Add SSO MFA docs #50533
Add SSO MFA docs #50533
Conversation
|
🤖 Vercel preview here: https://docs-mzyc3e21c-goteleport.vercel.app/docs |
|
Amplify deployment status
|
|
I still need to give this a proper review, but there are some internal links we need to fix for the preview build to work: |
| <TabItem label="OIDC"> | ||
|
|
||
| ```yaml | ||
| (!/examples/resources/oidc-connector-mfa.yaml!) |
There was a problem hiding this comment.
The partial doesn't render here—do we need to remove the leading slash?
There was a problem hiding this comment.
This also appears to be the case for existing sections in the preview, but those sections do load in the actual docs site.
|
Friendly ping to review @nklaassen @kiosion @mmcallister |
| ### Configure the IDP App / Client | ||
|
|
||
| There is no standardized MFA flow unlike there is with SAML/OIDC login, so | ||
| each IDP may offer zero, one, or more ways to offer MFA checks. | ||
|
|
||
| Teleport does not make any assumptions as to how the MFA app is configured. | ||
| If desired, you could even use your basic login flow with username, password, | ||
| and MFA device. |
There was a problem hiding this comment.
the example yaml's seem to suggest the user should create a separate app in the IDP for doing MFA, should we be more explicit about suggesting that in this section? It feels like we're not really telling people what they need to do here
There was a problem hiding this comment.
This is intentionally left vague and meant as an exercise for the reader to set up their own specific solution. You could set up a separate app or use the same app depending on the IDP offerings.
You're right it is too vague though, I will leave a couple examples and more guidance. My only concern is that I haven't actually been able to test these approaches with MFA enabled, since we don't have access to an enterprise Okta or Auth0 account for testing. In my testing I've most used a custom Auth0 Action which displays a fake webauthn prompt (no-op button) in place of an actual MFA prompt.
|
@nklaassen Friendly ping to re-review |
00e7e2a to
0d3af41
Compare
Add documentation for the new SSO MFA feature. See the RFD for more details.