[ZT] Independent MFA - #29713
Conversation
initial commit, missing the bulk of doc update
|
This PR requires additional review attention because it affects the following areas: PartialsThis PR updates partial files, which are pieces of content used across multiple files in our Render component.
|
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
codyanthony850
left a comment
codyanthony850
left a comment
There was a problem hiding this comment.
Looks good, approving. Two minor things:
-
The enrollment link in Lockout recovery uses cloudflareaccess.com/#/AddMfaDevice but the Enroll authenticators section uses cloudflareaccess.com/AddMfaDevice (no /#/). Which is correct? Should update so both are valid.
-
The main page uses "Apple Touch ID, Apple Face ID" but the changelog uses "macOS Touch ID, Face ID". Might want to align.
Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com>
|
looks good to me beyond a couple suggestions! |
…oudflare-docs into asamborski_independent_mfa
|
|
||
| 1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Access settings**. | ||
| 2. Under **Allow multi-factor authentication (MFA)**, select the [MFA methods](#supported-mfa-methods) you want to allow in your organization. | ||
| 3. Set an **Authentication duration**. This determines how long a user can log in to Access without being prompted for MFA again. If the MFA duration has expired, the user must complete MFA in addition to IdP authentication. |
There was a problem hiding this comment.
This claim introduces some ambiguity: a user will only be allowed to skip the MFA prompt if there is an existing MFA session which uses the same authenticator method as the one required to access the resource e.g., if TOTP is required to access a resource, but only a security key MFA session exists, then the user will be prompted to perform MFA using TOTP i.e., they can't skip the prompt.
The claim should be updated to include this constraint:
This determines how long a user can log in to Access without being prompted for MFA again. Note that in order for a user to be able to skip the MFA prompt, the existing MFA session must have been created using an MFA method that is required to access the resource. If there is no relevant, existing MFA session, the user must complete MFA in addition to IdP authentication.
7 participants
PCX-19983