create_host_user is not working

[Bob565656]

I have a server with two node setup. Everything was setup according to the documentation and works correctly. I have tried to get the auto creation of hosts users working but it's not doing anything. I have followed the guide completely: https://goteleport.com/docs/server-access/guides/host-user-creation/

The flag create_host_user: true doesn't seem to do anything. The role was created on the Teleport server. I have two active nodes which I can SSH into with the admin user just fine. Things I have done:

• I have restarted teleport on both the servers and nodes
• tried using logins: [ '{{internal.logins}}' ] and setting up a defined login for the user (using tctl)
• tried using logins: [ 'name' ]
• recreated the user multiple times trying different things
• added disable_create_host_user: false to teleport.yaml

The role is selected correctly (the login is populated in the GUI)

I am currently using version 11.0.3 (open source) on Debian. Does anyone have any idea of what I'm doing wrong?

Here is the role for reference
kind: role metadata: id: 1668817346706000481 name: auto-users spec: allow: host_groups: - ubuntu - nginx - other host_sudoers: - 'ALL = (root) NOPASSWD: /usr/bin/systemctl restart nginx.service' logins: - nginxrestarter node_labels: '*': '*' deny: {} options: cert_format: standard create_host_user: true desktop_clipboard: true desktop_directory_sharing: true enhanced_recording: - command - network forward_agent: false max_session_ttl: 30h0m0s pin_source_ip: false port_forwarding: true record_session: default: best_effort desktop: true ssh_file_copy: true version: v5

[webvictim]

Go to the "Users" section of the Teleport web UI. Take a look at the list of roles listed next to your user - every one of those roles will need to have create_host_user set to true in order for the functionality to work. If you update every role it should then work as expected.

[Bob565656]

Thanks for the response. It seems to work when I add that field to the default access role.

Is there a way to get this to work by using logins: ['{{internal.logins}}'] or even better... defaulting to the user's name (without modifying the user's logins using tctl)