{"record":{"id":"5bac3a74f54b5b6a","repo":"gravitational/teleport","slug":"moderated-sessions-w","errorCode":null,"errorMessage":"moderated sessions: %w","messagePattern":"moderated sessions: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/auth.go","lineNumber":7727,"sourceCode":"\t\t\tCode: events.AppDeleteCode,\n\t\t},\n\t\tUserMetadata: authz.ClientUserMetadata(ctx),\n\t\tResourceMetadata: apievents.ResourceMetadata{\n\t\t\tName: name,\n\t\t},\n\t}); err != nil {\n\t\ta.logger.WarnContext(ctx, \"Failed to emit app delete event\", \"error\", err)\n\t}\n\treturn nil\n}\n\n// CreateSessionTracker creates a tracker resource for an active session.\nfunc (a *Server) CreateSessionTracker(ctx context.Context, tracker types.SessionTracker) (types.SessionTracker, error) {\n\t// Don't allow sessions that require moderation without the enterprise feature enabled.\n\tfor _, policySet := range tracker.GetHostPolicySets() {\n\t\tif len(policySet.RequireSessionJoin) != 0 {\n\t\t\tif a.modules.BuildType() != modules.BuildEnterprise {\n\t\t\t\treturn nil, fmt.Errorf(\"moderated sessions: %w\", ErrRequiresEnterprise)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn a.Services.CreateSessionTracker(ctx, tracker)\n}\n\n// CreateDatabase creates a new database resource.\nfunc (a *Server) CreateDatabase(ctx context.Context, database types.Database) error {\n\tif err := a.Services.CreateDatabase(ctx, database); err != nil {\n\t\treturn trace.Wrap(err)\n\t}\n\tif err := a.emitter.EmitAuditEvent(ctx, &apievents.DatabaseCreate{\n\t\tMetadata: apievents.Metadata{\n\t\t\tType: events.DatabaseCreateEvent,\n\t\t\tCode: events.DatabaseCreateCode,\n\t\t},\n\t\tUserMetadata: authz.ClientUserMetadata(ctx),","sourceCodeStart":7709,"sourceCodeEnd":7745,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/auth.go#L7709-L7745","documentation":"CreateSessionTracker rejects session trackers whose host policy sets define RequireSessionJoin (moderated sessions) unless the binary is an Enterprise build. The error wraps ErrRequiresEnterprise, so sessions that would need a moderator cannot be tracked on OSS builds. It fires before the tracker is persisted via a.Services.CreateSessionTracker.","triggerScenarios":"Creating a session tracker (e.g. for SSH/kubectl access requests or moderated sessions) where any tracker.GetHostPolicySets()[i].RequireSessionJoin is non-empty while a.modules.BuildType() != modules.BuildEnterprise.","commonSituations":"OSS Teleport cluster with moderated-session role options (session_join policies) copied from Enterprise docs; access-request plugins configured with require_session_join on an OSS build; automated tests importing Enterprise role definitions.","solutions":["Upgrade the cluster to Teleport Enterprise, which supports moderated sessions.","Remove session_join / RequireSessionJoin policies from the roles in the host policy sets so sessions don't require moderation.","Verify build type with `teleport version` (OSS vs Enterprise) before enabling moderated-session policies."],"exampleFix":"// before (role spec, OSS build)\nspec: { allow: { session_join: [{ modes: [observer], roles: [auditor] }] } }\n// after\nspec: { allow: {} } // or upgrade to Teleport Enterprise to keep session_join","handlingStrategy":"validation","validationCode":"for _, policySet := range tracker.GetHostPolicySets() {\n\tif len(policySet.RequireSessionJoin) != 0 && modules.BuildType() != modules.BuildEnterprise {\n\t\treturn errors.New(\"moderated sessions require Teleport Enterprise; strip session_join policies\")\n\t}\n}\ncreated, err := authServer.CreateSessionTracker(ctx, tracker)","typeGuard":null,"tryCatchPattern":"tracker, err := authServer.CreateSessionTracker(ctx, t)\nif err != nil {\n\tif strings.Contains(err.Error(), \"moderated sessions\") {\n\t\t// retry without RequireSessionJoin policies or surface upgrade requirement\n\t}\n}","preventionTips":["Audit roles for session_join options before enabling them on OSS clusters.","Check BuildType() at feature-flag level before emitting moderated-session policies.","Keep access-request/plugin configurations aligned with the cluster's edition (OSS vs Enterprise)."],"tags":["licensing","moderated-sessions","session-tracker","enterprise"],"backgroundTag":"enterprise-feature-license-required","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}