Separating admin and user UI

Budy

I configured the seperate admin UI and I have Duo 2FA for admins enabled. When I am logging into the portal, I am presented with the Duo panel. However, when I chose to login through the regular user UI, where I don't have MFA enabled, I am still able to get to the admin bits without being forced to perform any MFA.

I'd expect the admin bits not to be accessible via the user UI, especially since this circumvents configured MFA options for the admin access.

ludup

There is a setting that you have to enable to force Administrator through the admin link /app/admin

It's under Authentication Flows->Authentication Options under the Admin tab.

Turn the switch on and the admin logging in through the standard login will be denied.

Budy

I know, and I have done it - but, when logging to the user UI as myself, I do have the admin options available as well, instead of just the Home section with My Profile and My Credentials. I can set Duo 2FA for the admin login, but I can bypass it by logging in as a user and then perform administrative changes, which should be prohibited.

MartianX

It is currently designed so that if you are a member of System Administrator or Realm Administrator roles then you must login via the admin link when that option is enabled. Logging in via My Account will result in an error.

If you have just delegated some permissions and are not members of either of those roles, that is intended.

I put this quick gif together. It shows the admin attempting to login my My Account and getting denied. Then a user that has some permissions to manage users, but not Realm or System Admin, that user is allowed in. Finally, a user that is a Realm Administrator attempts to login and is denied.

MartianX

The actual underlying mechanism for this looks at the users roles. So this could probably be extended to allow additional roles that you have defined to be treated as administrative roles.

I'll raise a FR to that effect.

Budy

Well, I do have an AD group which make me part of the System Administrator role but this doesn't prevent me from logging into the user UI or the admin UI. However, users not part of this role can only log in to the user portal and are refused when trying to connect to the admin UI.

Budy

Since I got the authentication flow now right - at least I am not concerned anymore about the 2FA being passed by. But at the current state, the additional admin URI would only be a 2nd login, which will keep regular users out. So, I will probably simply revert to the unified login where I have users of the admin role need to have 2FA.