Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Logic behind forcing DUO auth to be push instead of push or phone call? #19129

Open
eliottcassidy2000 opened this issue Feb 10, 2023 · 0 comments

Comments

@eliottcassidy2000
Copy link

Is your feature request related to a problem? Please describe.
Recently enabled DUO MFA on our cluster and we have some people in our org who have older phones that don't support the duo app. They would like to authenticate via phone call, but that is not possible with any current release of vault. Solution: change factor from push to auto

Describe the solution you'd like
In login_mfa.go the factor is hardcoded to either "push" or "password", but the duo api /auth endpoint supports additional modes such as "sms" "phone" and "auto", where auto lets duo choose which one to do. Is there any reason that I'm not aware of that auto is not chosen? Seems to be the most flexible to me, but I haven't worked with duo API directly at all. Maybe auto has some downside to it. Looks like the relevant code came from this commit so @raskchanky if you happen to see this and remember why you set it to push, that would probably be the most efficient way to answer my question, don't want to waste y'alls time. If you don't remember, I don't blame you haha I never remember random little intricacies of my old code, that shit is impossible. Anyways, I'd be happy to make a quick PR to change it from "push" to "auto" if no one has any reservations. Thank you for taking the time to read this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants