search

Noovolari / leapp

Leapp is the DevTool to access your cloud
https://www.leapp.cloud/
Mozilla Public License 2.0
1.62k stars 146 forks source link

IAM Role Chained does not flush active sessions with MFA when "Logout" is used #223

Open zackriso opened 2 years ago

zackriso commented 2 years ago

Describe the bug The IAM Role Chained session, which has 2FA activated, does not flush the existing/active sessions after using the "Logout" button.

Leapp Version version 0.8.1

To Reproduce

  1. Create an IAM Role Chained account, which has 2FA activated for a local IAM user.
  2. Use that Role, entering the MFA as required.
  3. Test that the role works (it does)
  4. Under Leapp, click on Logout in order to clear sessions
  5. Leap will close and restart by itself
  6. Click on the same role again that was previously created or connected to under step 3.
  7. The 2FA is not being asked again, but rather, access to the role works (though with different temporary STS tokens under .aws/credentials)

Expected behavior I would expect Leapp to ask me for entering my 2FA again, since I explicitly asked to clear my session by doing "Logout" from Leapp's menu. This is similar to a Logout link, which should delete all cookies, JWTs, and so on, so the user has to re-authenticate from scratch, including in this case entering their 2FA again.

Desktop (please complete the following information): Linux kali 5.14.0-kali4-amd64 #1 SMP Debian 5.14.16-1kali1 (2021-11-05) x86_64 GNU/Linux

Additional context It seems that Assume-Role is re-run again, and obtains new STS tokens, however without asking for entering 2FA again.

pethron commented 2 years ago

Currently, that's expected behavior because the MFA token has a duration itself, and we leverage that to ask for it the least number of times. However, I think it's an excellent suggestion for the "logout" action to make this behavior selectable (and remember the option for changing Leapp behavior). I'll label this as "enhancement." Thank you very much!

zackriso commented 2 years ago

Thanks for your feedback.

The way I understand it, Logout means "clear all sessions, active or inactive, including the MFA tokens". Otherwise, we are decreasing the security advantage of having 2FA in the first place :)

Most, if not all other tools I used, do invalidate everything, and 2FA has to be re-entered again. But I like the idea of letting the user decide on their own what level of security or what is their intention.

Currently, I have no way to tell leapp forget my sessions other than by deleting the actual account.