search

hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management
https://www.vaultproject.io/
Other
31.19k stars 4.21k forks source link

ODIC UI logins fail to trigger MFA #16385

Open tam116 opened 2 years ago

tam116 commented 2 years ago

Auth fails for UI logins using OIDC when MFA is enforced. The message "A login request was issued that is subject to MFA validation. Please make sure to validate the login by sending another request to mfa/validate endpoint." is displayed.

This issue does not affect the CLI

== Steps to reproduce the behavior:

  1. Setup OIDC as an auth option
  2. Setup an Login MFA provider and enable enforcement of the OIDC method or OIDC mount from the previous step
  3. Attempt to login via the UI using the OIDC provider
  4. Login fails

Expected behavior Something similar the CLI experience where I get an automatic push notification Edit: If I use userpass with the same MFA config then it works. I tried to debug a bit more and it appears that the call to mfavaildate either isn't happening or the OIDC flow is calling lookup_token before mfavalidate.

Environment:

lahiruperamune commented 2 years ago

When I attempt to configure MFA for OIDC logins using terraform, I keep getting the same message. Any solution?

chris-burn-phocas commented 2 years ago

I'm getting this problem too with Vault server version 1.12.0.

tibuntu commented 1 year ago

Any chance this is going to be fixed soon?

elopsod commented 7 months ago

I'm getting this problem too with Vault server version 1.15.5.

erikpartila commented 5 months ago

Same issue here (Vault 1.15.4)..