Teleport incident

Invalid Role Lockout

Notice Resolved View vendor source →

Teleport experienced a notice incident on February 10, 2023, lasting —. The incident has been resolved; the full update timeline is below.

Started
Feb 10, 2023, 01:06 AM UTC
Resolved
Feb 09, 2023, 07:00 AM UTC
Duration
Detected by Pingoru
Feb 10, 2023, 01:06 AM UTC

Update timeline

  1. resolved Feb 10, 2023, 01:06 AM UTC

    A Teleport Cloud tenant reported an inability to login to their Teleport cluster after being upgraded to 11.3.2. The tenant was rolled back to 11.2.1, an invalid role was removed, and the tenant was upgraded back to 11.3.2.

  2. postmortem Feb 10, 2023, 01:06 AM UTC

    A bug discovered in Teleport 11.3.2 was the result of new validation that prevented login when invalid namespaces were used in role templates. A [patch was created](https://github.com/gravitational/teleport/pull/21551) to allow invalid namespaces and will be included in the next Teleport release. **Synopsis** * Customer was unable to login and received "unable to process callback" error. * Teleport Cloud tenant was upgraded to v11.3.2 the previous day. 11.3.2 checks the role definitions more aggressively and rejects the logins if the definitions are invalid. Logged errors: Failed to calculate user attributes. invalid login found: \{\{internal.logins\}\}. * Customer’s tenant was rolled back to 11.2.1, the faulty role was corrected, and the tenant was upgraded again to 11.3.2. Customer confirmed they were able to login without issue. * A patch was created to revert the invalid role requirements and will be included in the next release