mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 19:12:46 +08:00
Andrew Lytvynov
3cfdc9b6f7
The user loading code is kind of convoluted: it loads all the separate backend items from the `/web/users/` prefix into a struct. That struct is then converted to a full `types.User` object. For each user there are 3 kinds of backend items: - `/params` which is the main one, containing a marshalled `types.User` object - `/pwd` which contains the hashed password for local users - `/mfa/...` which contain registered MFA devices When an SSO user expires, we delete the first two items but not `/mfa/...`. This is intentional, to persist MFA devices across logins. The user loading code would fail because the user was "found" (thanks to MFA items), but didn't have the mandatory `/params` item. This PR ignores any users that don't have `/params` instead of hard-failing all `GetUsers` calls.