Teleport fails to restart if OIDC user has MFA

[stevenGravy]

Description

What happened:

A MFA device is added to a OIDC user. If Teleport is restarted after that OIDC user expires Teleport will fail to start, at least for the sqllite storage option.

INFO [AUTH]      Updating cluster configuration: AuthPreference(Type="oidc",SecondFactor="u2f"). auth/init.go:292
INFO [AUTH]      Created namespace: "default". auth/init.go:299
ERROR: initialization failed
cannot itemTo user "[email protected]" without primary item "params"

What you expected to happen:

No failure to start if MFA stored for OIDC/SAML users.

Reproduction Steps

As minimally and precisely as possible, describe step-by-step how to reproduce the problem.

1. Configure MFA in Teleport with u2f such as adding this to the auth_service

  authentication:
   type: oidc
   second_factor: u2f
   u2f:
      app_id: https://teleport.example.com:3080
      facets:
      - https://teleport.example.com:3080
      - https://teleport.example.com
      - teleport.example.com:3080
      - teleport.example.com

2. Add a OIDC connector such as Auth0
   3.Login via OIDC with a user with a role that as a low ttl (30m).
3. add a MFA to that user.
4. Log out
5. Confirm the user has been removed from the list of users after a certain time
6. Restarted Teleport

Server Details

• Teleport version (run teleport version): 6.1.3
• Server OS (e.g. from /etc/os-release): ubuntu
• Where are you running Teleport? (e.g. AWS, GCP, Dedicated Hardware): AWS ec2
• Additional details:

[stevenGravy]

@awly fyi

[stevenGravy]

the workaround is to remove any /web/users entries for non local users.

[awly]

Will be fixed in 6.2