#69778·teleport

tsh login with --request-id fails when --user differs from active profile username

Author: andrew-h-teleportCreated Sep 16, 2026Updated Sep 16, 2026
Labelstshaccess-requestsc-sap

Expected behavior: When a user already has an active session and assumes an approved access request with tsh login --request-id, passing a --user value that differs from the active session should not break the command.

Current behavior: An error occurs because tsh tries to load non-existent local key files with the --user flag value. Depending on the local ssh-agent state, the failure surfaces in one of two ways:

  • Without ssh-agent (or if the agent holds no teleport certs): "ERROR: no SSH auth methods loaded, are you logged in?".
  • With ssh-agent running and holding session certs: "ERROR: failed to fetch TLS key for : no credentials: ~/.tsh/keys//.key is empty".

Bug details:

  • Teleport version 18.10.x
  • Recreation steps
    • Log in to a teleport cluster with tsh login.
    • Create and approve an access request for the logged in user.
    • While logged in, run: tsh login --proxy=<proxy> --user=other-user --request-id=<request-id>.
    • Fails with: "ERROR: failed to fetch TLS key for other-user".
    • Run the same command with SSH_AUTH_SOCK="" or on a system where ssh-agent does not hold teleport certs: SSH_AUTH_SOCK="" tsh login --proxy=<proxy> --user=other-user --request-id=<request-id>.
    • Fails with: "ERROR: no SSH auth methods loaded, are you logged in?".
    • Run the command without --user (tsh login --proxy=<proxy> --request-id=<request-id>) and it succeeds.