wif.tax

Teleport

B Teleport (Cloud and self-hosted)

Bots (tbot, the Terraform provider) and agents join Teleport with a JWT from any OIDC issuer you configure (generic_oidc, v18.11+), plus dedicated GitHub, GitLab, CI and cloud join methods, and get short-lived certificates. Secret join tokens, bound keypairs and tctl-signed identity files still exist. Into your cloud Teleport is an OIDC issuer for AWS and Entra ID, but GKE discovery, GitLab, Okta, Intune, Jamf and PagerDuty integrations want static keys.

Docs: goteleport.com · Checked 2026-10-22 · source YAML · dispute via PR

Inbound A

How a workload running anywhere authenticates to this product.

Join tokens with a delegated join method: generic_oidc verifies a JWT from any issuer you name with a required audience and claim rules, and dedicated methods cover GitHub Actions, GitLab, CircleCI, Bitbucket, Azure DevOps, Spacelift, Terraform Cloud, env0, AWS IAM/EC2, GCP, Azure, Oracle, Kubernetes and TPM. The bot gets short-lived certificates usable by tbot, tctl, tsh, the API clients and the Terraform provider.

Issuers
any

Graded on bot (Machine & Workload Identity) joining, which is how a workload automates the Teleport API, tctl and the Terraform provider. generic_oidc trusts an issuer you set (OIDC discovery or static_jwks), requires an exact `aud`, and lets you write must_match_fields and allow_any rules over `sub` and any other claim, so issuer, subject and audience are all constrainable: A, like `hashicorp-vault`'s JWT auth. It is new (v18.11.0) and Teleport warns you are "solely responsible" for the rules. Before it, the allowlisted dedicated methods would have been a B. No forced weaker path: every surface accepts a delegated join, though secret-based paths remain available (ephemeral and static join tokens, bound keypair registration secrets and static keys, and long-lived identity files from `tctl auth sign`, which Teleport itself calls high-privileged). The feature matrix lists Machine & Workload Identity issuance and "secretless authentication" in all three editions; TPM joining is Enterprise-only and the ec2 method is unavailable on Teleport Enterprise Cloud. Ambient cloud joins (iam, gcp, azure, kubernetes in-cluster) alone would not have earned A.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

Teleport publishes OIDC discovery and keys and acts as the identity provider for an AWS IAM role (AWS OIDC integration) and an Entra ID app's federated credential, so AWS and Azure reach-ins are keyless. Discovery agents you run use instance roles or managed identities, but the GKE discovery guide downloads a GCP service-account key, and SaaS integrations take a GitLab PAT, an Okta SSWS token or client secret, Intune and Jamf client secrets, a GitHub App private key or a PagerDuty API key.

Checked: AWS OIDC integration (EC2/RDS enrollment, AWS console and CLI access, Access Graph AWS sync, External Audit Storage, IAM Identity Center), Entra ID integration and Azure sync, Azure VM and AKS discovery, GCP VM, GCP database and GKE discovery, GitLab and GitHub Identity Security imports, Okta (Identity Security), Jamf and Intune device-trust sync, the GitHub SSH CA integration (a GitHub OAuth app client secret for user identity lookup) and the PagerDuty access request plugin. AWS and Azure are keyless with Teleport as the OIDC issuer; the IAM Identity Center SCIM token AWS hands Teleport flows the other way. GCP has no Teleport-as-issuer integration: discovery runs in a Teleport agent you host with ambient credentials on GCE, while the GKE guide creates a JSON key. Static SaaS tokens make this B. Teleport's Workload Identity JWTs can also be federated into AWS, Azure and GCP by your workloads, which is issuance to your workloads, not Teleport reaching in. Okta and Entra ID integrations are Enterprise features.

Hygiene for any static credential the product still issues

✗ Expiry enforceable
Graded on secret join tokens, the long-lived credential Teleport still issues. `tctl tokens add` defaults to 30 minutes, but a token resource's `expires` is an optional header, static tokens in teleport.yaml never expire, and no cluster policy capping token lifetime is documented. A changeable default is not an enforced expiry (precedent: `elastic-cloud-api`).
  • goteleport.com checked 2026-10-22
    “They can be created by the CLI (a strong random value is picked when not specified, default TTL is 30 minutes):”
  • goteleport.com checked 2026-10-22
    “Expires is a global expiry time header can be set on any resource in the system.”
  • goteleport.com checked 2026-10-22
    “This join method is inherently less secure because long-lived tokens can be stolen and reused.”
✓ Rotation via API
Tokens are API resources (gRPC, tctl, Terraform teleport_provision_token, Kubernetes operator). Bound keypair tokens also support forced keypair rotation via rotate_after.
  • goteleport.com checked 2026-10-22
    “Ephemeral tokens are secret tokens created dynamically via the CLI or Teleport API.”
  • goteleport.com checked 2026-10-22
    “Tokens created via `tctl` can be deleted (revoked) via the `tctl tokens rm` command.”
✓ Scoped keys
A bot is a purpose-built machine principal with its own roles, and each token names one bot (or a minimal set of agent system roles), which the rubric counts.
  • goteleport.com checked 2026-10-22
    “Bots have one or more Teleport roles, governing their access to resources in your infrastructure, and Teleport records their activity using audit logs.”
  • goteleport.com checked 2026-10-22
    “You should use the minimal set of system roles required.”
✓ Last-used visible
Judgment call: `tctl tokens ls` shows only expiry, but a bot's join token is consumed on use and the credential that lives on is the bot instance, whose recent authentications and heartbeats (with timestamps) are recorded, so dead bots can be found. Agents joined with static tokens get no equivalent per-token record.
  • goteleport.com checked 2026-10-22
    “The N most recent authentication status records for this bot instance.”
  • goteleport.com checked 2026-10-22
    “Bot Instances keep track of individual `tbot` installations over time, even as they renew their certificates or rejoin.”
✗ Leak revocation
Teleport (Gravitational) does not appear in GitHub's supported secret-scanning patterns table, as partner or otherwise. Join token names are random strings with no recognisable prefix.

Notes

One card for Teleport Enterprise Cloud, Enterprise self-hosted and Community Edition: they share the join-method machinery and integrations. Hygiene covers secret join tokens (two of the five checks fail). It does not change the grade, since inbound is A on generic_oidc. Headline is B, held down by outbound: a Teleport-as-issuer path for GCP (Workload Identity Federation for the Discovery Service and GKE) and keyless options for the GitLab, Okta, Jamf, Intune and PagerDuty integrations would move it to A.

Badge

wif.tax grade B

[![wif.tax grade](https://wif.tax/badge/teleport.svg)](https://wif.tax/p/teleport/)