gravitational/teleport · error

moderated sessions: %w

Error message

moderated sessions: %w

What it means

CreateSessionTracker rejects session trackers whose host policy sets define RequireSessionJoin (moderated sessions) unless the binary is an Enterprise build. The error wraps ErrRequiresEnterprise, so sessions that would need a moderator cannot be tracked on OSS builds. It fires before the tracker is persisted via a.Services.CreateSessionTracker.

Source

Thrown at lib/auth/auth.go:7727

			Code: events.AppDeleteCode,
		},
		UserMetadata: authz.ClientUserMetadata(ctx),
		ResourceMetadata: apievents.ResourceMetadata{
			Name: name,
		},
	}); err != nil {
		a.logger.WarnContext(ctx, "Failed to emit app delete event", "error", err)
	}
	return nil
}

// CreateSessionTracker creates a tracker resource for an active session.
func (a *Server) CreateSessionTracker(ctx context.Context, tracker types.SessionTracker) (types.SessionTracker, error) {
	// Don't allow sessions that require moderation without the enterprise feature enabled.
	for _, policySet := range tracker.GetHostPolicySets() {
		if len(policySet.RequireSessionJoin) != 0 {
			if a.modules.BuildType() != modules.BuildEnterprise {
				return nil, fmt.Errorf("moderated sessions: %w", ErrRequiresEnterprise)
			}
		}
	}

	return a.Services.CreateSessionTracker(ctx, tracker)
}

// CreateDatabase creates a new database resource.
func (a *Server) CreateDatabase(ctx context.Context, database types.Database) error {
	if err := a.Services.CreateDatabase(ctx, database); err != nil {
		return trace.Wrap(err)
	}
	if err := a.emitter.EmitAuditEvent(ctx, &apievents.DatabaseCreate{
		Metadata: apievents.Metadata{
			Type: events.DatabaseCreateEvent,
			Code: events.DatabaseCreateCode,
		},
		UserMetadata: authz.ClientUserMetadata(ctx),

View on GitHub (pinned to 1283425b60)

Solutions

1. Upgrade the cluster to Teleport Enterprise, which supports moderated sessions.
2. Remove session_join / RequireSessionJoin policies from the roles in the host policy sets so sessions don't require moderation.
3. Verify build type with `teleport version` (OSS vs Enterprise) before enabling moderated-session policies.

Example fix

// before (role spec, OSS build)
spec: { allow: { session_join: [{ modes: [observer], roles: [auditor] }] } }
// after
spec: { allow: {} } // or upgrade to Teleport Enterprise to keep session_join

for _, policySet := range tracker.GetHostPolicySets() {
	if len(policySet.RequireSessionJoin) != 0 && modules.BuildType() != modules.BuildEnterprise {
		return errors.New("moderated sessions require Teleport Enterprise; strip session_join policies")
	}
}
created, err := authServer.CreateSessionTracker(ctx, tracker)

tracker, err := authServer.CreateSessionTracker(ctx, t)
if err != nil {
	if strings.Contains(err.Error(), "moderated sessions") {
		// retry without RequireSessionJoin policies or surface upgrade requirement
	}
}

When it happens

Trigger: Creating a session tracker (e.g. for SSH/kubectl access requests or moderated sessions) where any tracker.GetHostPolicySets()[i].RequireSessionJoin is non-empty while a.modules.BuildType() != modules.BuildEnterprise.

Common situations: OSS Teleport cluster with moderated-session role options (session_join policies) copied from Enterprise docs; access-request plugins configured with require_session_join on an OSS build; automated tests importing Enterprise role definitions.

Related errors

• TAG feature is not enabled
• PKCS11 HSM support requires a license with the HSM feature e
• GCP KMS support requires a license with the HSM feature enab
• AWS KMS support requires a license with the HSM feature enab

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/5bac3a74f54b5b6a. Report an issue: GitHub.