incorrect error on dial when a session has been removed due to posture checks

[dovholuknf]

Steps to reproduce:

ziti edge delete identity pctest
ziti edge create identity pctest -a "ziti.controller.dialers" -o pctest.jwt

ziti edge delete config ziti.controller.int
ziti edge create config ziti.controller.int intercept.v1 "{\"protocols\":[\"tcp\"],\"addresses\":[\"controller.ziti\"],\"portRanges\":[{\"low\":1280,\"high\":1280}]}"
ziti edge delete config ziti.controller.host
ziti edge create config ziti.controller.host host.v1 "{\"protocol\":\"tcp\", \"address\":\"127.0.0.1\",\"port\":1280 }"
ziti edge delete service ziti.controller
ziti edge create service ziti.controller --configs "ziti.controller.int","ziti.controller.host" --role-attributes "ziti.controller.svc"

ziti edge delete posture-check totp-timeout 
ziti edge create posture-check mfa totp-timeout --seconds 30 

ziti edge delete sp ziti.controller.sp.dial
ziti edge create sp ziti.controller.sp.dial Dial --identity-roles "#ziti.controller.dialers" --service-roles "#ziti.controller.svc" --posture-check-roles "@totp-timeout"

ziti edge delete sp ziti.controller.sp.bind
ziti edge create sp ziti.controller.sp.bind Bind --identity-roles "#ziti.controller.binders" --service-roles "#ziti.controller.svc"

ziti edge update identity quickstart-router -a "ziti.controller.binders"

satisfy MFA TOTP requirement issue: curl -sk https://controller.ziti:1280

wait 30s

issue observe failure: curl -sk https://controller.ziti:1280

no matter how many times MFA TOTP entered, never can dial again

[andrewpmartinez]

This would occur any time a controller action (admin, posture check, etc.) takes place that removes a session (i.e. admin delete session, admin delete API session, admin delete identity, etc).

To support older SDKs we would have to re-create the "invalid session" error (exact language tbd).

Long term we should move to error codes.