gravitational/teleport · error

deny.body

Error message

deny.body

What it means

In enforceMinimalV9's deny path, this is the body text ('deny.body') written to the response when a v9-governed app request is denied — including the version-skew case where the user's roles carry app_resources rules or role versions this Teleport version does not implement, and unimplemented rules deny by default.

Source

Thrown at lib/srv/app/appresources.go:216

	if len(decision.droppedRoles) > 0 && c.v9WarnOnce("drop", identity.Username, app.GetName()) {
		log.WarnContext(r.Context(), "Dropped v8-or-older roles that grant a v9-governed app; v8 roles cannot re-open unrestricted access.", "dropped_roles", decision.droppedRoles)
	}

	if decision.allowed {
		return false, nil
	}

	if decision.versionSkew && c.v9WarnOnce("skew", identity.Username, app.GetName()) {
		log.WarnContext(r.Context(), "Denied app request: the user's roles carry app_resources rules or role versions that this Teleport version does not implement, and unimplemented rules deny by default. Upgrade this app agent to enforce the intended rules.")
	}

	if isCORSPreflight(r) && c.v9WarnOnce("cors", identity.Username, app.GetName()) {
		log.WarnContext(r.Context(), "Denied CORS preflight: the app denies requests by default and no v9 rule allows OPTIONS.")
	}

	deny := newDenyResponse(decision)
	c.emitRequestDenied(r, &identity, app, deny.kind)
	http.Error(w, deny.body, deny.status)
	return true, nil
}

// isGovernedByAppResources reports whether v9 app_resources rules govern this
// app type.
func isGovernedByAppResources(app types.Application) bool {
	return !app.IsAWSConsole() && !app.IsAzureCloud() && !app.IsGCP() && !app.IsLLM() &&
		app.GetSubKind() != types.KindIdentityCenterAccount
}

// emitRequestDenied emits one audit event for a request denied under
// fine-grained app access roles. The event is not rate limited.
func (c *ConnectionsHandler) emitRequestDenied(r *http.Request, identity *tlsca.Identity, app types.Application, denyKind appresource.DenyKind) {
	event := &apievents.AppSessionRequestDenied{
		Metadata: apievents.Metadata{
			Type:        events.AppSessionRequestDeniedEvent,
			Code:        events.AppSessionRequestDeniedCode,
			ClusterName: identity.RouteToApp.ClusterName,

View on GitHub (pinned to 1283425b60)

Solutions

1. Upgrade Teleport to a version that implements the v9 app_resources rules in the user's roles
2. Adjust the user's roles to remove unsupported v9 rules
3. Consult the app access v9 upgrade documentation for role migration

When it happens

Trigger: Thrown at lib/srv/app/appresources.go:216 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/96a4acdfbb8294ba. Report an issue: GitHub.