Disabling local logins for Teleport authentication

[webvictim]

Related announcement: #41130

You may have noticed that following a Teleport proxy upgrade to v15.2.2 or higher, your login page now looks different to how it did before:

Disabling local logins

This is expected due to Teleport adding better support for passkey logins. If you only use SSO logins and don't like the increased size of the UI, however, you can disable local logins to make it smaller by adding this to your /etc/teleport.yaml config file on the machines running your Teleport auth_service and restarting:

auth_service:
  authentication:
    local_auth: false

Cloud users can do this using tctl edit cluster_auth_preference and adding local_auth: false to the spec section:

kind: cluster_auth_preference
metadata:
  name: cluster-auth-preference
spec:
  local_auth: false
version: v2

After this change is made, you should see a smaller login dialog which only shows SSO providers.

Disabling passwordless logins

If you do use local users but don't use passwordless authentication, you can disable the passwordless functionality with the following configs.

/etc/teleport.yaml:

auth_service:
  authentication:
    passwordless: false

cluster_auth_preference:

kind: cluster_auth_preference
metadata:
  name: cluster-auth-preference
spec:
  passwordless: false
version: v2

This will result in the dialog looking more like this: