gravitational/teleport · error

user has only invalid WebAuthn registrations, consider a use

Error message

user has only invalid WebAuthn registrations, consider a user reset

What it means

ErrInvalidCredentials signals a special NotFound case: the user exists but every WebAuthn device on record is registered to a different RelyingParty ID (RPID), so none of them can satisfy the current login. It is returned by begin/LoginFlow and surfaced through IsCredentialsError/VerifyCredentials. The fix is administrative, not user-side: reset the affected users or restore a working WebAuthn configuration.

Source

Thrown at lib/auth/webauthn/login_mfa.go:38

import (
	"context"
	"errors"

	"github.com/gravitational/trace"

	mfav1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v1"
	mfav2 "github.com/gravitational/teleport/api/gen/proto/go/teleport/mfa/v2"
	"github.com/gravitational/teleport/api/types"
	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
)

// ErrInvalidCredentials is a special kind of credential "NotFound" error, where
// the user has only devices registered to other RPIDs.
// Possible fixes include reseting the affected users (likely the entire
// cluster), or rolling back to a good WebAuthn configuration (if still
// possible).
var ErrInvalidCredentials = errors.New("user has only invalid WebAuthn registrations, consider a user reset")

// LoginIdentity represents the subset of Identity methods used by LoginFlow.
// It exists to better scope LoginFlow's use of Identity and to facilitate
// testing.
type LoginIdentity interface {
	GetWebauthnLocalAuth(ctx context.Context, user string) (*types.WebauthnLocalAuth, error)

	GetMFADevices(ctx context.Context, user string, withSecrets bool) ([]*types.MFADevice, error)
	UpsertMFADevice(ctx context.Context, user string, d *types.MFADevice) error
	UpsertWebauthnSessionData(ctx context.Context, user, sessionID string, sd *wantypes.SessionData) error
	GetWebauthnSessionData(ctx context.Context, user, sessionID string) (*wantypes.SessionData, error)
	DeleteWebauthnSessionData(ctx context.Context, user, sessionID string) error
}

// WithDevices returns a LoginIdentity backed by a fixed set of devices.
// The supplied devices are returned in all GetMFADevices calls.
func WithDevices(identity LoginIdentity, devs []*types.MFADevice) LoginIdentity {
	return &loginWithDevices{

View on GitHub (pinned to 1283425b60)

Solutions

1. Restore the original WebAuthn configuration (the same RPID as when devices were registered) if a rollback is still possible.
2. Reset the affected users' MFA devices: tctl mfa reset or have users re-register via tsh mfa add after admin reset.
3. If the whole cluster is affected, plan a coordinated user reset across the cluster.
4. Before changing RPID, follow Teleport docs on WebAuthn RPID migration to avoid orphaned registrations.

Example fix

# before (auth_server config with new RPID while users are registered to old one)
# after: restore previous RPID or reset users
$ tctl mfa reset --user=alice

// server-side: compare cluster RPID to the RPID embedded in users' registered credentials before login

if wanlib.IsCredentialsError(err) {
	// treat as RPID-invalid case; prompt admin reset instead of re-registration
}

resp, err := flow.Login(ctx, req)
if wanlib.IsCredentialsError(err) {
	return trace.BadParameter("your MFA devices are registered to a different RPID; contact an admin to reset MFA")
}

When it happens

Trigger: Login at webauthn/login.go:157 when all of a user's credentials fail RPID validation (foundInvalid=true, len(u.credentials)==0), typically during webauthn.Begin / LoginFlow MFA or passwordless login.

Common situations: Cluster's WebAuthn RPID (auth_server config) changed after devices were registered (e.g. moving from hostname to cluster name); rollback to older teleport after RPID migration; restoring a cluster under a different public address.

Related errors

• credential not found
• webauthn error code %v and syscall err: %v
• webauthn error code %v
• touch ID not available
• cannot fulfill credential parameters, only ES256 are support

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/ebb639f756fad033. Report an issue: GitHub.