Fix JumpHost TLSRouting flow when root cluster is offline

[smallinsky]

What:

Fix the #13554 issue when JumpHost to leaf cluster fails when root cluster is online.

Why

The Fix TLS Routing JumpHost flow fix didn't aligned the isMFARequired calls agains root cluster and in case of offline root cluster the JumpHost TLS Routing flow fails.

How

In case of JumpHost == leaf proxy address` call isMFARequired on leaf auth service like in TLS Routing disabled flow.

[espadolini]

Does this mean that a non-FIPS tsh connecting directly to a non-FIPS leaf will not clear the terminal, while a connection to the leaf through a FIPS root would? Is that the correct behavior? Can you even join a non-FIPS leaf to a FIPS root?

[codingllama]

Thanks for the quick fixes, Marek.

What is the interaction between jump hosts and settings such as per_session_mfa? If the root has per_session_mfa=true and the leaf doesn't, would a jump allow the user to connect without MFA?

Conversely, if MFA is required by the leaf, how can the user pass the challenge if their credentials are saved in the root cluster?

In essence, is jumping with an offline root possible if MFA is involved?

[smallinsky]

@codingllama

What is the interaction between jump hosts and settings such as per_session_mfa? If the root has per_session_mfa=true and the leaf doesn't, would a jump allow the user to connect without MFA?

In that case the root cluster will ask the client to add MFA device in order to process MFA flow enforced by leaf cluster.

Conversely, if MFA is required by the leaf, how can the user pass the challenge if their credentials are saved in the root cluster?

In case of MFA require by the leaf a MFA cert issuer is a root cluster so root cluster needs to be online to handle MFA issue cert request triggered by the IsMFARequire check evaluate on the leaf cluster.

In essence, is jumping with an offline root possible if MFA is involved?

No, MFA flow requires root cluster aviability to issue MFA verify certs so this is not matter of JumpHost and in case of offline root cluster the tsh ssh --cluster=leaf leafnode command will also fail.

Does this mean that a non-FIPS tsh connecting directly to a non-FIPS leaf will not clear the terminal, while a connection to the leaf through a FIPS root would? Is that the correct behavior? Can you even join a non-FIPS leaf to a FIPS root?

@espadolini

Does this mean that a non-FIPS tsh connecting directly to a non-FIPS leaf will not clear the terminal, while a connection to the leaf through a FIPS root would? Is that the correct behavior? Can you even join a non-FIPS leaf to a FIPS root?

I'm not familiar with FIPS though I have never seen any checks preventing this behaviour.

[codingllama]

Thanks for the explanation.

[github-actions]

@smallinsky See the table below for backport results.

Branch	Result
branch/v10	Failed
branch/v8	Failed
branch/v9	Failed