API in Proxy for Multi Factor Authentication in Desktop Client

DefGuard / client

Best WireGuard desktop client with Multi-Factor Authentication

69 stars 9 forks source link

Closed teon closed 5 months ago

teon commented 7 months ago

Proxy will expose user MFA endpoints from core by connecting with GRPC to defguard.
Defuard client before connect will need to go through MFA exactly the same as after doing login on the web.
After successful MFA on client - the client receives a unique PSK KEY for this device, the gateway receives action of adding a new PEER with this PSK key.

In VPN Settings we need a checkbox Require MFA to connect to this Location (enabled by default).

Add rate limit - 5/min && (if possible) after that 1min brake.

teon commented 7 months ago

@4lb we need to talk it through from design point of view

teon commented 7 months ago

Agreed on duplicate core UI

przemyslaw commented 7 months ago

MVP - TOTP or email codes for MFA

wojcik91 commented 7 months ago

TODO:

update protos & proxy to expose auth methods from core
- TOTP/email code auth
login flow in client (on tunnel connect)
- step 1: MFA method choice
- step 2: MFA code
send PSK to the gateway
gateway confirms that the peer is UP
THEN send PSK to the client
Client: connec wg interface
user is logged out:
- desktop client is closed - add sending info to proxy on disconnect to remove peer
- based on the settings (Peer disconnect time) disconnect the peer & remove PSK from device

teon commented 6 months ago

wojcik91 commented 6 months ago