automatically upgrade now, you can change over to the beta url. https://get.openziti.io/zdew/beta.json Alternatively, you can choose to install it manually by downloading from: Current plan, assuming no big bugs are discovered:
|
Hello
Unable to enroll into MFA as the client thinks it has already and prompts for TOTP code when adding a new identity into ZDEW
Steps to reproduce
Workaround:
The text was updated successfully, but these errors were encountered: