Open
Description
Expected behavior:
When Per-session MFA is enabled, there should be a way to fallback to OTP for Teleport Connect (when both "Hardware Key" and "Authenticator App" have been configured for a user)
Current behavior:
Teleport Connect only prompts for the "Hardware Key".
Bug details:
- Teleport version: 15.4.18
- Recreation steps
- Debug logs
In tsh
, fallback to OTP is supported with the --mfa-mode=otp
option. No such fallback seems available for Teleport Connect.
The documentation seems to indicate that it should be supported in both:
OTP can only be used with per-session MFA when using
tsh
or Teleport Connect to establish connections. A hardware MFA key is required for using per-session MFA with Teleport's Web UI.
Ref. https://goteleport.com/docs/admin-guides/access-controls/guides/per-session-mfa/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment