Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Setting TELEPORT_PROXY and TELEPORT_CLUSTER environment variables prevent tsh login --request-id from working #50721

Open
Ezzahhh opened this issue Jan 3, 2025 · 0 comments
Labels
access-requests bug tsh tsh - Teleport's command line tool for logging into nodes running Teleport.

Comments

@Ezzahhh
Copy link

Ezzahhh commented Jan 3, 2025

Expected behavior:
If TELEPORT_PROXY and TELEPORT_CLUSTER environment variables are set, it should still get updated certificates from the requested role. The behaviour should not differ from when the environment variables are not set (which works).

Current behavior:
If TELEPORT_PROXY and TELEPORT_CLUSTER environment variables are set, it is not possible to tsh login --request-id unless the variables are unset. If tsh request create is run and not cancelled or specified with --nowait then there are no issues pulling the right certificates after approval.

Bug details:

  • Teleport version: 17.1.2

Recreation steps:

  1. Do not set TELEPORT_PROXY and TELEPORT_CLUSTER environment variables
  2. tsh login --proxy my-teleport-url:443 my-teleport-url
  3. tsh request create --role my-role --reason='test'
  4. Cancel out of the above with Ctrl+C
  5. Approve the request with tctl
  6. export TELEPORT_PROXY=my-teleport-url:443; export TELEPORT_CLUSTER=my-teleport-url;
  7. tsh login --request-id=<request-id>
  8. No log line Approval received, getting updated certificates...
  9. Try to login to requested resource through role and get access denied

Audit Logs

{
  "cert_type": "user",
  "cluster_name": "teleport.{{REDACTED}}.com",
  "code": "TC000I",
  "ei": 0,
  "event": "cert.create",
  "identity": {
    "access_requests": []
// request-id is not contained here in this audit log when environment variables are set
@Ezzahhh Ezzahhh added the bug label Jan 3, 2025
@stevenGravy stevenGravy added tsh tsh - Teleport's command line tool for logging into nodes running Teleport. access-requests labels Jan 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
access-requests bug tsh tsh - Teleport's command line tool for logging into nodes running Teleport.
Projects
None yet
Development

No branches or pull requests

2 participants