[Bug]: Support SSH keyboard-interactive authentication (push-based MFA)

[jhkim0911]

Operating system

macOS

Orca version

No response

Details

I am trying to connect Orca to a university HPC cluster that requires password authentication followed by a keyboard-interactive push-based MFA prompt.

The same host works correctly with macOS OpenSSH and VS Code Remote SSH.

In Orca, the password prompt appears, but immediately after entering the password, the connection fails with:

All configured authentication methods failed

The keyboard-interactive MFA prompt is never displayed.

The SSH host configuration is imported correctly from ~/.ssh/config, and the connection reaches the authentication stage successfully. It appears that Orca may not currently handle the keyboard-interactive authentication challenge that follows password authentication.

Could you confirm whether keyboard-interactive authentication is currently supported, or if there is a recommended workaround?

[nwparker]

🤖 Agent handoff — reproduction kit

Status: REPRODUCED · GitHub label has_repro
Writeup (branch): docs/bug-reproductions/8622.md
Branch with tests + docs: nwparker/bug-repro-handoffs

Summary

University HPC: password then keyboard-interactive push MFA works in OpenSSH / VS Code Remote SSH. In Orca, password prompt appears; after password → “All configured authentication methods failed”; MFA prompt never shown.

Automated re-run

git fetch origin nwparker/bug-repro-handoffs
git checkout nwparker/bug-repro-handoffs
# or: git worktree add /tmp/orca-repro-8622 origin/nwparker/bug-repro-handoffs

pnpm exec vitest run --config config/vitest.config.ts src/main/ssh/repro-8622-keyboard-interactive-missing.test.ts

Code / evidence files

• src/main/ssh/repro-8622-keyboard-interactive-missing.test.ts

How another agent should use this

1. Check out nwparker/bug-repro-handoffs (or cherry-pick the repro-* test for this issue).
2. Run the command(s) above — green documents the bug (or cannot_repro proves current tree does not show it).
3. Implement the fix on a new branch from main; keep/adapt the repro test as a regression test that should flip behavior or stay as a guard.
4. Open a PR with: Description, Evidence, ELI5, User-regression-tradeoffs.

Posted by bug-repro orchestration so work is not trapped in a local worktree only.

[jhkim0911]

Verified the repro kit against #8750 (the fix PR):

• upstream main @ 92fc79e — repro-8622-keyboard-interactive-missing.test.ts passes 4/4: bug present, matching the writeup.
• PR branch (jhkim0911:ssh-keyboard-interactive-auth @ 807b347) — 3 of 4 tests flip to failing, and they are exactly the capability-gap assertions: buildConnectConfig now sets tryKeyboard, SshCredentialKind gains 'keyboard-interactive', and ssh-connection.ts handles the keyboard-interactive event. The fourth test (isAuthError classifying the failure string) is fix-agnostic and still passes, as expected for a guard.

Rather than inverting the source-text assertions, #8750 carries the regression coverage in behavioral form: a buildConnectConfig unit test asserting config.tryKeyboard === true, unit tests for prompt classification/answering (src/main/ssh/ssh-keyboard-interactive.test.ts), and integration tests for the full password → keyboard-interactive MFA flow, cached-password auto-answer, and cancel handling (src/main/ssh/ssh-connection.test.ts). It was also exercised end-to-end against a local ssh2 server requiring password partial success + keyboard-interactive.