gravitational/teleport · error

cannot disable multi-factor authentication

Error message

cannot disable multi-factor authentication

What it means

Sentinel returned by Modules.ValidateResource (license/edition checks) when a cluster's auth preference change would turn off second-factor authentication while the current license or module set still requires MFA; callers in auth init wrap it with upgrade instructions.

Source

Thrown at lib/modules/modules.go:341

// SetModules sets the modules interface
func SetModules(m Modules) {
	mutex.Lock()
	defer mutex.Unlock()
	modules = m
}

// GetModules returns the modules interface. It only works in the auth service
// process, so any code that may be executed in a different context needs to
// obtain modules or derived options from an auth-specific caller or an RPC
// call to the auth server.
func GetModules() Modules {
	mutex.Lock()
	defer mutex.Unlock()
	return modules
}

var ErrCannotDisableSecondFactor = errors.New("cannot disable multi-factor authentication")

// ValidateResource performs additional resource checks.
func ValidateResource(res types.Resource) error {
	// todo(tross): DELETE WHEN ABLE TO [remove env var, leave insecure test mode]
	allowNoSecondFactor, _ := strconv.ParseBool(os.Getenv(teleport.EnvVarAllowNoSecondFactor))
	if GetModules().Features().Cloud ||
		(!allowNoSecondFactor && !IsInsecureTestMode()) {
		switch r := res.(type) {
		case types.AuthPreference:
			if !r.IsSecondFactorEnforced() {
				return trace.Wrap(ErrCannotDisableSecondFactor)
			}
		}
	}

	// All checks below are Cloud-specific.
	if !GetModules().Features().Cloud {
		return nil

View on GitHub (pinned to 1283425b60)

Solutions

1. Keep at least one second_factor method (webauthn, otp, or on) in the cluster_auth_preference
2. Upgrade the license/edition if you need to manage MFA settings differently

When it happens

Trigger: Thrown at lib/modules/modules.go:341 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/6dbc1cf6e6f122cc. Report an issue: GitHub.