Step-up auth: Add global enforcement following 2FA pattern

Gerardo Navarrorequested to merge
gitlab-community/gitlab-org/gitlab:587948-gerardo-navarro-step-up-auth-apply-global-step-up-auth-enforcement-like-2fa-enforcement into master

What does this MR do and why?

Implement global step-up authentication enforcement that blocks users from accessing any page until they complete step-up auth, similar to how 2FA enforcement works.

Problem

The current step-up authentication implementation only enforces step-up auth when users directly access protected group or project pages. Users who are members of a step-up auth protected group can still freely browse other parts of GitLab (dashboard, other groups, profile settings, global search, etc.) without completing step-up authentication first.

This creates security concerns:

  • Information leakage via dashboard views: Users can see content from protected groups on their dashboard without completing step-up authentication
  • Information leakage via global search: Users can discover content from protected groups through search results
  • Delayed enforcement: Step-up auth is only triggered when visiting the protected resource, not immediately

Solution

Follow the established 2FA enforcement pattern by:

  1. Create StepUpAuthRequiringGroupsFinder - Finder to retrieve groups requiring step-up auth for a user
  2. Create EnforcesStepUpAuthGlobal concern - Global enforcement concern with before_action that redirects users to complete step-up auth before accessing any page
  3. Include concern in ApplicationController - Enables global enforcement
  4. Add skip_before_action to essential controllers - Allow logout, help pages, terms acceptance, leave group action, and the step-up auth flow itself
  5. Add profile step-up auth controller - Fallback page when user has multiple groups requiring authentication
  6. Handle GraphQL requests - Return proper error response instead of redirect

Current vs. New Behavior

Current behavior:

User logs in → User can browse freely → User visits protected group → Step-up auth required
              (User can still browse other content while step-up auth is pending)

New behavior (aligned with 2FA):

User logs in → User visits ANY page → Step-up auth check
              → Required + Not completed → REDIRECT to step-up auth
              → User LOCKED until step-up auth completed
              → User can now access ALL pages

🛠️ with ❤️ at Siemens

References

  • Related epic: &16818
  • Related issue: #587948
  • Addresses: #581316 (Dashboard views protection)
  • Addresses: #581317 (Global search protection)
  • Related: #556943 (Step-up auth group protection epic)

Screenshots or screen recordings

N/A - Backend-only changes affecting redirect behavior

Before After
Users can browse GitLab freely while step-up auth is pending Users are redirected to step-up auth before accessing any page

How to set up and validate locally

  • Enable the openid_connect provider in your OmniAuth configuration
  • Create a group and configure step-up auth requirement: 
    group = Group.find_by_path('your-group')
group.update!(step_up_auth_required_oauth_provider: 'openid_connect')
  • Add a test user as a member of this group
  • Log in as the test user
  • Navigate to the dashboard or any other page
  • Verify you are redirected to the step-up auth page
  • Verify you can still:
    • Log out (via the sign out link)
    • Access help pages
    • Leave the group (escape hatch)
    • Accept terms (if applicable)
  • Complete the step-up auth flow
  • Verify you can now access all pages normally

MR acceptance checklist

Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

MR Checklist (@gerardo-navarro)
Edited by Gerardo Navarro

Merge request reports