gravitational/teleport · error

user input required

Error message

user input required

What it means

Exported sentinel ErrUserInputRequired returned by the ALPN local proxy kube middleware when the client certificate for the request has expired and re-issuing it requires an interactive relogin (and possibly MFA) that only the user can perform; the proxy surfaces a Kubernetes-style error so the client (e.g. tsh kube login / kubectl) can prompt the user.

Source

Thrown at lib/srv/alpnproxy/kube.go:285

func (m *KubeMiddleware) getCertForRequest(req *http.Request) (tls.Certificate, error) {
	tc, kc, err := m.resolveClusterKey(req)
	if err != nil {
		return tls.Certificate{}, trace.Wrap(err)
	}
	return m.getCert(tc, kc)
}

// GetClientCerts implements [LocalProxyHTTPMiddleware].
func (m *KubeMiddleware) GetClientCerts(req *http.Request) ([]tls.Certificate, bool, error) {
	cert, err := m.getCertForRequest(req)
	if err != nil {
		return nil, false, trace.Wrap(err)
	}
	return []tls.Certificate{cert}, true, nil
}

// ErrUserInputRequired returned when user's input required to relogin and/or reissue new certificate.
var ErrUserInputRequired = errors.New("user input required")

// reissueCertIfExpired checks if provided certificate has expired and
// reissues it if needed, replacing the entry in the middleware cert map.
func (m *KubeMiddleware) reissueCertIfExpired(ctx context.Context, cert tls.Certificate, teleportCluster, kubeCluster string) error {
	needsReissue := false
	if len(cert.Certificate) == 0 {
		m.logger.InfoContext(ctx, "missing TLS certificate, attempting to reissue a new one")
		needsReissue = true
	} else {
		x509Cert, err := utils.TLSCertLeaf(cert)
		if err != nil {
			return trace.Wrap(err)
		}
		if err := utils.VerifyCertificateExpiry(x509Cert, m.clock); err != nil {
			needsReissue = true
		}
	}
	if !needsReissue {

View on GitHub (pinned to 1283425b60)

Solutions

1. Follow the client-side prompt to relogin (tsh login) and reissue certificates
2. Re-run tsh proxy kube or tsh kube login to obtain a fresh certificate
3. Ensure MFA devices are available if the cluster requires per-session MFA

When it happens

Trigger: Thrown at lib/srv/alpnproxy/kube.go:285 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/24e925422672f353. Report an issue: GitHub.