From 32bfc489606df19fb90cb6a55a40857c91edcf25 Mon Sep 17 00:00:00 2001 From: Zoltan Papp Date: Mon, 7 Sep 2026 23:42:27 +0200 Subject: [PATCH] [client] Report a missing OS user in the SSH login error message The session handler mapped a failed user lookup to the generic "User authentication failed", which reads as a rejected SSO login even though the JWT was accepted. Name the missing user instead. --- client/ssh/server/session_handlers.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/client/ssh/server/session_handlers.go b/client/ssh/server/session_handlers.go index 0e531bb96..964a7d938 100644 --- a/client/ssh/server/session_handlers.go +++ b/client/ssh/server/session_handlers.go @@ -119,8 +119,12 @@ func (s *Server) handlePrivError(logger *log.Entry, session ssh.Session, err err // buildUserLookupErrorMessage creates appropriate user-facing error messages based on error type func (s *Server) buildUserLookupErrorMessage(err error) string { var privilegedErr *PrivilegedUserError + var notFoundErr *UserNotFoundError switch { + case errors.As(err, ¬FoundErr): + return fmt.Sprintf("user %q does not exist on this host\n", notFoundErr.Username) + case errors.As(err, &privilegedErr): if privilegedErr.Username == "root" { return "root login is disabled on this SSH server\n"