upstream/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2026-02-03 20:40:45 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

identity/mfa: revert cache value and add comments to mfa cache (#31421)

Browse source 
* identity/mfa: revert cache value and add comments to mfa cache
This commit is contained in:
mickael-hc 2025-08-04 17:07:53 -04:00 committed by GitHub
parent ed1615be17
commit 078585b365
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
changelog/31421.txt Normal file
View file

@ -0,0 +1,3 @@
```release-note:bug
identity/mfa: revert cache entry change from #31217 and document cache entry values
```

2
vault/external_tests/identity/login_mfa_totp_test.go
View file

@ -329,7 +329,7 @@ func TestLoginMfaGenerateTOTPTestAuditIncluded(t *testing.T) {
// let's make sure the configID is not blocked for other users
doTwoPhaseLogin(t, userClient2, enginePath2, methodID, testuser2)
// let's see if user1 is able to login after 3 + 3*2 = 9 seconds
// let's see if user1 is able to login after 3 * (2+1) = 9 seconds
time.Sleep(9 * time.Second)
doTwoPhaseLogin(t, userClient1, enginePath1, methodID, testuser1)

7
vault/login_mfa.go
View file

@ -2343,9 +2343,10 @@ func (c *Core) validateTOTP(ctx context.Context, mfaFactors *MFAFactor, entityMe
return fmt.Errorf("failed to validate TOTP passcode")
}
// The duration in which a passcode is stored in cache to enforce
// rate limit on failed totp passcode validation
passcodeTTL := time.Duration(int64(time.Second) * int64(totpSecret.Period) * int64(2*totpSecret.Skew))
// The duration in which a rateLimitID (configID_entityID) is used to limit the number of TOTP validation attempts.
// The passcode will be added to the usedCodes cache later, with a different TTL, with the skew and period.
passcodeTTL := time.Duration(int64(time.Second) * int64(totpSecret.Period))
// Enforcing rate limit per MethodID per EntityID
rateLimitID := fmt.Sprintf("%s_%s", configID, entityID)