diff --git a/api/proto/teleport/legacy/types/webauthn/webauthn.proto b/api/proto/teleport/legacy/types/webauthn/webauthn.proto
index e96abaca38f3f..ed65e27278847 100644
--- a/api/proto/teleport/legacy/types/webauthn/webauthn.proto
+++ b/api/proto/teleport/legacy/types/webauthn/webauthn.proto
@@ -37,17 +37,6 @@ option go_package = "github.com/gravitational/teleport/api/types/webauthn;webaut
 option (gogoproto.marshaler_all) = true;
 option (gogoproto.unmarshaler_all) = true;
 
-// -----------------------------------------------------------------------------
-// WebAuthn messages used by server storage.
-// -----------------------------------------------------------------------------
-
-// User represents a WebAuthn user.
-// Used mainly to correlated a WebAuthn user handle with a Teleport user.
-message User {
-  // Teleport user ID.
-  string teleport_user = 1;
-}
-
 // -----------------------------------------------------------------------------
 // Assertion (aka login).
 // -----------------------------------------------------------------------------
diff --git a/api/types/webauthn/webauthn.pb.go b/api/types/webauthn/webauthn.pb.go
index c7664972f2089..0f221fce38173 100644
--- a/api/types/webauthn/webauthn.pb.go
+++ b/api/types/webauthn/webauthn.pb.go
@@ -39,56 +39,6 @@ var _ = math.Inf
 // proto package needs to be updated.
 const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
-// User represents a WebAuthn user.
-// Used mainly to correlated a WebAuthn user handle with a Teleport user.
-type User struct {
-	// Teleport user ID.
-	TeleportUser         string   `protobuf:"bytes,1,opt,name=teleport_user,json=teleportUser,proto3" json:"teleport_user,omitempty"`
-	XXX_NoUnkeyedLiteral struct{} `json:"-"`
-	XXX_unrecognized     []byte   `json:"-"`
-	XXX_sizecache        int32    `json:"-"`
-}
-
-func (m *User) Reset()         { *m = User{} }
-func (m *User) String() string { return proto.CompactTextString(m) }
-func (*User) ProtoMessage()    {}
-func (*User) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{0}
-}
-func (m *User) XXX_Unmarshal(b []byte) error {
-	return m.Unmarshal(b)
-}
-func (m *User) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
-	if deterministic {
-		return xxx_messageInfo_User.Marshal(b, m, deterministic)
-	} else {
-		b = b[:cap(b)]
-		n, err := m.MarshalToSizedBuffer(b)
-		if err != nil {
-			return nil, err
-		}
-		return b[:n], nil
-	}
-}
-func (m *User) XXX_Merge(src proto.Message) {
-	xxx_messageInfo_User.Merge(m, src)
-}
-func (m *User) XXX_Size() int {
-	return m.Size()
-}
-func (m *User) XXX_DiscardUnknown() {
-	xxx_messageInfo_User.DiscardUnknown(m)
-}
-
-var xxx_messageInfo_User proto.InternalMessageInfo
-
-func (m *User) GetTeleportUser() string {
-	if m != nil {
-		return m.TeleportUser
-	}
-	return ""
-}
-
 // Credential assertion used for login ceremonies.
 type CredentialAssertion struct {
 	PublicKey            *PublicKeyCredentialRequestOptions `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
@@ -101,7 +51,7 @@ func (m *CredentialAssertion) Reset()         { *m = CredentialAssertion{} }
 func (m *CredentialAssertion) String() string { return proto.CompactTextString(m) }
 func (*CredentialAssertion) ProtoMessage()    {}
 func (*CredentialAssertion) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{1}
+	return fileDescriptor_0d490a6db28e8798, []int{0}
 }
 func (m *CredentialAssertion) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -162,7 +112,7 @@ func (m *PublicKeyCredentialRequestOptions) Reset()         { *m = PublicKeyCred
 func (m *PublicKeyCredentialRequestOptions) String() string { return proto.CompactTextString(m) }
 func (*PublicKeyCredentialRequestOptions) ProtoMessage()    {}
 func (*PublicKeyCredentialRequestOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{2}
+	return fileDescriptor_0d490a6db28e8798, []int{1}
 }
 func (m *PublicKeyCredentialRequestOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -253,7 +203,7 @@ func (m *CredentialAssertionResponse) Reset()         { *m = CredentialAssertion
 func (m *CredentialAssertionResponse) String() string { return proto.CompactTextString(m) }
 func (*CredentialAssertionResponse) ProtoMessage()    {}
 func (*CredentialAssertionResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{3}
+	return fileDescriptor_0d490a6db28e8798, []int{2}
 }
 func (m *CredentialAssertionResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -333,7 +283,7 @@ func (m *AuthenticatorAssertionResponse) Reset()         { *m = AuthenticatorAss
 func (m *AuthenticatorAssertionResponse) String() string { return proto.CompactTextString(m) }
 func (*AuthenticatorAssertionResponse) ProtoMessage()    {}
 func (*AuthenticatorAssertionResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{4}
+	return fileDescriptor_0d490a6db28e8798, []int{3}
 }
 func (m *AuthenticatorAssertionResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -402,7 +352,7 @@ func (m *CredentialCreation) Reset()         { *m = CredentialCreation{} }
 func (m *CredentialCreation) String() string { return proto.CompactTextString(m) }
 func (*CredentialCreation) ProtoMessage()    {}
 func (*CredentialCreation) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{5}
+	return fileDescriptor_0d490a6db28e8798, []int{4}
 }
 func (m *CredentialCreation) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -473,7 +423,7 @@ func (m *PublicKeyCredentialCreationOptions) Reset()         { *m = PublicKeyCre
 func (m *PublicKeyCredentialCreationOptions) String() string { return proto.CompactTextString(m) }
 func (*PublicKeyCredentialCreationOptions) ProtoMessage()    {}
 func (*PublicKeyCredentialCreationOptions) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{6}
+	return fileDescriptor_0d490a6db28e8798, []int{5}
 }
 func (m *PublicKeyCredentialCreationOptions) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -585,7 +535,7 @@ func (m *CredentialCreationResponse) Reset()         { *m = CredentialCreationRe
 func (m *CredentialCreationResponse) String() string { return proto.CompactTextString(m) }
 func (*CredentialCreationResponse) ProtoMessage()    {}
 func (*CredentialCreationResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{7}
+	return fileDescriptor_0d490a6db28e8798, []int{6}
 }
 func (m *CredentialCreationResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -661,7 +611,7 @@ func (m *AuthenticatorAttestationResponse) Reset()         { *m = AuthenticatorA
 func (m *AuthenticatorAttestationResponse) String() string { return proto.CompactTextString(m) }
 func (*AuthenticatorAttestationResponse) ProtoMessage()    {}
 func (*AuthenticatorAttestationResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{8}
+	return fileDescriptor_0d490a6db28e8798, []int{7}
 }
 func (m *AuthenticatorAttestationResponse) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -721,7 +671,7 @@ func (m *AuthenticationExtensionsClientInputs) Reset()         { *m = Authentica
 func (m *AuthenticationExtensionsClientInputs) String() string { return proto.CompactTextString(m) }
 func (*AuthenticationExtensionsClientInputs) ProtoMessage()    {}
 func (*AuthenticationExtensionsClientInputs) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{9}
+	return fileDescriptor_0d490a6db28e8798, []int{8}
 }
 func (m *AuthenticationExtensionsClientInputs) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -774,7 +724,7 @@ func (m *AuthenticationExtensionsClientOutputs) Reset()         { *m = Authentic
 func (m *AuthenticationExtensionsClientOutputs) String() string { return proto.CompactTextString(m) }
 func (*AuthenticationExtensionsClientOutputs) ProtoMessage()    {}
 func (*AuthenticationExtensionsClientOutputs) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{10}
+	return fileDescriptor_0d490a6db28e8798, []int{9}
 }
 func (m *AuthenticationExtensionsClientOutputs) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -830,7 +780,7 @@ func (m *AuthenticatorSelection) Reset()         { *m = AuthenticatorSelection{}
 func (m *AuthenticatorSelection) String() string { return proto.CompactTextString(m) }
 func (*AuthenticatorSelection) ProtoMessage()    {}
 func (*AuthenticatorSelection) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{11}
+	return fileDescriptor_0d490a6db28e8798, []int{10}
 }
 func (m *AuthenticatorSelection) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -896,7 +846,7 @@ func (m *CredentialDescriptor) Reset()         { *m = CredentialDescriptor{} }
 func (m *CredentialDescriptor) String() string { return proto.CompactTextString(m) }
 func (*CredentialDescriptor) ProtoMessage()    {}
 func (*CredentialDescriptor) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{12}
+	return fileDescriptor_0d490a6db28e8798, []int{11}
 }
 func (m *CredentialDescriptor) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -958,7 +908,7 @@ func (m *CredentialParameter) Reset()         { *m = CredentialParameter{} }
 func (m *CredentialParameter) String() string { return proto.CompactTextString(m) }
 func (*CredentialParameter) ProtoMessage()    {}
 func (*CredentialParameter) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{13}
+	return fileDescriptor_0d490a6db28e8798, []int{12}
 }
 func (m *CredentialParameter) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1016,7 +966,7 @@ func (m *RelyingPartyEntity) Reset()         { *m = RelyingPartyEntity{} }
 func (m *RelyingPartyEntity) String() string { return proto.CompactTextString(m) }
 func (*RelyingPartyEntity) ProtoMessage()    {}
 func (*RelyingPartyEntity) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{14}
+	return fileDescriptor_0d490a6db28e8798, []int{13}
 }
 func (m *RelyingPartyEntity) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1081,7 +1031,7 @@ func (m *UserEntity) Reset()         { *m = UserEntity{} }
 func (m *UserEntity) String() string { return proto.CompactTextString(m) }
 func (*UserEntity) ProtoMessage()    {}
 func (*UserEntity) Descriptor() ([]byte, []int) {
-	return fileDescriptor_0d490a6db28e8798, []int{15}
+	return fileDescriptor_0d490a6db28e8798, []int{14}
 }
 func (m *UserEntity) XXX_Unmarshal(b []byte) error {
 	return m.Unmarshal(b)
@@ -1132,7 +1082,6 @@ func (m *UserEntity) GetDisplayName() string {
 }
 
 func init() {
-	proto.RegisterType((*User)(nil), "webauthn.User")
 	proto.RegisterType((*CredentialAssertion)(nil), "webauthn.CredentialAssertion")
 	proto.RegisterType((*PublicKeyCredentialRequestOptions)(nil), "webauthn.PublicKeyCredentialRequestOptions")
 	proto.RegisterType((*CredentialAssertionResponse)(nil), "webauthn.CredentialAssertionResponse")
@@ -1155,102 +1104,66 @@ func init() {
 }
 
 var fileDescriptor_0d490a6db28e8798 = []byte{
-	// 962 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x56, 0x5d, 0x6f, 0x1b, 0x45,
-	0x17, 0xd6, 0xda, 0xeb, 0xbc, 0xf1, 0xb1, 0xdf, 0xca, 0x99, 0xb8, 0xc5, 0x2a, 0xad, 0x71, 0x17,
-	0x90, 0x2c, 0xd2, 0xc6, 0x28, 0x5c, 0x41, 0x05, 0x28, 0x24, 0x45, 0x24, 0x51, 0xeb, 0x68, 0x10,
-	0x48, 0x70, 0xb3, 0x1a, 0xef, 0x1e, 0xec, 0x29, 0xeb, 0xdd, 0xe9, 0xcc, 0x6c, 0x53, 0x8b, 0x9f,
-	0xc4, 0x1d, 0x57, 0xdc, 0x71, 0xcb, 0x25, 0xff, 0x80, 0x2a, 0xbf, 0x04, 0xed, 0xec, 0x97, 0x3f,
-	0x36, 0x4d, 0x00, 0x89, 0xbb, 0xd9, 0x73, 0xce, 0x73, 0xce, 0xcc, 0x33, 0xe7, 0x39, 0x3b, 0xf0,
-	0x48, 0x63, 0x80, 0x22, 0x92, 0x7a, 0x14, 0xe0, 0x94, 0x79, 0x8b, 0x91, 0x5e, 0x08, 0x54, 0xa3,
-	0x0b, 0x9c, 0xb0, 0x58, 0xcf, 0xc2, 0x62, 0xb1, 0x2f, 0x64, 0xa4, 0x23, 0xb2, 0x9d, 0x7f, 0xdf,
-	0xed, 0x4e, 0xa3, 0x69, 0x64, 0x8c, 0xa3, 0x64, 0x95, 0xfa, 0x9d, 0x3d, 0xb0, 0xbf, 0x51, 0x28,
-	0xc9, 0xbb, 0xf0, 0xff, 0x3c, 0xb1, 0x1b, 0x2b, 0x94, 0x3d, 0x6b, 0x60, 0x0d, 0x9b, 0xb4, 0x9d,
-	0x1b, 0x93, 0x20, 0x87, 0xc1, 0xee, 0x91, 0x44, 0x1f, 0x43, 0xcd, 0x59, 0x70, 0xa8, 0x14, 0x4a,
-	0xcd, 0xa3, 0x90, 0x9c, 0x02, 0x88, 0x78, 0x12, 0x70, 0xcf, 0xfd, 0x11, 0x17, 0x06, 0xd8, 0x3a,
-	0xd8, 0xdb, 0x2f, 0x36, 0x72, 0x6e, 0x7c, 0x67, 0xb8, 0x28, 0xb1, 0x14, 0x5f, 0xc4, 0xa8, 0xf4,
-	0x58, 0x24, 0x78, 0x45, 0x9b, 0x22, 0x0f, 0x71, 0x7e, 0xab, 0xc1, 0x83, 0x6b, 0x01, 0xe4, 0x1e,
-	0x34, 0xbd, 0x19, 0x0b, 0x02, 0x0c, 0xa7, 0x68, 0x0a, 0xb6, 0x69, 0x69, 0x20, 0xf7, 0x01, 0x34,
-	0x9f, 0x63, 0x14, 0x6b, 0x77, 0xae, 0x7a, 0xb5, 0x81, 0x35, 0xac, 0xd3, 0x66, 0x66, 0x79, 0xaa,
-	0xc8, 0x2e, 0x34, 0xa4, 0x70, 0xb9, 0xdf, 0xab, 0x9b, 0x23, 0xda, 0x52, 0x9c, 0xf8, 0xe4, 0x0c,
-	0x76, 0x58, 0x10, 0x44, 0x17, 0xae, 0x57, 0xd4, 0x54, 0x3d, 0x7b, 0x50, 0x1f, 0xb6, 0x0e, 0xfa,
-	0xe5, 0x51, 0xca, 0x0d, 0x1d, 0xa3, 0xf2, 0x24, 0x17, 0x3a, 0x92, 0xb4, 0x63, 0x80, 0xa5, 0x4b,
-	0x91, 0x67, 0x00, 0xf8, 0x4a, 0x63, 0xa8, 0x92, 0xcd, 0xf6, 0x1a, 0x86, 0x90, 0xfd, 0x32, 0xcb,
-	0x61, 0xac, 0x67, 0x49, 0xa8, 0xc7, 0x92, 0xd3, 0x3c, 0x29, 0x22, 0x8f, 0x02, 0x8e, 0xa1, 0x3e,
-	0x09, 0x45, 0xac, 0x15, 0x5d, 0xca, 0x40, 0xf6, 0x60, 0x27, 0xb9, 0x13, 0xf7, 0x25, 0x4a, 0xfe,
-	0x43, 0x06, 0xeb, 0x6d, 0x99, 0xdd, 0x77, 0x12, 0xc7, 0xb7, 0x4b, 0x76, 0xe7, 0x4f, 0x0b, 0xde,
-	0xae, 0xb8, 0x25, 0x8a, 0x4a, 0x44, 0xa1, 0x42, 0x42, 0xc0, 0x4e, 0x5a, 0x26, 0xbb, 0x60, 0xb3,
-	0x26, 0xb7, 0x61, 0x4b, 0xb2, 0x8b, 0x84, 0x93, 0x9a, 0x21, 0xb3, 0x21, 0xd9, 0xc5, 0x89, 0x4f,
-	0x8e, 0x61, 0x5b, 0x66, 0x30, 0x43, 0x56, 0xeb, 0x60, 0x58, 0x79, 0x8a, 0x48, 0x6e, 0x94, 0xa1,
-	0x05, 0x92, 0x8c, 0x57, 0xd8, 0xb0, 0x4d, 0x9e, 0xd1, 0x4d, 0xd9, 0x18, 0xc7, 0x7a, 0x9d, 0x0e,
-	0xe7, 0x57, 0x0b, 0xfa, 0x6f, 0xae, 0x4e, 0x86, 0xd0, 0xf1, 0x0c, 0xde, 0xf5, 0x99, 0x66, 0xee,
-	0x73, 0x15, 0x85, 0x59, 0x9f, 0xdc, 0x4a, 0xed, 0xc7, 0x4c, 0xb3, 0x53, 0x15, 0x85, 0xe4, 0x11,
-	0x10, 0xb6, 0x9c, 0xcb, 0x00, 0x32, 0x1a, 0x76, 0x56, 0x3c, 0x09, 0x24, 0xe9, 0x3c, 0xc5, 0xa7,
-	0x21, 0xd3, 0xb1, 0x4c, 0x39, 0x69, 0xd3, 0xd2, 0x40, 0xde, 0x81, 0x96, 0xb9, 0xa8, 0x19, 0x0b,
-	0xfd, 0x00, 0xcd, 0x59, 0xdb, 0x14, 0x12, 0xd3, 0x57, 0xc6, 0xe2, 0x30, 0x20, 0xe5, 0xdd, 0x1c,
-	0x49, 0x34, 0x67, 0x26, 0x67, 0x15, 0x02, 0x7a, 0xf8, 0x46, 0x01, 0xe5, 0xd0, 0x0a, 0x05, 0xfd,
-	0x6c, 0x83, 0x73, 0x3d, 0xe2, 0x1a, 0x09, 0x3d, 0x84, 0x9a, 0x14, 0x86, 0x85, 0xd6, 0xc1, 0xbd,
-	0x72, 0x27, 0x14, 0x83, 0x05, 0x0f, 0xa7, 0xe7, 0x4c, 0xea, 0xc5, 0x93, 0x50, 0x73, 0xbd, 0xa0,
-	0x35, 0x29, 0xc8, 0x10, 0x6c, 0x33, 0x33, 0xd2, 0x1e, 0xe9, 0x96, 0xf1, 0xc9, 0xd4, 0xc8, 0xe2,
-	0x4c, 0x04, 0xa1, 0x70, 0xbb, 0x14, 0x98, 0x2b, 0x98, 0x64, 0x73, 0xd4, 0x28, 0x73, 0xa9, 0xdd,
-	0xaf, 0x92, 0xda, 0x79, 0x1e, 0x45, 0xbb, 0xde, 0xa6, 0x51, 0xad, 0xc9, 0xbd, 0xb1, 0x2e, 0xf7,
-	0x31, 0xec, 0xe2, 0x2b, 0x2f, 0x88, 0x7d, 0x5c, 0xd1, 0xf6, 0xd6, 0x8d, 0xb4, 0x4d, 0x32, 0xe8,
-	0xb2, 0xba, 0x07, 0xd0, 0x62, 0x5a, 0xa3, 0xd2, 0xa9, 0x0e, 0xff, 0x67, 0x74, 0xb4, 0x6c, 0x5a,
-	0xd3, 0xff, 0xf6, 0xbf, 0xd6, 0xff, 0x77, 0xf0, 0xd6, 0x6a, 0x8f, 0x2a, 0x0c, 0xd0, 0x33, 0xd5,
-	0x9b, 0x26, 0xf9, 0xe0, 0x0a, 0x59, 0x7e, 0x9d, 0xc7, 0xd1, 0x3b, 0xac, 0xd2, 0xee, 0xbc, 0xb6,
-	0xe0, 0xee, 0x66, 0x93, 0xfc, 0x93, 0x61, 0xf1, 0xe5, 0xc6, 0xb0, 0xf8, 0xe0, 0xaa, 0x61, 0x51,
-	0x52, 0xf5, 0x5f, 0x8c, 0x8b, 0x9f, 0x60, 0x70, 0x5d, 0xf9, 0xbf, 0x39, 0x2f, 0xca, 0x04, 0x6e,
-	0x34, 0x79, 0x8e, 0x9e, 0x2e, 0xe6, 0x45, 0xe9, 0x19, 0x1b, 0x87, 0xf3, 0x29, 0xbc, 0x77, 0x93,
-	0xeb, 0x4e, 0x48, 0x65, 0xc2, 0xfc, 0x95, 0x52, 0xaa, 0x1b, 0x4c, 0x88, 0x13, 0xdf, 0xf9, 0x0c,
-	0xde, 0xbf, 0xd1, 0x81, 0xd7, 0xf0, 0xdb, 0x39, 0xfe, 0x17, 0x0b, 0xee, 0x54, 0x77, 0x04, 0xf9,
-	0x18, 0x7a, 0xab, 0x4d, 0xc5, 0xb4, 0x66, 0xde, 0x6c, 0x8e, 0xa1, 0xce, 0xf6, 0xb0, 0xda, 0x74,
-	0x87, 0x85, 0x9b, 0x7c, 0x08, 0x5d, 0x89, 0x2f, 0x62, 0x2e, 0xd1, 0x95, 0xa8, 0x78, 0xd2, 0x3c,
-	0x66, 0x72, 0xd5, 0x4c, 0x69, 0x92, 0xf9, 0x68, 0xe6, 0x3a, 0xc3, 0x45, 0xf5, 0x1f, 0xac, 0x7e,
-	0xc5, 0x1f, 0xec, 0x13, 0xe8, 0x56, 0x89, 0xb1, 0xb2, 0x19, 0x6f, 0x41, 0xad, 0x68, 0xc4, 0x1a,
-	0xf7, 0x9d, 0xc7, 0xcb, 0x4f, 0x94, 0x62, 0x48, 0x54, 0x42, 0x3b, 0x50, 0x67, 0xc1, 0xd4, 0x60,
-	0x1b, 0x34, 0x59, 0x3a, 0xc7, 0x40, 0x36, 0x27, 0x5c, 0x56, 0x22, 0x45, 0xd6, 0xb8, 0x9f, 0xe4,
-	0x0a, 0xd9, 0x1c, 0x0d, 0xb0, 0x49, 0xcd, 0xfa, 0xd4, 0xde, 0xae, 0x77, 0x6c, 0x6a, 0x73, 0x2f,
-	0x0a, 0x1d, 0x17, 0xa0, 0x9c, 0x7b, 0x4b, 0xe8, 0xf6, 0x55, 0x68, 0xf2, 0x00, 0xda, 0x3e, 0x57,
-	0x22, 0x60, 0x0b, 0xd7, 0xf8, 0x52, 0x62, 0x5a, 0x99, 0xed, 0x59, 0x5a, 0xc0, 0xee, 0x34, 0xd2,
-	0x02, 0x5f, 0x3c, 0xfd, 0xfd, 0xb2, 0x6f, 0xfd, 0x71, 0xd9, 0xb7, 0x5e, 0x5f, 0xf6, 0xad, 0xef,
-	0x3f, 0x9f, 0x72, 0x3d, 0x8b, 0x27, 0xfb, 0x5e, 0x34, 0x1f, 0x4d, 0x25, 0x7b, 0xc9, 0xd3, 0xfe,
-	0x63, 0xc1, 0xa8, 0x78, 0x29, 0x32, 0xc1, 0xd7, 0x9e, 0x89, 0x8f, 0xf3, 0x85, 0x98, 0x4c, 0xb6,
-	0xcc, 0x4b, 0xf0, 0xa3, 0xbf, 0x02, 0x00, 0x00, 0xff, 0xff, 0xbb, 0x5b, 0x9d, 0x27, 0x5a, 0x0a,
-	0x00, 0x00,
-}
-
-func (m *User) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalToSizedBuffer(dAtA[:size])
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *User) MarshalTo(dAtA []byte) (int, error) {
-	size := m.Size()
-	return m.MarshalToSizedBuffer(dAtA[:size])
-}
-
-func (m *User) MarshalToSizedBuffer(dAtA []byte) (int, error) {
-	i := len(dAtA)
-	_ = i
-	var l int
-	_ = l
-	if m.XXX_unrecognized != nil {
-		i -= len(m.XXX_unrecognized)
-		copy(dAtA[i:], m.XXX_unrecognized)
-	}
-	if len(m.TeleportUser) > 0 {
-		i -= len(m.TeleportUser)
-		copy(dAtA[i:], m.TeleportUser)
-		i = encodeVarintWebauthn(dAtA, i, uint64(len(m.TeleportUser)))
-		i--
-		dAtA[i] = 0xa
-	}
-	return len(dAtA) - i, nil
+	// 944 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xbc, 0x56, 0xdf, 0x8f, 0xdb, 0xc4,
+	0x13, 0x97, 0x13, 0xe7, 0xbe, 0xc9, 0x24, 0xaa, 0x72, 0x7b, 0x69, 0xbf, 0x51, 0x69, 0x43, 0x6a,
+	0x81, 0x14, 0xd1, 0xf6, 0x82, 0x8e, 0x27, 0xa8, 0x00, 0x1d, 0x77, 0x45, 0xdc, 0x9d, 0xda, 0x9c,
+	0x16, 0x81, 0x04, 0x2f, 0xd6, 0xc6, 0x1e, 0x92, 0x2d, 0x8e, 0xbd, 0xdd, 0x5d, 0xf7, 0x6a, 0xf1,
+	0x27, 0xf1, 0xc6, 0x13, 0x6f, 0xbc, 0xf2, 0xc8, 0x7f, 0x40, 0x75, 0x7f, 0x09, 0xf2, 0xda, 0xb1,
+	0xf3, 0xc3, 0xd7, 0x3b, 0x40, 0xe2, 0x6d, 0x3d, 0x33, 0x9f, 0x99, 0xdd, 0xcf, 0xce, 0x67, 0xbc,
+	0xf0, 0x58, 0x63, 0x80, 0x22, 0x92, 0x7a, 0x1c, 0xe0, 0x8c, 0x79, 0xc9, 0x58, 0x27, 0x02, 0xd5,
+	0xf8, 0x02, 0xa7, 0x2c, 0xd6, 0xf3, 0xb0, 0x58, 0xec, 0x0b, 0x19, 0xe9, 0x88, 0x34, 0x97, 0xdf,
+	0x77, 0x7b, 0xb3, 0x68, 0x16, 0x19, 0xe3, 0x38, 0x5d, 0x65, 0x7e, 0x87, 0xc1, 0xde, 0x91, 0x44,
+	0x1f, 0x43, 0xcd, 0x59, 0x70, 0xa8, 0x14, 0x4a, 0xcd, 0xa3, 0x90, 0x9c, 0x02, 0x88, 0x78, 0x1a,
+	0x70, 0xcf, 0xfd, 0x11, 0x93, 0xbe, 0x35, 0xb4, 0x46, 0xed, 0x83, 0x87, 0xfb, 0x45, 0xee, 0x73,
+	0xe3, 0x3b, 0xc3, 0xa4, 0xc4, 0x52, 0x7c, 0x19, 0xa3, 0xd2, 0x13, 0x91, 0xe2, 0x15, 0x6d, 0x89,
+	0x65, 0x88, 0xf3, 0x5b, 0x0d, 0x1e, 0x5c, 0x0b, 0x20, 0xf7, 0xa0, 0xe5, 0xcd, 0x59, 0x10, 0x60,
+	0x38, 0x43, 0x53, 0xb0, 0x43, 0x4b, 0x03, 0xb9, 0x0f, 0xa0, 0xf9, 0x02, 0xa3, 0x58, 0xbb, 0x0b,
+	0xd5, 0xaf, 0x0d, 0xad, 0x51, 0x9d, 0xb6, 0x72, 0xcb, 0x33, 0x45, 0xf6, 0xa0, 0x21, 0x85, 0xcb,
+	0xfd, 0x7e, 0x7d, 0x68, 0x8d, 0x5a, 0xd4, 0x96, 0xe2, 0xc4, 0x27, 0x67, 0xb0, 0xcb, 0x82, 0x20,
+	0xba, 0x70, 0xbd, 0xa2, 0xa6, 0xea, 0xdb, 0xc3, 0xfa, 0xa8, 0x7d, 0x30, 0x28, 0x8f, 0x52, 0x6e,
+	0xe8, 0x18, 0x95, 0x27, 0xb9, 0xd0, 0x91, 0xa4, 0x5d, 0x03, 0x2c, 0x5d, 0x8a, 0x3c, 0x07, 0xc0,
+	0xd7, 0x1a, 0x43, 0x95, 0x6e, 0xb6, 0xdf, 0x30, 0x84, 0xec, 0x97, 0x59, 0x0e, 0x63, 0x3d, 0x4f,
+	0x43, 0x3d, 0x96, 0x9e, 0xe6, 0x69, 0x11, 0x79, 0x14, 0x70, 0x0c, 0xf5, 0x49, 0x28, 0x62, 0xad,
+	0xe8, 0x4a, 0x06, 0xf2, 0x10, 0x76, 0x63, 0x85, 0xd2, 0x7d, 0x85, 0x92, 0xff, 0x90, 0xc3, 0xfa,
+	0x3b, 0x66, 0xf7, 0xdd, 0xd4, 0xf1, 0xed, 0x8a, 0xdd, 0xf9, 0xd3, 0x82, 0x77, 0x2a, 0x6e, 0x89,
+	0xa2, 0x12, 0x51, 0xa8, 0x90, 0x10, 0xb0, 0xd3, 0x2e, 0x30, 0xb4, 0xb5, 0xa8, 0x59, 0x93, 0xdb,
+	0xb0, 0x23, 0xd9, 0x45, 0xca, 0x49, 0xcd, 0x90, 0xd9, 0x90, 0xec, 0xe2, 0xc4, 0x27, 0xc7, 0xd0,
+	0x94, 0x39, 0xcc, 0x90, 0xd5, 0x3e, 0x18, 0x55, 0x9e, 0x22, 0x92, 0x5b, 0x65, 0x68, 0x81, 0x24,
+	0x93, 0x35, 0x36, 0x6c, 0x93, 0x67, 0x7c, 0x53, 0x36, 0x26, 0xb1, 0xde, 0xa4, 0xc3, 0xf9, 0xd5,
+	0x82, 0xc1, 0xdb, 0xab, 0x93, 0x11, 0x74, 0x3d, 0x83, 0x77, 0x7d, 0xa6, 0x99, 0xfb, 0x42, 0x45,
+	0x61, 0xde, 0x27, 0xb7, 0x32, 0xfb, 0x31, 0xd3, 0xec, 0x54, 0x45, 0x21, 0x79, 0x0c, 0x84, 0xad,
+	0xe6, 0x32, 0x80, 0x9c, 0x86, 0xdd, 0x35, 0x4f, 0x0a, 0x49, 0x3b, 0x4f, 0xf1, 0x59, 0xc8, 0x74,
+	0x2c, 0x33, 0x4e, 0x3a, 0xb4, 0x34, 0x90, 0x77, 0xa1, 0x6d, 0x2e, 0x6a, 0xce, 0x42, 0x3f, 0x40,
+	0x73, 0xd6, 0x0e, 0x85, 0xd4, 0xf4, 0x95, 0xb1, 0x38, 0x0c, 0x48, 0x79, 0x37, 0x47, 0x12, 0xcd,
+	0x99, 0xc9, 0x59, 0x85, 0x80, 0x1e, 0xbd, 0x55, 0x40, 0x4b, 0x68, 0x85, 0x82, 0x7e, 0xb6, 0xc1,
+	0xb9, 0x1e, 0x71, 0x8d, 0x84, 0x1e, 0x41, 0x4d, 0x0a, 0xc3, 0x42, 0xfb, 0xe0, 0x5e, 0xb9, 0x13,
+	0x8a, 0x41, 0xc2, 0xc3, 0xd9, 0x39, 0x93, 0x3a, 0x79, 0x1a, 0x6a, 0xae, 0x13, 0x5a, 0x93, 0x82,
+	0x8c, 0xc0, 0x4e, 0xcf, 0x98, 0xf7, 0x48, 0xaf, 0x8c, 0xff, 0x46, 0xa1, 0xcc, 0xe3, 0x4c, 0x04,
+	0xa1, 0x70, 0xbb, 0x14, 0x98, 0x2b, 0x98, 0x64, 0x0b, 0xd4, 0x28, 0x97, 0x52, 0xbb, 0x5f, 0x25,
+	0xb5, 0xf3, 0x65, 0x14, 0xed, 0x79, 0xdb, 0x46, 0xb5, 0x21, 0xf7, 0xc6, 0xa6, 0xdc, 0x27, 0xb0,
+	0x87, 0xaf, 0xbd, 0x20, 0xf6, 0x71, 0x4d, 0xdb, 0x3b, 0x37, 0xd2, 0x36, 0xc9, 0xa1, 0xab, 0xea,
+	0x1e, 0x42, 0x9b, 0x69, 0x8d, 0x4a, 0x67, 0x3a, 0xfc, 0x9f, 0xd1, 0xd1, 0xaa, 0x69, 0x43, 0xff,
+	0xcd, 0x7f, 0xad, 0xff, 0xef, 0xe0, 0xff, 0xeb, 0x3d, 0xaa, 0x30, 0x40, 0xcf, 0x54, 0x6f, 0x99,
+	0xe4, 0xc3, 0x2b, 0x64, 0xf9, 0xf5, 0x32, 0x8e, 0xde, 0x61, 0x95, 0x76, 0xe7, 0x8d, 0x05, 0x77,
+	0xb7, 0x9b, 0xe4, 0x9f, 0x0c, 0x8b, 0x2f, 0xb7, 0x86, 0xc5, 0x07, 0x57, 0x0d, 0x8b, 0x92, 0xaa,
+	0xff, 0x62, 0x5c, 0xfc, 0x04, 0xc3, 0xeb, 0xca, 0xff, 0xcd, 0x79, 0x51, 0x26, 0x70, 0xa3, 0xe9,
+	0x0b, 0xf4, 0x74, 0x31, 0x2f, 0x4a, 0xcf, 0xc4, 0x38, 0x9c, 0x4f, 0xe1, 0xbd, 0x9b, 0x5c, 0x77,
+	0x4a, 0x2a, 0x13, 0xe6, 0xaf, 0x94, 0x51, 0xdd, 0x60, 0x42, 0x9c, 0xf8, 0xce, 0x67, 0xf0, 0xfe,
+	0x8d, 0x0e, 0xbc, 0x81, 0x6f, 0x2e, 0xf1, 0xbf, 0x58, 0x70, 0xa7, 0xba, 0x23, 0xc8, 0xc7, 0xd0,
+	0x5f, 0x6f, 0x2a, 0xa6, 0x35, 0xf3, 0xe6, 0x0b, 0x0c, 0x75, 0xbe, 0x87, 0xf5, 0xa6, 0x3b, 0x2c,
+	0xdc, 0xe4, 0x43, 0xe8, 0x49, 0x7c, 0x19, 0x73, 0x89, 0xae, 0x44, 0xc5, 0xd3, 0xe6, 0x31, 0x93,
+	0xab, 0x66, 0x4a, 0x93, 0xdc, 0x47, 0x73, 0xd7, 0x19, 0x26, 0xd5, 0x7f, 0xb0, 0xfa, 0x15, 0x7f,
+	0xb0, 0x4f, 0xa0, 0x57, 0x25, 0xc6, 0xca, 0x66, 0xbc, 0x05, 0xb5, 0xa2, 0x11, 0x6b, 0xdc, 0x77,
+	0x9e, 0xac, 0x3e, 0x51, 0x8a, 0x21, 0x51, 0x09, 0xed, 0x42, 0x9d, 0x05, 0x33, 0x83, 0x6d, 0xd0,
+	0x74, 0xe9, 0x1c, 0x03, 0xd9, 0x9e, 0x70, 0x79, 0x89, 0x0c, 0x59, 0xe3, 0x7e, 0x9a, 0x2b, 0x64,
+	0x0b, 0x34, 0xc0, 0x16, 0x35, 0xeb, 0x53, 0xbb, 0x59, 0xef, 0xda, 0xd4, 0xe6, 0x5e, 0x14, 0x3a,
+	0x2e, 0x40, 0x39, 0xf7, 0x56, 0xd0, 0x9d, 0xab, 0xd0, 0xe4, 0x01, 0x74, 0x7c, 0xae, 0x44, 0xc0,
+	0x12, 0xd7, 0xf8, 0x32, 0x62, 0xda, 0xb9, 0xed, 0x79, 0x56, 0xc0, 0xee, 0x36, 0xb2, 0x02, 0x5f,
+	0x3c, 0xfb, 0xfd, 0x72, 0x60, 0xfd, 0x71, 0x39, 0xb0, 0xde, 0x5c, 0x0e, 0xac, 0xef, 0x3f, 0x9f,
+	0x71, 0x3d, 0x8f, 0xa7, 0xfb, 0x5e, 0xb4, 0x18, 0xcf, 0x24, 0x7b, 0xc5, 0xb3, 0xfe, 0x63, 0xc1,
+	0xb8, 0x78, 0xfc, 0x31, 0xc1, 0x37, 0x5e, 0x7e, 0x4f, 0x96, 0x0b, 0x31, 0x9d, 0xee, 0x98, 0xc7,
+	0xdd, 0x47, 0x7f, 0x05, 0x00, 0x00, 0xff, 0xff, 0x9b, 0x8b, 0x9d, 0xcf, 0x2d, 0x0a, 0x00, 0x00,
 }
 
 func (m *CredentialAssertion) Marshal() (dAtA []byte, err error) {
@@ -2060,22 +1973,6 @@ func encodeVarintWebauthn(dAtA []byte, offset int, v uint64) int {
 	dAtA[offset] = uint8(v)
 	return base
 }
-func (m *User) Size() (n int) {
-	if m == nil {
-		return 0
-	}
-	var l int
-	_ = l
-	l = len(m.TeleportUser)
-	if l > 0 {
-		n += 1 + l + sovWebauthn(uint64(l))
-	}
-	if m.XXX_unrecognized != nil {
-		n += len(m.XXX_unrecognized)
-	}
-	return n
-}
-
 func (m *CredentialAssertion) Size() (n int) {
 	if m == nil {
 		return 0
@@ -2443,89 +2340,6 @@ func sovWebauthn(x uint64) (n int) {
 func sozWebauthn(x uint64) (n int) {
 	return sovWebauthn(uint64((x << 1) ^ uint64((int64(x) >> 63))))
 }
-func (m *User) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowWebauthn
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= uint64(b&0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: User: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: User: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field TeleportUser", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowWebauthn
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthWebauthn
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthWebauthn
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.TeleportUser = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipWebauthn(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if (skippy < 0) || (iNdEx+skippy) < 0 {
-				return ErrInvalidLengthWebauthn
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.XXX_unrecognized = append(m.XXX_unrecognized, dAtA[iNdEx:iNdEx+skippy]...)
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
 func (m *CredentialAssertion) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
diff --git a/lib/services/local/users.go b/lib/services/local/users.go
index fc11ddb441ebb..0bf5db82df9d8 100644
--- a/lib/services/local/users.go
+++ b/lib/services/local/users.go
@@ -44,7 +44,6 @@ import (
 	userspb "github.com/gravitational/teleport/api/gen/proto/go/teleport/users/v1"
 	"github.com/gravitational/teleport/api/internalutils/stream"
 	"github.com/gravitational/teleport/api/types"
-	wanpb "github.com/gravitational/teleport/api/types/webauthn"
 	"github.com/gravitational/teleport/api/utils/keys"
 	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
 	"github.com/gravitational/teleport/lib/backend"
@@ -816,7 +815,7 @@ func (s *IdentityService) UpsertWebauthnLocalAuth(ctx context.Context, user stri
 	if err != nil {
 		return trace.Wrap(err, "marshal webauthn local auth")
 	}
-	userJSON, err := json.Marshal(&wanpb.User{
+	userJSON, err := json.Marshal(&webauthnUser{
 		TeleportUser: user,
 	})
 	if err != nil {
@@ -873,13 +872,19 @@ func (s *IdentityService) GetTeleportUserByWebauthnID(ctx context.Context, webID
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
-	user := &wanpb.User{}
+	user := &webauthnUser{}
 	if err := json.Unmarshal(item.Value, user); err != nil {
 		return "", trace.Wrap(err)
 	}
 	return user.TeleportUser, nil
 }
 
+// webauthnUser represents a WebAuthn user stored under [webauthnUserKey].
+// Looked up during passwordless logins.
+type webauthnUser struct {
+	TeleportUser string `json:"teleport_user"`
+}
+
 func webauthnLocalAuthKey(user string) []byte {
 	return backend.Key(webPrefix, usersPrefix, user, webauthnLocalAuthPrefix)
 }