{"record":{"id":"24e925422672f353","repo":"gravitational/teleport","slug":"user-input-required","errorCode":null,"errorMessage":"user input required","messagePattern":"user input required","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/srv/alpnproxy/kube.go","lineNumber":285,"sourceCode":"func (m *KubeMiddleware) getCertForRequest(req *http.Request) (tls.Certificate, error) {\n\ttc, kc, err := m.resolveClusterKey(req)\n\tif err != nil {\n\t\treturn tls.Certificate{}, trace.Wrap(err)\n\t}\n\treturn m.getCert(tc, kc)\n}\n\n// GetClientCerts implements [LocalProxyHTTPMiddleware].\nfunc (m *KubeMiddleware) GetClientCerts(req *http.Request) ([]tls.Certificate, bool, error) {\n\tcert, err := m.getCertForRequest(req)\n\tif err != nil {\n\t\treturn nil, false, trace.Wrap(err)\n\t}\n\treturn []tls.Certificate{cert}, true, nil\n}\n\n// ErrUserInputRequired returned when user's input required to relogin and/or reissue new certificate.\nvar ErrUserInputRequired = errors.New(\"user input required\")\n\n// reissueCertIfExpired checks if provided certificate has expired and\n// reissues it if needed, replacing the entry in the middleware cert map.\nfunc (m *KubeMiddleware) reissueCertIfExpired(ctx context.Context, cert tls.Certificate, teleportCluster, kubeCluster string) error {\n\tneedsReissue := false\n\tif len(cert.Certificate) == 0 {\n\t\tm.logger.InfoContext(ctx, \"missing TLS certificate, attempting to reissue a new one\")\n\t\tneedsReissue = true\n\t} else {\n\t\tx509Cert, err := utils.TLSCertLeaf(cert)\n\t\tif err != nil {\n\t\t\treturn trace.Wrap(err)\n\t\t}\n\t\tif err := utils.VerifyCertificateExpiry(x509Cert, m.clock); err != nil {\n\t\t\tneedsReissue = true\n\t\t}\n\t}\n\tif !needsReissue {","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/alpnproxy/kube.go#L267-L303","documentation":"Exported sentinel ErrUserInputRequired returned by the ALPN local proxy kube middleware when the client certificate for the request has expired and re-issuing it requires an interactive relogin (and possibly MFA) that only the user can perform; the proxy surfaces a Kubernetes-style error so the client (e.g. tsh kube login / kubectl) can prompt the user.","triggerScenarios":"Thrown at lib/srv/alpnproxy/kube.go:285 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Follow the client-side prompt to relogin (tsh login) and reissue certificates","Re-run tsh proxy kube or tsh kube login to obtain a fresh certificate","Ensure MFA devices are available if the cluster requires per-session MFA"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}