Teleport: Invalid Role Lockout
Timeline of updates
- resolved
A Teleport Cloud tenant reported an inability to login to their Teleport cluster after being upgraded to 11.3.2. The tenant was rolled back to 11.2.1, an invalid role was removed, and the tenant was upgraded back to 11.3.2.
- postmortem
A bug discovered in Teleport 11.3.2 was the result of new validation that prevented login when invalid namespaces were used in role templates. A [patch was created](https://github.com/gravitational/teleport/pull/21551) to allow invalid namespaces and will be included in the next Teleport release. **Synopsis** * Customer was unable to login and received "unable to process callback" error. * Teleport Cloud tenant was upgraded to v11.3.2 the previous day. 11.3.2 checks the role definitions more aggressively and rejects the logins if the definitions are invalid. Logged errors: Failed to calculate user attributes. invalid login found: \{\{internal.logins\}\}. * Customer’s tenant was rolled back to 11.2.1, the faulty role was corrected, and the tenant was upgraded again to 11.3.2. Customer confirmed they were able to login without issue. * A patch was created to revert the invalid role requirements and will be included in the next release
Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).