tsh login with --request-id fails when --user differs from active profile username
Author: andrew-h-teleportCreated Sep 16, 2026Updated Sep 16, 2026
Labelstshaccess-requestsc-sap
Expected behavior:
When a user already has an active session and assumes an approved access request with tsh login --request-id, passing a --user value that differs from the active session should not break the command.
Current behavior:
An error occurs because tsh tries to load non-existent local key files with the --user flag value.
Depending on the local ssh-agent state, the failure surfaces in one of two ways:
- Without ssh-agent (or if the agent holds no teleport certs): "ERROR: no SSH auth methods loaded, are you logged in?".
- With ssh-agent running and holding session certs: "ERROR: failed to fetch TLS key for : no credentials: ~/.tsh/keys//.key is empty".
Bug details:
- Teleport version 18.10.x
- Recreation steps
- Log in to a teleport cluster with
tsh login. - Create and approve an access request for the logged in user.
- While logged in, run:
tsh login --proxy=<proxy> --user=other-user --request-id=<request-id>. - Fails with: "ERROR: failed to fetch TLS key for other-user".
- Run the same command with SSH_AUTH_SOCK="" or on a system where ssh-agent does not hold teleport certs:
SSH_AUTH_SOCK="" tsh login --proxy=<proxy> --user=other-user --request-id=<request-id>. - Fails with: "ERROR: no SSH auth methods loaded, are you logged in?".
- Run the command without --user (
tsh login --proxy=<proxy> --request-id=<request-id>) and it succeeds.
- Log in to a teleport cluster with
Source: gravitational/teleport