MFA issues

[Pehesi97]

when inputting MFA code.

Setup worked fine in older versions of Ziti Desktop Edge (Mac OS). The user is able to set up MFA but not input the code. Because of that, a require mfa posture check fails.

To reproduce:

• Set up a v1.6.13 Ziti Controller
• Download latest Ziti Desktop Edge app
• Set up MFA for a given enrollment
• Try and input MFA code, which will lead to the error above

[Pehesi97]

@scareything have you heard of someone else with this problem? seems to be caused by the latest release of the desktop app. Unfortunately I can't have my team revert the update due to App Store limitations. Any change this can be prioritized for next releases?

[dovholuknf]

Hi @Pehesi97, thanks for these details. We had someone ask an MFA-related question that led me to reopen a ZDEW bug I thought was closed. (this one openziti/desktop-edge-win#877). I had assumed it was a UI issue, but given your report here I'm thinking maybe it's a bigger issue. I'll look into this from the windows perspective. I believe you've posted on discourse before wrt MFA and ZDEW, is this a problem for Windows users as well or is this only impacting MacOS users?

[Pehesi97]

I think nobody on my team has a Windows laptop. I'll try and set up one today and let you know.

[dovholuknf]

FYI - there's no need now. I was able to track back the ZDEW issue and it was not related. I'll have a deeper look at macos tunneler. thanks

[dovholuknf]

@Pehesi97 I was unable to click the red lock icon however I think there are two workarounds...

Workaround 1: click the Z icon in the task bar and clicking on the red identity

Workaround 2: disable/enable the identity in the tunneler itself and use the 'auth now' button from the flyout

We'll look into the red icon issue but that should get you unblocked I hope?

[Pehesi97]

I don't think the bug was visual. I am able to open the "Authorize MFA" modal. But once I input the code and click OK, I get the error I reported.

[Pehesi97]

OK I think it might be related to posture checks. I'll record a video.

[dovholuknf]

Oh. that was what i was going to ask. exactly how you have it configured because I expect I didnt' configure it the same. Any chance you can reproduce with a clean set of user/policies? Or would you be willing to export your config and send it to me via ziti ops export ?

[Pehesi97]

Seems like the ziti tunneler reverted to an old behavior regarding MFA. I've even reported that in the past.
If you have MFA enabled (even if it's not enforced by the controller), you can't see any services until you input the code (I'd expect to see and be able to access services that don't require MFA in this scenario). If you don't have any services with MFA posture checks, the MFA icon will go green and there's no issue. If one of the services requires MFA from its posture checks, it'll show up as "FAIL (MFA)" even though you just input your code. If you try to input your code to fix the "FAIL (MFA)" message, you get the error I reported above.

[Pehesi97]

I'll try and set up a clean ziti network later today after work to demonstrate this.

[scareything]

this looks like openziti/ziti-sdk-c#1061