auth/okta: Add support for Okta number challenge

[calvn]

This PR adds the ability for the Okta Auth Method to perform the 3-number verification challenge if that's enabled on an Okta Organization.

The login flow is as follows, which happens within a single Vault login CLI command:

1. Perform a Vault login using Okta credentials

$ vault login -method=okta [email protected]
Password (will be hidden):
...

2. Receive and confirm MFA prompt

3. Receive a number challenge in the CLI

...
In Okta Verify, tap the number '32'
...

4. Validate number on the user's device

5. Sucessful login

...
Success! You are now authenticated. The token information displayed below
is already stored in the token helper. You do NOT need to run "vault login"
again. Future Vault requests will automatically use this token.

Key                    Value
---                    -----
token                  hvs.CAESIF6yzMNIoAiH6WqTvZ9W_bhI-ux6qsLLBHfKoBCZegnKGh4KHGh2cy4wZVVQTmdnbDUxbUVzTGRTN25MNzlPS3k
token_accessor         GrGamdHye5dZKRr092bydAfO
token_duration         768h
token_renewable        true
token_policies         ["default" "foo"]
identity_policies      []
policies               ["default" "foo"]
token_meta_policies    default,foo
token_meta_username    [email protected]

[austingebauer]

Just a couple of comments. Looks good to me otherwise 👍

[austingebauer]

👍

[calvn]

Taking the opportunity in this PR to change the polling frequency from 500ms to 1s. The rationale behind this change is that Okta dev accounts has a rate limit of 100req/min on authn/ endpoints (non-dev accounts do have higher limits), and at this frequency calls made by a vault login will trigger a warning and eventually lead to rate limit exceeded errors. By lowering this to a max of 60req/min we avoid hitting this rate limit and getting into flaky testing scenarios. The bump should not be that noticeable since this is a purely human-based flow.

Login MFA uses a 1s polling frequency, so it should be acceptable for us here as well:

vault/vault/login_mfa.go

Line 1928 in a2fc885

case <-time.After(time.Second):

[swenson]

LGTM

[adrian-mi-romero]

@calvn how can I know if you fixed that was merged to main was in deed included in a vault release version? thanks in advance.

[tvoran]

Hi @adrian-mi-romero, if you click on the commit sha from the "calvn merged commit" message above, and then expand the tags, it'll show which releases included this patch. Example screenshot:

[adrian-mi-romero]

Thanks a lot @tvoran so it should be in v1.12.X ... wondering about it coz if you check the doc for v1.12.X it says your fix it is not supported/included.
https://developer.hashicorp.com/vault/docs/auth/login-mfa/faq#q-what-is-single-phase-mfa-vs-two-phase-mfa

[tvoran]

@adrian-mi-romero Best to open another issue about that.

[bobby-mack]

@calvn By chance did a recent update in 1.15.0 result in this feature breaking for Okta Verify Number Challenge? We're no longer presented with the corresponding matching number in the UI (previously working) as part of this PR.

[bobby-mack]

@calvn By chance did a recent update in 1.15.0 result in this feature breaking for Okta Verify Number Challenge? We're no longer presented with the corresponding matching number in the UI (previously working) as part of this PR.

I have since opened an issue for this, just an FYI: #23465