{"record":{"id":"22d11e0f728aa851","repo":"gravitational/teleport","slug":"no-security-keys-found","errorCode":null,"errorMessage":"no security keys found","messagePattern":"no security keys found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/webauthncli/fido2.go","lineNumber":680,"sourceCode":"\tpinAwareCallbackFunc func(dev FIDODevice, info *deviceInfo, pin string) (requiresPIN bool, err error)\n)\n\n// runPrompt defines the prompt operations necessary for runOnFIDO2Devices.\n// (RegisterPrompt happens to match the minimal interface required.)\ntype runPrompt RegisterPrompt\n\nfunc runOnFIDO2Devices(\n\tctx context.Context,\n\tprompt runPrompt,\n\tfilter deviceFilterFunc,\n\tdeviceCallback deviceCallbackFunc,\n) error {\n\tlocs, err := fidoDeviceLocations()\n\tif err != nil {\n\t\treturn trace.Wrap(err, \"device locations\")\n\t}\n\tif len(locs) == 0 {\n\t\treturn trace.Wrap(errors.New(\"no security keys found\"))\n\t}\n\n\tdevices, devicesC, err := startDevices(locs, filter, deviceCallback, prompt)\n\tif err != nil {\n\t\treturn trace.Wrap(err)\n\t}\n\n\tvar receiveCount int\n\tdefer func() {\n\t\t// Cancel all in-flight requests, if any.\n\t\tdevices.cancelAll(nil /* except */)\n\n\t\t// Give the devices some time to tidy up, but don't wait forever.\n\t\tmaxWait := time.NewTimer(fido2DeviceMaxWait)\n\t\tdefer maxWait.Stop()\n\n\t\tfor receiveCount < devices.len() {\n\t\t\tselect {","sourceCodeStart":662,"sourceCodeEnd":698,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/webauthncli/fido2.go#L662-L698","documentation":"RunOnFIDO2Devices enumerates FIDO2 device locations via fidoDeviceLocations() and this guard fires when the list is empty, meaning no security keys (or platform authenticators) are visible to the host before any prompt is shown.","triggerScenarios":"Thrown at lib/auth/webauthncli/fido2.go:680 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Plug in a FIDO2 security key and retry","Check the key is visible to the OS (lsusb on Linux, or the browser/OS authenticator settings)","On Linux, verify udev rules for the security key are installed so the device is accessible"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}