Fix major version check for stateless environment

api/proto/teleport/authinfo/v1/authinfo.proto

@@ -0,0 +1,37 @@
+// Copyright 2025 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.authinfo.v1;
+
+import "teleport/header/v1/metadata.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/authinfo/v1;authinfo";
+
+// AuthInfo holds meta-information for specific server.
+message AuthInfo {
+  string kind = 1;
+  string sub_kind = 2;
+  string version = 3;
+  teleport.header.v1.Metadata metadata = 4;
+
+  AuthInfoSpec spec = 5;
+}
+
+// AuthInfoSpec encodes the parameters auth server meta-information.
+message AuthInfoSpec {
+  // teleport_version advertises the version of the auth server.
+  string teleport_version = 1;
+}

api/types/authinfo/info.go

@@ -0,0 +1,57 @@
+/*
+Copyright 2025 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package authinfo
+
+import (
+	"github.com/gravitational/teleport/api/gen/proto/go/teleport/authinfo/v1"
+	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	"github.com/gravitational/teleport/api/types"
+	"github.com/gravitational/trace"
+)
+
+// NewAuthInfo creates a new auth info resource.
+func NewAuthInfo(spec *authinfo.AuthInfoSpec) (*authinfo.AuthInfo, error) {
+	info := &authinfo.AuthInfo{
+		Kind:    types.KindAuthInfo,
+		Version: types.V1,
+		Metadata: &headerv1.Metadata{
+			Name: types.MetaNameAuthInfo,
+		},
+		Spec: spec,
+	}
+	if err := ValidateAuthInfo(info); err != nil {
+		return nil, trace.Wrap(err)
+	}
+
+	return info, nil
+}
+
+// ValidateAuthInfo checks that required parameters are set
+// for the specified AuthInfo.
+func ValidateAuthInfo(c *authinfo.AuthInfo) error {
+	if c == nil {
+		return trace.BadParameter("AuthInfo is nil")
+	}
+	if c.Metadata == nil {
+		return trace.BadParameter("Metadata is nil")
+	}
+	if c.Spec == nil {
+		return trace.BadParameter("Spec is nil")
+	}
+
+	return nil
+}

api/types/constants.go

@@ -516,6 +516,12 @@ const (
 	// KindServerInfo contains info that should be applied to joining Nodes.
 	KindServerInfo = "server_info"
 
+	// KindAuthInfo contains auth server info.
+	KindAuthInfo = "auth_info"
+
+	// MetaNameAuthInfo name auth server info entity.
+	MetaNameAuthInfo = "auth-info"
+
 	// SubKindCloudInfo is a ServerInfo that was created by the Discovery
 	// service to match with a single discovered instance.
 	SubKindCloudInfo = "cloud_info"

lib/auth/auth.go

@@ -426,6 +426,12 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 			Backend: cfg.Backend,
 		}
 	}
+	if cfg.AuthInfo == nil {
+		cfg.AuthInfo, err = local.NewAuthInfoService(cfg.Backend)
+		if err != nil {
+			return nil, trace.Wrap(err, "creating AuthInfo service")
+		}
+	}
 
 	if cfg.Logger == nil {
 		cfg.Logger = slog.With(teleport.ComponentKey, teleport.ComponentAuth)
@@ -530,6 +536,7 @@ func NewServer(cfg *InitConfig, opts ...ServerOption) (*Server, error) {
 		StableUNIXUsersInternal:         cfg.StableUNIXUsers,
 		WorkloadIdentityX509Revocations: cfg.WorkloadIdentityX509Revocations,
 		WorkloadIdentityX509Overrides:   cfg.WorkloadIdentityX509Overrides,
+		AuthInfoService:                 cfg.AuthInfo,
 	}
 
 	as := Server{
@@ -764,6 +771,7 @@ type Services struct {
 	services.StableUNIXUsersInternal
 	services.WorkloadIdentityX509Revocations
 	services.WorkloadIdentityX509Overrides
+	services.AuthInfoService
 }
 
 // GetWebSession returns existing web session described by req.