What to do if the SSO provider is down?

[iSplasher]

Hello
We're currently discussing internally whether we should take the full plunge into using this tool to manage our server access via Github SSO, however, we're currently debating and trying to figure out strategies in case the worst scenario were to happen.
Specifically, we are assessing the implications of a hypothetical scenario involving GitHub service unavailability. Such an outage could invariably impact our server access operations, effectively rendering us reliant on the uptime of GitHub's infrastructure. In light of this, we are keen to ascertain the approaches and strategies that the community might have devised to mitigate this issue.

We've thought of running the default ssh service on a separate port hereby enabling manual access as a fallback mechanism. (but this requires creating keys the old way, which lamentingly defeats the purpose of using Teleport in the first place)

[webvictim]

The easiest way to do this if you're just looking to isolate yourself from a Github outage is to add a local user to Teleport as a backup which has root-level access to servers in the cluster, then keep its password/MFA stored in a secure location (password vault, safe etc)

If you need that break-glass access in the event of an outage, you can get the credentials and log into Teleport as this user without needing Github at all.

Once Github is back up, reset the admin user's password and update it in the vault ready for next time.

[iSplasher]

That does sound like a reasonable backup solution.
We were thinking that it would be great if we could map SSO users to local users, created upon or before a SSO login (by a webhook). The local user will have no password but that can be set at a later time.
However, we're not sure whether this approach is possible when looking at https://goteleport.com/docs/management/admin/users/#adding-local-users
. If the invite link expires, that means no local user has been created?

[webvictim]

Technically I think local users can be created with no password (i.e. if the invite link expires without being used) but they're not much use without one. You'd need to run tctl users reset <username> to get a new password reset link and get the user to set up a password an MFA before they could log in.

[iSplasher]

Thank you, we'll try this approach first.