Fix user tests.

lib/auth/users/usersv1/service_test.go

@@ -73,7 +73,8 @@ func (a fakeAuthorizer) Authorize(ctx context.Context) (*authz.Context, error) {
 					},
 				},
 			},
-			Identity: identity,
+			Identity:              identity,
+			AdminActionAuthorized: true,
 		}, nil
 	}
 
@@ -102,8 +103,8 @@ func (a fakeAuthorizer) Authorize(ctx context.Context) (*authz.Context, error) {
 				Username: "alice",
 			},
 		},
+		AdminActionAuthorized: true,
 	}, nil
-
 }
 
 type fakeChecker struct {
@@ -866,7 +867,6 @@ func TestRBAC(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.desc, func(t *testing.T) {
-
 			env, err := newTestEnv(withAuthorizer(&fakeAuthorizer{authzContext: &authz.Context{
 				User:    llama,
 				Checker: test.checker,
@@ -876,6 +876,7 @@ func TestRBAC(t *testing.T) {
 						Groups: []string{"dev"},
 					},
 				},
+				AdminActionAuthorized: true,
 			}}))
 			require.NoError(t, err, "creating test service")
 
@@ -888,5 +889,4 @@ func TestRBAC(t *testing.T) {
 			require.ElementsMatch(t, test.expectChecks, test.checker.checks)
 		})
 	}
-
 }

lib/authz/permissions.go

@@ -193,7 +193,7 @@ type Context struct {
 	// AdminActionVerified is whether this auth request is verified for admin actions. This
 	// either means that the request was MFA verified through the context or Hardware Key support,
 	// or the identity does not require admin MFA (built in roles, bot impersonated user, etc).
-	adminActionAuthorized bool
+	AdminActionAuthorized bool
 }
 
 // GetUserMetadata returns information about the authenticated identity
@@ -384,7 +384,7 @@ func (a *authorizer) checkAdminActionVerification(ctx context.Context, authConte
 		return trace.Wrap(err)
 	}
 
-	authContext.adminActionAuthorized = true
+	authContext.AdminActionAuthorized = true
 	return nil
 }
 
@@ -1101,6 +1101,7 @@ func ContextForBuiltinRole(r BuiltinRole, recConfig types.SessionRecordingConfig
 		Identity:              r,
 		UnmappedIdentity:      r,
 		disableDeviceRoleMode: true, // Builtin roles skip device trust.
+		AdminActionAuthorized: true, // builtin roles skip mfa for admin actions.
 	}, nil
 }
 
@@ -1324,7 +1325,7 @@ func AuthorizeContextWithVerbs(ctx context.Context, log logrus.FieldLogger, auth
 
 // AuthorizeAdminAction will ensure that the user is authorized to perform admin actions.
 func AuthorizeAdminAction(ctx context.Context, authCtx *Context) error {
-	if !authCtx.adminActionAuthorized {
+	if !authCtx.AdminActionAuthorized {
 		return trace.Wrap(&mfa.ErrAdminActionMFARequired)
 	}
 	return nil