diff --git a/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service.pb.go
index d9d0ce6c4cf5b..cdc68fb467aa2 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service.pb.go
@@ -632,10 +632,11 @@ type PromptMFARequest struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Reason     string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
-	Totp       bool   `protobuf:"varint,3,opt,name=totp,proto3" json:"totp,omitempty"`
-	Webauthn   bool   `protobuf:"varint,4,opt,name=webauthn,proto3" json:"webauthn,omitempty"`
-	ClusterUri string `protobuf:"bytes,5,opt,name=cluster_uri,json=clusterUri,proto3" json:"cluster_uri,omitempty"`
+	Reason     string        `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
+	Totp       bool          `protobuf:"varint,3,opt,name=totp,proto3" json:"totp,omitempty"`
+	Webauthn   bool          `protobuf:"varint,4,opt,name=webauthn,proto3" json:"webauthn,omitempty"`
+	ClusterUri string        `protobuf:"bytes,5,opt,name=cluster_uri,json=clusterUri,proto3" json:"cluster_uri,omitempty"`
+	Sso        *SSOChallenge `protobuf:"bytes,6,opt,name=sso,proto3" json:"sso,omitempty"`
 }
 
 func (x *PromptMFARequest) Reset() {
@@ -696,6 +697,83 @@ func (x *PromptMFARequest) GetClusterUri() string {
 	return ""
 }
 
+func (x *PromptMFARequest) GetSso() *SSOChallenge {
+	if x != nil {
+		return x.Sso
+	}
+	return nil
+}
+
+// SSOChallenge contains SSO challenge details.
+type SSOChallenge struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ConnectorId   string `protobuf:"bytes,1,opt,name=connector_id,json=connectorId,proto3" json:"connector_id,omitempty"`
+	ConnectorType string `protobuf:"bytes,2,opt,name=connector_type,json=connectorType,proto3" json:"connector_type,omitempty"`
+	DisplayName   string `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	RedirectUrl   string `protobuf:"bytes,4,opt,name=redirect_url,json=redirectUrl,proto3" json:"redirect_url,omitempty"`
+}
+
+func (x *SSOChallenge) Reset() {
+	*x = SSOChallenge{}
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SSOChallenge) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SSOChallenge) ProtoMessage() {}
+
+func (x *SSOChallenge) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SSOChallenge.ProtoReflect.Descriptor instead.
+func (*SSOChallenge) Descriptor() ([]byte, []int) {
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *SSOChallenge) GetConnectorId() string {
+	if x != nil {
+		return x.ConnectorId
+	}
+	return ""
+}
+
+func (x *SSOChallenge) GetConnectorType() string {
+	if x != nil {
+		return x.ConnectorType
+	}
+	return ""
+}
+
+func (x *SSOChallenge) GetDisplayName() string {
+	if x != nil {
+		return x.DisplayName
+	}
+	return ""
+}
+
+func (x *SSOChallenge) GetRedirectUrl() string {
+	if x != nil {
+		return x.RedirectUrl
+	}
+	return ""
+}
+
 // Response for PromptMFA.
 type PromptMFAResponse struct {
 	state         protoimpl.MessageState
@@ -707,7 +785,7 @@ type PromptMFAResponse struct {
 
 func (x *PromptMFAResponse) Reset() {
 	*x = PromptMFAResponse{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[11]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -719,7 +797,7 @@ func (x *PromptMFAResponse) String() string {
 func (*PromptMFAResponse) ProtoMessage() {}
 
 func (x *PromptMFAResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[11]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -732,7 +810,7 @@ func (x *PromptMFAResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PromptMFAResponse.ProtoReflect.Descriptor instead.
 func (*PromptMFAResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{11}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *PromptMFAResponse) GetTotpCode() string {
@@ -755,7 +833,7 @@ type PromptHardwareKeyPINRequest struct {
 
 func (x *PromptHardwareKeyPINRequest) Reset() {
 	*x = PromptHardwareKeyPINRequest{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[12]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -767,7 +845,7 @@ func (x *PromptHardwareKeyPINRequest) String() string {
 func (*PromptHardwareKeyPINRequest) ProtoMessage() {}
 
 func (x *PromptHardwareKeyPINRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[12]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -780,7 +858,7 @@ func (x *PromptHardwareKeyPINRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PromptHardwareKeyPINRequest.ProtoReflect.Descriptor instead.
 func (*PromptHardwareKeyPINRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{12}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *PromptHardwareKeyPINRequest) GetRootClusterUri() string {
@@ -809,7 +887,7 @@ type PromptHardwareKeyPINResponse struct {
 
 func (x *PromptHardwareKeyPINResponse) Reset() {
 	*x = PromptHardwareKeyPINResponse{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[13]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -821,7 +899,7 @@ func (x *PromptHardwareKeyPINResponse) String() string {
 func (*PromptHardwareKeyPINResponse) ProtoMessage() {}
 
 func (x *PromptHardwareKeyPINResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[13]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -834,7 +912,7 @@ func (x *PromptHardwareKeyPINResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PromptHardwareKeyPINResponse.ProtoReflect.Descriptor instead.
 func (*PromptHardwareKeyPINResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{13}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *PromptHardwareKeyPINResponse) GetPin() string {
@@ -855,7 +933,7 @@ type PromptHardwareKeyTouchRequest struct {
 
 func (x *PromptHardwareKeyTouchRequest) Reset() {
 	*x = PromptHardwareKeyTouchRequest{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[14]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -867,7 +945,7 @@ func (x *PromptHardwareKeyTouchRequest) String() string {
 func (*PromptHardwareKeyTouchRequest) ProtoMessage() {}
 
 func (x *PromptHardwareKeyTouchRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[14]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -880,7 +958,7 @@ func (x *PromptHardwareKeyTouchRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PromptHardwareKeyTouchRequest.ProtoReflect.Descriptor instead.
 func (*PromptHardwareKeyTouchRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{14}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *PromptHardwareKeyTouchRequest) GetRootClusterUri() string {
@@ -899,7 +977,7 @@ type PromptHardwareKeyTouchResponse struct {
 
 func (x *PromptHardwareKeyTouchResponse) Reset() {
 	*x = PromptHardwareKeyTouchResponse{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[15]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -911,7 +989,7 @@ func (x *PromptHardwareKeyTouchResponse) String() string {
 func (*PromptHardwareKeyTouchResponse) ProtoMessage() {}
 
 func (x *PromptHardwareKeyTouchResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[15]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -924,7 +1002,7 @@ func (x *PromptHardwareKeyTouchResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PromptHardwareKeyTouchResponse.ProtoReflect.Descriptor instead.
 func (*PromptHardwareKeyTouchResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{15}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{16}
 }
 
 // Response for PromptHardwareKeyPINChange.
@@ -938,7 +1016,7 @@ type PromptHardwareKeyPINChangeRequest struct {
 
 func (x *PromptHardwareKeyPINChangeRequest) Reset() {
 	*x = PromptHardwareKeyPINChangeRequest{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[16]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -950,7 +1028,7 @@ func (x *PromptHardwareKeyPINChangeRequest) String() string {
 func (*PromptHardwareKeyPINChangeRequest) ProtoMessage() {}
 
 func (x *PromptHardwareKeyPINChangeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[16]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -963,7 +1041,7 @@ func (x *PromptHardwareKeyPINChangeRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use PromptHardwareKeyPINChangeRequest.ProtoReflect.Descriptor instead.
 func (*PromptHardwareKeyPINChangeRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{16}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *PromptHardwareKeyPINChangeRequest) GetRootClusterUri() string {
@@ -990,7 +1068,7 @@ type PromptHardwareKeyPINChangeResponse struct {
 
 func (x *PromptHardwareKeyPINChangeResponse) Reset() {
 	*x = PromptHardwareKeyPINChangeResponse{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[17]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1002,7 +1080,7 @@ func (x *PromptHardwareKeyPINChangeResponse) String() string {
 func (*PromptHardwareKeyPINChangeResponse) ProtoMessage() {}
 
 func (x *PromptHardwareKeyPINChangeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[17]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1015,7 +1093,7 @@ func (x *PromptHardwareKeyPINChangeResponse) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use PromptHardwareKeyPINChangeResponse.ProtoReflect.Descriptor instead.
 func (*PromptHardwareKeyPINChangeResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{17}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *PromptHardwareKeyPINChangeResponse) GetPin() string {
@@ -1052,7 +1130,7 @@ type ConfirmHardwareKeySlotOverwriteRequest struct {
 
 func (x *ConfirmHardwareKeySlotOverwriteRequest) Reset() {
 	*x = ConfirmHardwareKeySlotOverwriteRequest{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[18]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1064,7 +1142,7 @@ func (x *ConfirmHardwareKeySlotOverwriteRequest) String() string {
 func (*ConfirmHardwareKeySlotOverwriteRequest) ProtoMessage() {}
 
 func (x *ConfirmHardwareKeySlotOverwriteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[18]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1077,7 +1155,7 @@ func (x *ConfirmHardwareKeySlotOverwriteRequest) ProtoReflect() protoreflect.Mes
 
 // Deprecated: Use ConfirmHardwareKeySlotOverwriteRequest.ProtoReflect.Descriptor instead.
 func (*ConfirmHardwareKeySlotOverwriteRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{18}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *ConfirmHardwareKeySlotOverwriteRequest) GetRootClusterUri() string {
@@ -1106,7 +1184,7 @@ type ConfirmHardwareKeySlotOverwriteResponse struct {
 
 func (x *ConfirmHardwareKeySlotOverwriteResponse) Reset() {
 	*x = ConfirmHardwareKeySlotOverwriteResponse{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[19]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1118,7 +1196,7 @@ func (x *ConfirmHardwareKeySlotOverwriteResponse) String() string {
 func (*ConfirmHardwareKeySlotOverwriteResponse) ProtoMessage() {}
 
 func (x *ConfirmHardwareKeySlotOverwriteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[19]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1131,7 +1209,7 @@ func (x *ConfirmHardwareKeySlotOverwriteResponse) ProtoReflect() protoreflect.Me
 
 // Deprecated: Use ConfirmHardwareKeySlotOverwriteResponse.ProtoReflect.Descriptor instead.
 func (*ConfirmHardwareKeySlotOverwriteResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{19}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *ConfirmHardwareKeySlotOverwriteResponse) GetConfirmed() bool {
@@ -1150,7 +1228,7 @@ type GetUsageReportingSettingsRequest struct {
 
 func (x *GetUsageReportingSettingsRequest) Reset() {
 	*x = GetUsageReportingSettingsRequest{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[20]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1162,7 +1240,7 @@ func (x *GetUsageReportingSettingsRequest) String() string {
 func (*GetUsageReportingSettingsRequest) ProtoMessage() {}
 
 func (x *GetUsageReportingSettingsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[20]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1175,7 +1253,7 @@ func (x *GetUsageReportingSettingsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetUsageReportingSettingsRequest.ProtoReflect.Descriptor instead.
 func (*GetUsageReportingSettingsRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{20}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{21}
 }
 
 // Response for GetUsageReportingSettings.
@@ -1189,7 +1267,7 @@ type GetUsageReportingSettingsResponse struct {
 
 func (x *GetUsageReportingSettingsResponse) Reset() {
 	*x = GetUsageReportingSettingsResponse{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[21]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1201,7 +1279,7 @@ func (x *GetUsageReportingSettingsResponse) String() string {
 func (*GetUsageReportingSettingsResponse) ProtoMessage() {}
 
 func (x *GetUsageReportingSettingsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[21]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1214,7 +1292,7 @@ func (x *GetUsageReportingSettingsResponse) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use GetUsageReportingSettingsResponse.ProtoReflect.Descriptor instead.
 func (*GetUsageReportingSettingsResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{21}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *GetUsageReportingSettingsResponse) GetUsageReportingSettings() *UsageReportingSettings {
@@ -1236,7 +1314,7 @@ type UsageReportingSettings struct {
 
 func (x *UsageReportingSettings) Reset() {
 	*x = UsageReportingSettings{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[22]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1248,7 +1326,7 @@ func (x *UsageReportingSettings) String() string {
 func (*UsageReportingSettings) ProtoMessage() {}
 
 func (x *UsageReportingSettings) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[22]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1261,7 +1339,7 @@ func (x *UsageReportingSettings) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UsageReportingSettings.ProtoReflect.Descriptor instead.
 func (*UsageReportingSettings) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{22}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *UsageReportingSettings) GetEnabled() bool {
@@ -1284,7 +1362,7 @@ type ReportUnexpectedVnetShutdownRequest struct {
 
 func (x *ReportUnexpectedVnetShutdownRequest) Reset() {
 	*x = ReportUnexpectedVnetShutdownRequest{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[23]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1296,7 +1374,7 @@ func (x *ReportUnexpectedVnetShutdownRequest) String() string {
 func (*ReportUnexpectedVnetShutdownRequest) ProtoMessage() {}
 
 func (x *ReportUnexpectedVnetShutdownRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[23]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1309,7 +1387,7 @@ func (x *ReportUnexpectedVnetShutdownRequest) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use ReportUnexpectedVnetShutdownRequest.ProtoReflect.Descriptor instead.
 func (*ReportUnexpectedVnetShutdownRequest) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{23}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *ReportUnexpectedVnetShutdownRequest) GetError() string {
@@ -1328,7 +1406,7 @@ type ReportUnexpectedVnetShutdownResponse struct {
 
 func (x *ReportUnexpectedVnetShutdownResponse) Reset() {
 	*x = ReportUnexpectedVnetShutdownResponse{}
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[24]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1340,7 +1418,7 @@ func (x *ReportUnexpectedVnetShutdownResponse) String() string {
 func (*ReportUnexpectedVnetShutdownResponse) ProtoMessage() {}
 
 func (x *ReportUnexpectedVnetShutdownResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[24]
+	mi := &file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1353,7 +1431,7 @@ func (x *ReportUnexpectedVnetShutdownResponse) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use ReportUnexpectedVnetShutdownResponse.ProtoReflect.Descriptor instead.
 func (*ReportUnexpectedVnetShutdownResponse) Descriptor() ([]byte, []int) {
-	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{24}
+	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP(), []int{25}
 }
 
 var File_teleport_lib_teleterm_v1_tshd_events_service_proto protoreflect.FileDescriptor
@@ -1442,7 +1520,7 @@ var file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDesc = []byte{
 	0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49,
 	0x70, 0x22, 0x2b, 0x0a, 0x29, 0x53, 0x65, 0x6e, 0x64, 0x50, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67,
 	0x48, 0x65, 0x61, 0x64, 0x6c, 0x65, 0x73, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
-	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x93,
+	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xcd,
 	0x01, 0x0a, 0x10, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x75,
 	0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x02, 0x20,
 	0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x74,
@@ -1450,168 +1528,181 @@ var file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDesc = []byte{
 	0x1a, 0x0a, 0x08, 0x77, 0x65, 0x62, 0x61, 0x75, 0x74, 0x68, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28,
 	0x08, 0x52, 0x08, 0x77, 0x65, 0x62, 0x61, 0x75, 0x74, 0x68, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x63,
 	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0a, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x69, 0x4a, 0x04, 0x08, 0x01,
-	0x10, 0x02, 0x52, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
-	0x5f, 0x75, 0x72, 0x69, 0x22, 0x30, 0x0a, 0x11, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4d, 0x46,
-	0x41, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x6f, 0x74,
-	0x70, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x6f,
-	0x74, 0x70, 0x43, 0x6f, 0x64, 0x65, 0x22, 0x6a, 0x0a, 0x1b, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74,
-	0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x63, 0x6c,
-	0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0e, 0x72, 0x6f, 0x6f, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x69, 0x12,
-	0x21, 0x0a, 0x0c, 0x70, 0x69, 0x6e, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x70, 0x69, 0x6e, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x61, 0x6c, 0x22, 0x30, 0x0a, 0x1c, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64,
-	0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x03, 0x70, 0x69, 0x6e, 0x22, 0x49, 0x0a, 0x1d, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61,
-	0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x54, 0x6f, 0x75, 0x63, 0x68, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x63, 0x6c,
-	0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0e, 0x72, 0x6f, 0x6f, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x69, 0x22,
-	0x20, 0x0a, 0x1e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72,
-	0x65, 0x4b, 0x65, 0x79, 0x54, 0x6f, 0x75, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x4d, 0x0a, 0x21, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77,
-	0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x63,
-	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0e, 0x72, 0x6f, 0x6f, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x69,
-	0x22, 0x69, 0x0a, 0x22, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61,
-	0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x75, 0x6b, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x75, 0x6b, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x75,
-	0x6b, 0x5f, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x0a, 0x70, 0x75, 0x6b, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x64, 0x22, 0x6c, 0x0a, 0x26, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65,
-	0x79, 0x53, 0x6c, 0x6f, 0x74, 0x4f, 0x76, 0x65, 0x72, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x63, 0x6c,
-	0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0e, 0x72, 0x6f, 0x6f, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x69, 0x12,
-	0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x47, 0x0a, 0x27, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x72, 0x6d, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x53,
-	0x6c, 0x6f, 0x74, 0x4f, 0x76, 0x65, 0x72, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d, 0x65,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d,
-	0x65, 0x64, 0x22, 0x22, 0x0a, 0x20, 0x47, 0x65, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
+	0x52, 0x0a, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x69, 0x12, 0x38, 0x0a, 0x03,
+	0x73, 0x73, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72,
+	0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x53, 0x4f, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
+	0x65, 0x52, 0x03, 0x73, 0x73, 0x6f, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x52, 0x10, 0x72, 0x6f,
+	0x6f, 0x74, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x69, 0x22, 0x9e,
+	0x01, 0x0a, 0x0c, 0x53, 0x53, 0x4f, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x12,
+	0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x6f, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x69, 0x73,
+	0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x21, 0x0a, 0x0c,
+	0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x72, 0x6c, 0x22,
+	0x30, 0x0a, 0x11, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x6f, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x64,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x6f, 0x74, 0x70, 0x43, 0x6f, 0x64,
+	0x65, 0x22, 0x6a, 0x0a, 0x1b, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77,
+	0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x28, 0x0a, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x5f, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x72, 0x6f, 0x6f, 0x74,
+	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x69, 0x12, 0x21, 0x0a, 0x0c, 0x70, 0x69,
+	0x6e, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0b, 0x70, 0x69, 0x6e, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x22, 0x30, 0x0a,
+	0x1c, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b,
+	0x65, 0x79, 0x50, 0x49, 0x4e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a,
+	0x03, 0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x22,
+	0x49, 0x0a, 0x1d, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72,
+	0x65, 0x4b, 0x65, 0x79, 0x54, 0x6f, 0x75, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x28, 0x0a, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x5f, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x72, 0x6f, 0x6f, 0x74,
+	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x69, 0x22, 0x20, 0x0a, 0x1e, 0x50, 0x72,
+	0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x54,
+	0x6f, 0x75, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x4d, 0x0a, 0x21,
+	0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65,
+	0x79, 0x50, 0x49, 0x4e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x28, 0x0a, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x72, 0x6f, 0x6f,
+	0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x69, 0x22, 0x69, 0x0a, 0x22, 0x50,
+	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79,
+	0x50, 0x49, 0x4e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x70, 0x69, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x75, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x70, 0x75, 0x6b, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x75, 0x6b, 0x5f, 0x63, 0x68, 0x61,
+	0x6e, 0x67, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x70, 0x75, 0x6b, 0x43,
+	0x68, 0x61, 0x6e, 0x67, 0x65, 0x64, 0x22, 0x6c, 0x0a, 0x26, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x72,
+	0x6d, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x53, 0x6c, 0x6f, 0x74,
+	0x4f, 0x76, 0x65, 0x72, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x28, 0x0a, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x5f, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x72, 0x6f, 0x6f, 0x74,
+	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x72, 0x69, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6d, 0x65, 0x73,
+	0x73, 0x61, 0x67, 0x65, 0x22, 0x47, 0x0a, 0x27, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d, 0x48,
+	0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x53, 0x6c, 0x6f, 0x74, 0x4f, 0x76,
+	0x65, 0x72, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d, 0x65, 0x64, 0x22, 0x22, 0x0a,
+	0x20, 0x47, 0x65, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69,
+	0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x22, 0x8f, 0x01, 0x0a, 0x21, 0x47, 0x65, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
 	0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x8f, 0x01, 0x0a, 0x21, 0x47, 0x65, 0x74, 0x55, 0x73,
-	0x61, 0x67, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74,
-	0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6a, 0x0a, 0x18,
-	0x75, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x72, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x5f,
-	0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30,
-	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73,
-	0x52, 0x16, 0x75, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67,
-	0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x32, 0x0a, 0x16, 0x55, 0x73, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e,
-	0x67, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x3b, 0x0a, 0x23,
-	0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x55, 0x6e, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64,
-	0x56, 0x6e, 0x65, 0x74, 0x53, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0x26, 0x0a, 0x24, 0x52, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x55, 0x6e, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x56, 0x6e, 0x65,
-	0x74, 0x53, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x32, 0x93, 0x0b, 0x0a, 0x11, 0x54, 0x73, 0x68, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5e, 0x0a, 0x07, 0x52, 0x65, 0x6c, 0x6f, 0x67,
-	0x69, 0x6e, 0x12, 0x28, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69,
-	0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
-	0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x74,
-	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x79, 0x0a, 0x10, 0x53, 0x65, 0x6e, 0x64, 0x4e,
-	0x6f, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x31, 0x2e, 0x74, 0x65,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6a, 0x0a, 0x18, 0x75, 0x73, 0x61, 0x67, 0x65,
+	0x5f, 0x72, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69,
+	0x6e, 0x67, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72,
+	0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x16, 0x75, 0x73, 0x61,
+	0x67, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69,
+	0x6e, 0x67, 0x73, 0x22, 0x32, 0x0a, 0x16, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x18, 0x0a,
+	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x3b, 0x0a, 0x23, 0x52, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x55, 0x6e, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x56, 0x6e, 0x65, 0x74, 0x53,
+	0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14,
+	0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x22, 0x26, 0x0a, 0x24, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x55, 0x6e,
+	0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x56, 0x6e, 0x65, 0x74, 0x53, 0x68, 0x75, 0x74,
+	0x64, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0x93, 0x0b, 0x0a,
+	0x11, 0x54, 0x73, 0x68, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x12, 0x5e, 0x0a, 0x07, 0x52, 0x65, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x28, 0x2e,
+	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x6c, 0x6f, 0x67, 0x69, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e,
+	0x76, 0x31, 0x2e, 0x52, 0x65, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x79, 0x0a, 0x10, 0x53, 0x65, 0x6e, 0x64, 0x4e, 0x6f, 0x74, 0x69, 0x66, 0x69,
+	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x31, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x4e, 0x6f, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x32, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72,
+	0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x4e, 0x6f, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xac, 0x01,
+	0x0a, 0x21, 0x53, 0x65, 0x6e, 0x64, 0x50, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x48, 0x65, 0x61,
+	0x64, 0x6c, 0x65, 0x73, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x42, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c,
+	0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x53,
+	0x65, 0x6e, 0x64, 0x50, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x48, 0x65, 0x61, 0x64, 0x6c, 0x65,
+	0x73, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x43, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e,
+	0x76, 0x31, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x50, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x48, 0x65,
+	0x61, 0x64, 0x6c, 0x65, 0x73, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x64, 0x0a, 0x09,
+	0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4d, 0x46, 0x41, 0x12, 0x2a, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72,
+	0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4d, 0x46, 0x41, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31,
+	0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x85, 0x01, 0x0a, 0x14, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72,
+	0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x12, 0x35, 0x2e, 0x74, 0x65,
 	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x4e, 0x6f, 0x74, 0x69, 0x66,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x32,
-	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x4e, 0x6f,
-	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0xac, 0x01, 0x0a, 0x21, 0x53, 0x65, 0x6e, 0x64, 0x50, 0x65, 0x6e, 0x64, 0x69,
-	0x6e, 0x67, 0x48, 0x65, 0x61, 0x64, 0x6c, 0x65, 0x73, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
-	0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x42, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d,
-	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x50, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x48,
-	0x65, 0x61, 0x64, 0x6c, 0x65, 0x73, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x43, 0x2e, 0x74,
-	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x50, 0x65, 0x6e, 0x64,
-	0x69, 0x6e, 0x67, 0x48, 0x65, 0x61, 0x64, 0x6c, 0x65, 0x73, 0x73, 0x41, 0x75, 0x74, 0x68, 0x65,
-	0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x64, 0x0a, 0x09, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4d, 0x46, 0x41, 0x12, 0x2a,
+	0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72,
+	0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x36, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69,
+	0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72,
+	0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50,
+	0x49, 0x4e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x8b, 0x01, 0x0a, 0x16, 0x50,
+	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79,
+	0x54, 0x6f, 0x75, 0x63, 0x68, 0x12, 0x37, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31,
+	0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b,
+	0x65, 0x79, 0x54, 0x6f, 0x75, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x38,
 	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65,
 	0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74,
-	0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x4d, 0x46, 0x41, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x85, 0x01, 0x0a, 0x14, 0x50, 0x72, 0x6f, 0x6d,
-	0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e,
-	0x12, 0x35, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e,
-	0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6d,
-	0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x36, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x54, 0x6f, 0x75, 0x63, 0x68,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x97, 0x01, 0x0a, 0x1a, 0x50, 0x72, 0x6f,
+	0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49,
+	0x4e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x3b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
 	0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e,
 	0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72,
-	0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x8b, 0x01, 0x0a, 0x16, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61,
-	0x72, 0x65, 0x4b, 0x65, 0x79, 0x54, 0x6f, 0x75, 0x63, 0x68, 0x12, 0x37, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64,
-	0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x54, 0x6f, 0x75, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x38, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c,
-	0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50,
-	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79,
-	0x54, 0x6f, 0x75, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x97, 0x01,
-	0x0a, 0x1a, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65,
-	0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x3b, 0x2e, 0x74,
-	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61,
-	0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x43, 0x68, 0x61, 0x6e,
-	0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3c, 0x2e, 0x74, 0x65, 0x6c, 0x65,
-	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72,
-	0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77,
-	0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0xa6, 0x01, 0x0a, 0x1f, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x72, 0x6d, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x53, 0x6c,
-	0x6f, 0x74, 0x4f, 0x76, 0x65, 0x72, 0x77, 0x72, 0x69, 0x74, 0x65, 0x12, 0x40, 0x2e, 0x74, 0x65,
-	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d, 0x48, 0x61,
+	0x65, 0x4b, 0x65, 0x79, 0x50, 0x49, 0x4e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x3c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e,
+	0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e,
+	0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65,
+	0x79, 0x50, 0x49, 0x4e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0xa6, 0x01, 0x0a, 0x1f, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d, 0x48, 0x61,
 	0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x53, 0x6c, 0x6f, 0x74, 0x4f, 0x76, 0x65,
-	0x72, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x41, 0x2e,
-	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d,
-	0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x53, 0x6c, 0x6f, 0x74, 0x4f,
-	0x76, 0x65, 0x72, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x94, 0x01, 0x0a, 0x19, 0x47, 0x65, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x70,
-	0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3a,
-	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x61,
-	0x67, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69,
-	0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3b, 0x2e, 0x74, 0x65, 0x6c,
-	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
-	0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x9d, 0x01, 0x0a, 0x1c, 0x52, 0x65, 0x70, 0x6f,
-	0x72, 0x74, 0x55, 0x6e, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x56, 0x6e, 0x65, 0x74,
-	0x53, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x12, 0x3d, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
+	0x72, 0x77, 0x72, 0x69, 0x74, 0x65, 0x12, 0x40, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76,
+	0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72,
+	0x65, 0x4b, 0x65, 0x79, 0x53, 0x6c, 0x6f, 0x74, 0x4f, 0x76, 0x65, 0x72, 0x77, 0x72, 0x69, 0x74,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x41, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70,
 	0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d,
-	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x55, 0x6e, 0x65, 0x78, 0x70, 0x65,
-	0x63, 0x74, 0x65, 0x64, 0x56, 0x6e, 0x65, 0x74, 0x53, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3e, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
-	0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e,
-	0x76, 0x31, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x55, 0x6e, 0x65, 0x78, 0x70, 0x65, 0x63,
-	0x74, 0x65, 0x64, 0x56, 0x6e, 0x65, 0x74, 0x53, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x54, 0x5a, 0x52, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x67, 0x65, 0x6e,
-	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
-	0x72, 0x74, 0x2f, 0x6c, 0x69, 0x62, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2f,
-	0x76, 0x31, 0x3b, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x76, 0x31, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d, 0x48, 0x61, 0x72, 0x64, 0x77,
+	0x61, 0x72, 0x65, 0x4b, 0x65, 0x79, 0x53, 0x6c, 0x6f, 0x74, 0x4f, 0x76, 0x65, 0x72, 0x77, 0x72,
+	0x69, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x94, 0x01, 0x0a, 0x19,
+	0x47, 0x65, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69, 0x6e,
+	0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3a, 0x2e, 0x74, 0x65, 0x6c, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72,
+	0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3b, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x2e, 0x6c, 0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31,
+	0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x69,
+	0x6e, 0x67, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x9d, 0x01, 0x0a, 0x1c, 0x52, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x55, 0x6e, 0x65,
+	0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x56, 0x6e, 0x65, 0x74, 0x53, 0x68, 0x75, 0x74, 0x64,
+	0x6f, 0x77, 0x6e, 0x12, 0x3d, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c,
+	0x69, 0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x55, 0x6e, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x56,
+	0x6e, 0x65, 0x74, 0x53, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x3e, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x6c, 0x69,
+	0x62, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65,
+	0x70, 0x6f, 0x72, 0x74, 0x55, 0x6e, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x56, 0x6e,
+	0x65, 0x74, 0x53, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x42, 0x54, 0x5a, 0x52, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74,
+	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x6c, 0x69,
+	0x62, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x2f, 0x76, 0x31, 0x3b, 0x74, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x72, 0x6d, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1626,7 +1717,7 @@ func file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescGZIP() []byt
 	return file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDescData
 }
 
-var file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes = make([]protoimpl.MessageInfo, 25)
+var file_teleport_lib_teleterm_v1_tshd_events_service_proto_msgTypes = make([]protoimpl.MessageInfo, 26)
 var file_teleport_lib_teleterm_v1_tshd_events_service_proto_goTypes = []any{
 	(*ReloginRequest)(nil),                            // 0: teleport.lib.teleterm.v1.ReloginRequest
 	(*GatewayCertExpired)(nil),                        // 1: teleport.lib.teleterm.v1.GatewayCertExpired
@@ -1639,52 +1730,54 @@ var file_teleport_lib_teleterm_v1_tshd_events_service_proto_goTypes = []any{
 	(*SendPendingHeadlessAuthenticationRequest)(nil),  // 8: teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationRequest
 	(*SendPendingHeadlessAuthenticationResponse)(nil), // 9: teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationResponse
 	(*PromptMFARequest)(nil),                          // 10: teleport.lib.teleterm.v1.PromptMFARequest
-	(*PromptMFAResponse)(nil),                         // 11: teleport.lib.teleterm.v1.PromptMFAResponse
-	(*PromptHardwareKeyPINRequest)(nil),               // 12: teleport.lib.teleterm.v1.PromptHardwareKeyPINRequest
-	(*PromptHardwareKeyPINResponse)(nil),              // 13: teleport.lib.teleterm.v1.PromptHardwareKeyPINResponse
-	(*PromptHardwareKeyTouchRequest)(nil),             // 14: teleport.lib.teleterm.v1.PromptHardwareKeyTouchRequest
-	(*PromptHardwareKeyTouchResponse)(nil),            // 15: teleport.lib.teleterm.v1.PromptHardwareKeyTouchResponse
-	(*PromptHardwareKeyPINChangeRequest)(nil),         // 16: teleport.lib.teleterm.v1.PromptHardwareKeyPINChangeRequest
-	(*PromptHardwareKeyPINChangeResponse)(nil),        // 17: teleport.lib.teleterm.v1.PromptHardwareKeyPINChangeResponse
-	(*ConfirmHardwareKeySlotOverwriteRequest)(nil),    // 18: teleport.lib.teleterm.v1.ConfirmHardwareKeySlotOverwriteRequest
-	(*ConfirmHardwareKeySlotOverwriteResponse)(nil),   // 19: teleport.lib.teleterm.v1.ConfirmHardwareKeySlotOverwriteResponse
-	(*GetUsageReportingSettingsRequest)(nil),          // 20: teleport.lib.teleterm.v1.GetUsageReportingSettingsRequest
-	(*GetUsageReportingSettingsResponse)(nil),         // 21: teleport.lib.teleterm.v1.GetUsageReportingSettingsResponse
-	(*UsageReportingSettings)(nil),                    // 22: teleport.lib.teleterm.v1.UsageReportingSettings
-	(*ReportUnexpectedVnetShutdownRequest)(nil),       // 23: teleport.lib.teleterm.v1.ReportUnexpectedVnetShutdownRequest
-	(*ReportUnexpectedVnetShutdownResponse)(nil),      // 24: teleport.lib.teleterm.v1.ReportUnexpectedVnetShutdownResponse
+	(*SSOChallenge)(nil),                              // 11: teleport.lib.teleterm.v1.SSOChallenge
+	(*PromptMFAResponse)(nil),                         // 12: teleport.lib.teleterm.v1.PromptMFAResponse
+	(*PromptHardwareKeyPINRequest)(nil),               // 13: teleport.lib.teleterm.v1.PromptHardwareKeyPINRequest
+	(*PromptHardwareKeyPINResponse)(nil),              // 14: teleport.lib.teleterm.v1.PromptHardwareKeyPINResponse
+	(*PromptHardwareKeyTouchRequest)(nil),             // 15: teleport.lib.teleterm.v1.PromptHardwareKeyTouchRequest
+	(*PromptHardwareKeyTouchResponse)(nil),            // 16: teleport.lib.teleterm.v1.PromptHardwareKeyTouchResponse
+	(*PromptHardwareKeyPINChangeRequest)(nil),         // 17: teleport.lib.teleterm.v1.PromptHardwareKeyPINChangeRequest
+	(*PromptHardwareKeyPINChangeResponse)(nil),        // 18: teleport.lib.teleterm.v1.PromptHardwareKeyPINChangeResponse
+	(*ConfirmHardwareKeySlotOverwriteRequest)(nil),    // 19: teleport.lib.teleterm.v1.ConfirmHardwareKeySlotOverwriteRequest
+	(*ConfirmHardwareKeySlotOverwriteResponse)(nil),   // 20: teleport.lib.teleterm.v1.ConfirmHardwareKeySlotOverwriteResponse
+	(*GetUsageReportingSettingsRequest)(nil),          // 21: teleport.lib.teleterm.v1.GetUsageReportingSettingsRequest
+	(*GetUsageReportingSettingsResponse)(nil),         // 22: teleport.lib.teleterm.v1.GetUsageReportingSettingsResponse
+	(*UsageReportingSettings)(nil),                    // 23: teleport.lib.teleterm.v1.UsageReportingSettings
+	(*ReportUnexpectedVnetShutdownRequest)(nil),       // 24: teleport.lib.teleterm.v1.ReportUnexpectedVnetShutdownRequest
+	(*ReportUnexpectedVnetShutdownResponse)(nil),      // 25: teleport.lib.teleterm.v1.ReportUnexpectedVnetShutdownResponse
 }
 var file_teleport_lib_teleterm_v1_tshd_events_service_proto_depIdxs = []int32{
 	1,  // 0: teleport.lib.teleterm.v1.ReloginRequest.gateway_cert_expired:type_name -> teleport.lib.teleterm.v1.GatewayCertExpired
 	2,  // 1: teleport.lib.teleterm.v1.ReloginRequest.vnet_cert_expired:type_name -> teleport.lib.teleterm.v1.VnetCertExpired
 	5,  // 2: teleport.lib.teleterm.v1.SendNotificationRequest.cannot_proxy_gateway_connection:type_name -> teleport.lib.teleterm.v1.CannotProxyGatewayConnection
 	6,  // 3: teleport.lib.teleterm.v1.SendNotificationRequest.cannot_proxy_vnet_connection:type_name -> teleport.lib.teleterm.v1.CannotProxyVnetConnection
-	22, // 4: teleport.lib.teleterm.v1.GetUsageReportingSettingsResponse.usage_reporting_settings:type_name -> teleport.lib.teleterm.v1.UsageReportingSettings
-	0,  // 5: teleport.lib.teleterm.v1.TshdEventsService.Relogin:input_type -> teleport.lib.teleterm.v1.ReloginRequest
-	4,  // 6: teleport.lib.teleterm.v1.TshdEventsService.SendNotification:input_type -> teleport.lib.teleterm.v1.SendNotificationRequest
-	8,  // 7: teleport.lib.teleterm.v1.TshdEventsService.SendPendingHeadlessAuthentication:input_type -> teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationRequest
-	10, // 8: teleport.lib.teleterm.v1.TshdEventsService.PromptMFA:input_type -> teleport.lib.teleterm.v1.PromptMFARequest
-	12, // 9: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyPIN:input_type -> teleport.lib.teleterm.v1.PromptHardwareKeyPINRequest
-	14, // 10: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyTouch:input_type -> teleport.lib.teleterm.v1.PromptHardwareKeyTouchRequest
-	16, // 11: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyPINChange:input_type -> teleport.lib.teleterm.v1.PromptHardwareKeyPINChangeRequest
-	18, // 12: teleport.lib.teleterm.v1.TshdEventsService.ConfirmHardwareKeySlotOverwrite:input_type -> teleport.lib.teleterm.v1.ConfirmHardwareKeySlotOverwriteRequest
-	20, // 13: teleport.lib.teleterm.v1.TshdEventsService.GetUsageReportingSettings:input_type -> teleport.lib.teleterm.v1.GetUsageReportingSettingsRequest
-	23, // 14: teleport.lib.teleterm.v1.TshdEventsService.ReportUnexpectedVnetShutdown:input_type -> teleport.lib.teleterm.v1.ReportUnexpectedVnetShutdownRequest
-	3,  // 15: teleport.lib.teleterm.v1.TshdEventsService.Relogin:output_type -> teleport.lib.teleterm.v1.ReloginResponse
-	7,  // 16: teleport.lib.teleterm.v1.TshdEventsService.SendNotification:output_type -> teleport.lib.teleterm.v1.SendNotificationResponse
-	9,  // 17: teleport.lib.teleterm.v1.TshdEventsService.SendPendingHeadlessAuthentication:output_type -> teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationResponse
-	11, // 18: teleport.lib.teleterm.v1.TshdEventsService.PromptMFA:output_type -> teleport.lib.teleterm.v1.PromptMFAResponse
-	13, // 19: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyPIN:output_type -> teleport.lib.teleterm.v1.PromptHardwareKeyPINResponse
-	15, // 20: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyTouch:output_type -> teleport.lib.teleterm.v1.PromptHardwareKeyTouchResponse
-	17, // 21: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyPINChange:output_type -> teleport.lib.teleterm.v1.PromptHardwareKeyPINChangeResponse
-	19, // 22: teleport.lib.teleterm.v1.TshdEventsService.ConfirmHardwareKeySlotOverwrite:output_type -> teleport.lib.teleterm.v1.ConfirmHardwareKeySlotOverwriteResponse
-	21, // 23: teleport.lib.teleterm.v1.TshdEventsService.GetUsageReportingSettings:output_type -> teleport.lib.teleterm.v1.GetUsageReportingSettingsResponse
-	24, // 24: teleport.lib.teleterm.v1.TshdEventsService.ReportUnexpectedVnetShutdown:output_type -> teleport.lib.teleterm.v1.ReportUnexpectedVnetShutdownResponse
-	15, // [15:25] is the sub-list for method output_type
-	5,  // [5:15] is the sub-list for method input_type
-	5,  // [5:5] is the sub-list for extension type_name
-	5,  // [5:5] is the sub-list for extension extendee
-	0,  // [0:5] is the sub-list for field type_name
+	11, // 4: teleport.lib.teleterm.v1.PromptMFARequest.sso:type_name -> teleport.lib.teleterm.v1.SSOChallenge
+	23, // 5: teleport.lib.teleterm.v1.GetUsageReportingSettingsResponse.usage_reporting_settings:type_name -> teleport.lib.teleterm.v1.UsageReportingSettings
+	0,  // 6: teleport.lib.teleterm.v1.TshdEventsService.Relogin:input_type -> teleport.lib.teleterm.v1.ReloginRequest
+	4,  // 7: teleport.lib.teleterm.v1.TshdEventsService.SendNotification:input_type -> teleport.lib.teleterm.v1.SendNotificationRequest
+	8,  // 8: teleport.lib.teleterm.v1.TshdEventsService.SendPendingHeadlessAuthentication:input_type -> teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationRequest
+	10, // 9: teleport.lib.teleterm.v1.TshdEventsService.PromptMFA:input_type -> teleport.lib.teleterm.v1.PromptMFARequest
+	13, // 10: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyPIN:input_type -> teleport.lib.teleterm.v1.PromptHardwareKeyPINRequest
+	15, // 11: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyTouch:input_type -> teleport.lib.teleterm.v1.PromptHardwareKeyTouchRequest
+	17, // 12: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyPINChange:input_type -> teleport.lib.teleterm.v1.PromptHardwareKeyPINChangeRequest
+	19, // 13: teleport.lib.teleterm.v1.TshdEventsService.ConfirmHardwareKeySlotOverwrite:input_type -> teleport.lib.teleterm.v1.ConfirmHardwareKeySlotOverwriteRequest
+	21, // 14: teleport.lib.teleterm.v1.TshdEventsService.GetUsageReportingSettings:input_type -> teleport.lib.teleterm.v1.GetUsageReportingSettingsRequest
+	24, // 15: teleport.lib.teleterm.v1.TshdEventsService.ReportUnexpectedVnetShutdown:input_type -> teleport.lib.teleterm.v1.ReportUnexpectedVnetShutdownRequest
+	3,  // 16: teleport.lib.teleterm.v1.TshdEventsService.Relogin:output_type -> teleport.lib.teleterm.v1.ReloginResponse
+	7,  // 17: teleport.lib.teleterm.v1.TshdEventsService.SendNotification:output_type -> teleport.lib.teleterm.v1.SendNotificationResponse
+	9,  // 18: teleport.lib.teleterm.v1.TshdEventsService.SendPendingHeadlessAuthentication:output_type -> teleport.lib.teleterm.v1.SendPendingHeadlessAuthenticationResponse
+	12, // 19: teleport.lib.teleterm.v1.TshdEventsService.PromptMFA:output_type -> teleport.lib.teleterm.v1.PromptMFAResponse
+	14, // 20: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyPIN:output_type -> teleport.lib.teleterm.v1.PromptHardwareKeyPINResponse
+	16, // 21: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyTouch:output_type -> teleport.lib.teleterm.v1.PromptHardwareKeyTouchResponse
+	18, // 22: teleport.lib.teleterm.v1.TshdEventsService.PromptHardwareKeyPINChange:output_type -> teleport.lib.teleterm.v1.PromptHardwareKeyPINChangeResponse
+	20, // 23: teleport.lib.teleterm.v1.TshdEventsService.ConfirmHardwareKeySlotOverwrite:output_type -> teleport.lib.teleterm.v1.ConfirmHardwareKeySlotOverwriteResponse
+	22, // 24: teleport.lib.teleterm.v1.TshdEventsService.GetUsageReportingSettings:output_type -> teleport.lib.teleterm.v1.GetUsageReportingSettingsResponse
+	25, // 25: teleport.lib.teleterm.v1.TshdEventsService.ReportUnexpectedVnetShutdown:output_type -> teleport.lib.teleterm.v1.ReportUnexpectedVnetShutdownResponse
+	16, // [16:26] is the sub-list for method output_type
+	6,  // [6:16] is the sub-list for method input_type
+	6,  // [6:6] is the sub-list for extension type_name
+	6,  // [6:6] is the sub-list for extension extendee
+	0,  // [0:6] is the sub-list for field type_name
 }
 
 func init() { file_teleport_lib_teleterm_v1_tshd_events_service_proto_init() }
@@ -1706,7 +1799,7 @@ func file_teleport_lib_teleterm_v1_tshd_events_service_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_teleport_lib_teleterm_v1_tshd_events_service_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   25,
+			NumMessages:   26,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service_grpc.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service_grpc.pb.go
index da8f82e67af7e..f377efccb2645 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service_grpc.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service_grpc.pb.go
@@ -65,10 +65,14 @@ type TshdEventsServiceClient interface {
 	// SendPendingHeadlessAuthentication notifies the Electron app of a pending headless authentication,
 	// which it can use to initiate headless authentication resolution in the UI.
 	SendPendingHeadlessAuthentication(ctx context.Context, in *SendPendingHeadlessAuthenticationRequest, opts ...grpc.CallOption) (*SendPendingHeadlessAuthenticationResponse, error)
-	// PromptMFA notifies the Electron app that the daemon is waiting for the user to answer an MFA prompt.
-	// If Webauthn is supported, tsh daemon starts another goroutine which readies the hardware key.
-	// If TOTP is supported, tsh daemon expects that the Electron app responds to this RPC with the
-	// code.
+	// PromptMFA notifies the Electron app that the daemon wants to prompt for MFA.
+	// If TOTP is supported, the Electron app can return a totp code to complete the ceremony.
+	// If Webauthn or SSO are supported, tsh daemon waits for the Electron App to choose
+	// an option in the response before prompting for either.
+	//
+	// In order for the WebAuthn and SSO prompts to be reflected in the Electron App, the
+	// Electron app can display a waiting screen and listen for the tsh daemon to send a
+	// notification to close the screen.
 	PromptMFA(ctx context.Context, in *PromptMFARequest, opts ...grpc.CallOption) (*PromptMFAResponse, error)
 	// PromptHardwareKeyPIN notifies the Electron app that the daemon is waiting for the user to
 	// provide the hardware key PIN.
@@ -218,10 +222,14 @@ type TshdEventsServiceServer interface {
 	// SendPendingHeadlessAuthentication notifies the Electron app of a pending headless authentication,
 	// which it can use to initiate headless authentication resolution in the UI.
 	SendPendingHeadlessAuthentication(context.Context, *SendPendingHeadlessAuthenticationRequest) (*SendPendingHeadlessAuthenticationResponse, error)
-	// PromptMFA notifies the Electron app that the daemon is waiting for the user to answer an MFA prompt.
-	// If Webauthn is supported, tsh daemon starts another goroutine which readies the hardware key.
-	// If TOTP is supported, tsh daemon expects that the Electron app responds to this RPC with the
-	// code.
+	// PromptMFA notifies the Electron app that the daemon wants to prompt for MFA.
+	// If TOTP is supported, the Electron app can return a totp code to complete the ceremony.
+	// If Webauthn or SSO are supported, tsh daemon waits for the Electron App to choose
+	// an option in the response before prompting for either.
+	//
+	// In order for the WebAuthn and SSO prompts to be reflected in the Electron App, the
+	// Electron app can display a waiting screen and listen for the tsh daemon to send a
+	// notification to close the screen.
 	PromptMFA(context.Context, *PromptMFARequest) (*PromptMFAResponse, error)
 	// PromptHardwareKeyPIN notifies the Electron app that the daemon is waiting for the user to
 	// provide the hardware key PIN.
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts
index 639353d5e19a7..e0ded4ff476fc 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.client.ts
@@ -77,10 +77,14 @@ export interface ITshdEventsServiceClient {
      */
     sendPendingHeadlessAuthentication(input: SendPendingHeadlessAuthenticationRequest, options?: RpcOptions): UnaryCall<SendPendingHeadlessAuthenticationRequest, SendPendingHeadlessAuthenticationResponse>;
     /**
-     * PromptMFA notifies the Electron app that the daemon is waiting for the user to answer an MFA prompt.
-     * If Webauthn is supported, tsh daemon starts another goroutine which readies the hardware key.
-     * If TOTP is supported, tsh daemon expects that the Electron app responds to this RPC with the
-     * code.
+     * PromptMFA notifies the Electron app that the daemon wants to prompt for MFA.
+     * If TOTP is supported, the Electron app can return a totp code to complete the ceremony.
+     * If Webauthn or SSO are supported, tsh daemon waits for the Electron App to choose
+     * an option in the response before prompting for either.
+     *
+     * In order for the WebAuthn and SSO prompts to be reflected in the Electron App, the
+     * Electron app can display a waiting screen and listen for the tsh daemon to send a
+     * notification to close the screen.
      *
      * @generated from protobuf rpc: PromptMFA(teleport.lib.teleterm.v1.PromptMFARequest) returns (teleport.lib.teleterm.v1.PromptMFAResponse);
      */
@@ -175,10 +179,14 @@ export class TshdEventsServiceClient implements ITshdEventsServiceClient, Servic
         return stackIntercept<SendPendingHeadlessAuthenticationRequest, SendPendingHeadlessAuthenticationResponse>("unary", this._transport, method, opt, input);
     }
     /**
-     * PromptMFA notifies the Electron app that the daemon is waiting for the user to answer an MFA prompt.
-     * If Webauthn is supported, tsh daemon starts another goroutine which readies the hardware key.
-     * If TOTP is supported, tsh daemon expects that the Electron app responds to this RPC with the
-     * code.
+     * PromptMFA notifies the Electron app that the daemon wants to prompt for MFA.
+     * If TOTP is supported, the Electron app can return a totp code to complete the ceremony.
+     * If Webauthn or SSO are supported, tsh daemon waits for the Electron App to choose
+     * an option in the response before prompting for either.
+     *
+     * In order for the WebAuthn and SSO prompts to be reflected in the Electron App, the
+     * Electron app can display a waiting screen and listen for the tsh daemon to send a
+     * notification to close the screen.
      *
      * @generated from protobuf rpc: PromptMFA(teleport.lib.teleterm.v1.PromptMFARequest) returns (teleport.lib.teleterm.v1.PromptMFAResponse);
      */
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts
index 110fa4c7d1c33..089af6b221d9e 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.grpc-server.ts
@@ -72,10 +72,14 @@ export interface ITshdEventsService extends grpc.UntypedServiceImplementation {
      */
     sendPendingHeadlessAuthentication: grpc.handleUnaryCall<SendPendingHeadlessAuthenticationRequest, SendPendingHeadlessAuthenticationResponse>;
     /**
-     * PromptMFA notifies the Electron app that the daemon is waiting for the user to answer an MFA prompt.
-     * If Webauthn is supported, tsh daemon starts another goroutine which readies the hardware key.
-     * If TOTP is supported, tsh daemon expects that the Electron app responds to this RPC with the
-     * code.
+     * PromptMFA notifies the Electron app that the daemon wants to prompt for MFA.
+     * If TOTP is supported, the Electron app can return a totp code to complete the ceremony.
+     * If Webauthn or SSO are supported, tsh daemon waits for the Electron App to choose
+     * an option in the response before prompting for either.
+     *
+     * In order for the WebAuthn and SSO prompts to be reflected in the Electron App, the
+     * Electron app can display a waiting screen and listen for the tsh daemon to send a
+     * notification to close the screen.
      *
      * @generated from protobuf rpc: PromptMFA(teleport.lib.teleterm.v1.PromptMFARequest) returns (teleport.lib.teleterm.v1.PromptMFAResponse);
      */
diff --git a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts
index 6bc1ef96ed469..66b3f05bdb2d2 100644
--- a/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts
+++ b/gen/proto/ts/teleport/lib/teleterm/v1/tshd_events_service_pb.ts
@@ -234,6 +234,33 @@ export interface PromptMFARequest {
      * @generated from protobuf field: string cluster_uri = 5;
      */
     clusterUri: string;
+    /**
+     * @generated from protobuf field: teleport.lib.teleterm.v1.SSOChallenge sso = 6;
+     */
+    sso?: SSOChallenge;
+}
+/**
+ * SSOChallenge contains SSO challenge details.
+ *
+ * @generated from protobuf message teleport.lib.teleterm.v1.SSOChallenge
+ */
+export interface SSOChallenge {
+    /**
+     * @generated from protobuf field: string connector_id = 1;
+     */
+    connectorId: string;
+    /**
+     * @generated from protobuf field: string connector_type = 2;
+     */
+    connectorType: string;
+    /**
+     * @generated from protobuf field: string display_name = 3;
+     */
+    displayName: string;
+    /**
+     * @generated from protobuf field: string redirect_url = 4;
+     */
+    redirectUrl: string;
 }
 /**
  * Response for PromptMFA.
@@ -921,7 +948,8 @@ class PromptMFARequest$Type extends MessageType<PromptMFARequest> {
             { no: 2, name: "reason", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 3, name: "totp", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
             { no: 4, name: "webauthn", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 5, name: "cluster_uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+            { no: 5, name: "cluster_uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "sso", kind: "message", T: () => SSOChallenge }
         ]);
     }
     create(value?: PartialMessage<PromptMFARequest>): PromptMFARequest {
@@ -951,6 +979,9 @@ class PromptMFARequest$Type extends MessageType<PromptMFARequest> {
                 case /* string cluster_uri */ 5:
                     message.clusterUri = reader.string();
                     break;
+                case /* teleport.lib.teleterm.v1.SSOChallenge sso */ 6:
+                    message.sso = SSOChallenge.internalBinaryRead(reader, reader.uint32(), options, message.sso);
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -975,6 +1006,9 @@ class PromptMFARequest$Type extends MessageType<PromptMFARequest> {
         /* string cluster_uri = 5; */
         if (message.clusterUri !== "")
             writer.tag(5, WireType.LengthDelimited).string(message.clusterUri);
+        /* teleport.lib.teleterm.v1.SSOChallenge sso = 6; */
+        if (message.sso)
+            SSOChallenge.internalBinaryWrite(message.sso, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -986,6 +1020,77 @@ class PromptMFARequest$Type extends MessageType<PromptMFARequest> {
  */
 export const PromptMFARequest = new PromptMFARequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
+class SSOChallenge$Type extends MessageType<SSOChallenge> {
+    constructor() {
+        super("teleport.lib.teleterm.v1.SSOChallenge", [
+            { no: 1, name: "connector_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "connector_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "display_name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "redirect_url", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<SSOChallenge>): SSOChallenge {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.connectorId = "";
+        message.connectorType = "";
+        message.displayName = "";
+        message.redirectUrl = "";
+        if (value !== undefined)
+            reflectionMergePartial<SSOChallenge>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SSOChallenge): SSOChallenge {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string connector_id */ 1:
+                    message.connectorId = reader.string();
+                    break;
+                case /* string connector_type */ 2:
+                    message.connectorType = reader.string();
+                    break;
+                case /* string display_name */ 3:
+                    message.displayName = reader.string();
+                    break;
+                case /* string redirect_url */ 4:
+                    message.redirectUrl = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: SSOChallenge, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string connector_id = 1; */
+        if (message.connectorId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.connectorId);
+        /* string connector_type = 2; */
+        if (message.connectorType !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.connectorType);
+        /* string display_name = 3; */
+        if (message.displayName !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.displayName);
+        /* string redirect_url = 4; */
+        if (message.redirectUrl !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.redirectUrl);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message teleport.lib.teleterm.v1.SSOChallenge
+ */
+export const SSOChallenge = new SSOChallenge$Type();
+// @generated message type with reflection information, may provide speed optimized methods
 class PromptMFAResponse$Type extends MessageType<PromptMFAResponse> {
     constructor() {
         super("teleport.lib.teleterm.v1.PromptMFAResponse", [
diff --git a/lib/client/api.go b/lib/client/api.go
index f811efa3824a9..82db907a363c4 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -495,6 +495,9 @@ type Config struct {
 	// MFAPromptConstructor is a custom MFA prompt constructor to use when prompting for MFA.
 	MFAPromptConstructor func(cfg *libmfa.PromptConfig) mfa.Prompt
 
+	// SSOMFACeremonyConstructor is a custom SSO MFA ceremony constructor.
+	SSOMFACeremonyConstructor func(rd *sso.Redirector) mfa.SSOMFACeremony
+
 	// CustomHardwareKeyPrompt is a custom hardware key prompt to use when asking
 	// for a hardware key PIN, touch, etc.
 	// If empty, a default CLI prompt is used.
diff --git a/lib/client/mfa.go b/lib/client/mfa.go
index 67e9b30f6417a..9ee70b4d8bcfb 100644
--- a/lib/client/mfa.go
+++ b/lib/client/mfa.go
@@ -98,5 +98,9 @@ func (tc *TeleportClient) NewSSOMFACeremony(ctx context.Context) (mfa.SSOMFACere
 		return nil, trace.Wrap(err, "failed to create a redirector for SSO MFA")
 	}
 
+	if tc.SSOMFACeremonyConstructor != nil {
+		return tc.SSOMFACeremonyConstructor(rd), nil
+	}
+
 	return sso.NewCLIMFACeremony(rd), nil
 }
diff --git a/lib/client/sso/ceremony.go b/lib/client/sso/ceremony.go
index 26a58e16abf28..a8cd13042eeb4 100644
--- a/lib/client/sso/ceremony.go
+++ b/lib/client/sso/ceremony.go
@@ -24,6 +24,7 @@ import (
 	"github.com/gravitational/trace"
 
 	"github.com/gravitational/teleport/api/client/proto"
+	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 )
 
@@ -125,3 +126,27 @@ func NewCLIMFACeremony(rd *Redirector) *MFACeremony {
 		},
 	}
 }
+
+// NewConnectMFACeremony creates a new Teleport Connect SSO ceremony from the given redirector.
+func NewConnectMFACeremony(rd *Redirector) mfa.SSOMFACeremony {
+	return &MFACeremony{
+		close:             rd.Close,
+		ClientCallbackURL: rd.ClientCallbackURL,
+		HandleRedirect: func(ctx context.Context, redirectURL string) error {
+			// Connect handles redirect on the Electron side.
+			return nil
+		},
+		GetCallbackMFAToken: func(ctx context.Context) (string, error) {
+			loginResp, err := rd.WaitForResponse(ctx)
+			if err != nil {
+				return "", trace.Wrap(err)
+			}
+
+			if loginResp.MFAToken == "" {
+				return "", trace.BadParameter("login response for SSO MFA flow missing MFA token")
+			}
+
+			return loginResp.MFAToken, nil
+		},
+	}
+}
diff --git a/lib/teleterm/clusters/cluster_gateways.go b/lib/teleterm/clusters/cluster_gateways.go
index 010f337972a55..c70222c597168 100644
--- a/lib/teleterm/clusters/cluster_gateways.go
+++ b/lib/teleterm/clusters/cluster_gateways.go
@@ -27,6 +27,7 @@ import (
 	"github.com/gravitational/teleport/api/mfa"
 	"github.com/gravitational/teleport/lib/client"
 	libmfa "github.com/gravitational/teleport/lib/client/mfa"
+	"github.com/gravitational/teleport/lib/client/sso"
 	"github.com/gravitational/teleport/lib/teleterm/api/uri"
 	"github.com/gravitational/teleport/lib/teleterm/gateway"
 	"github.com/gravitational/teleport/lib/tlsca"
@@ -52,6 +53,7 @@ type CreateGatewayParams struct {
 // CreateGateway creates a gateway
 func (c *Cluster) CreateGateway(ctx context.Context, params CreateGatewayParams) (gateway.Gateway, error) {
 	c.clusterClient.MFAPromptConstructor = params.MFAPromptConstructor
+	c.clusterClient.SSOMFACeremonyConstructor = sso.NewConnectMFACeremony
 
 	switch {
 	case params.TargetURI.IsDB():
diff --git a/lib/teleterm/daemon/daemon.go b/lib/teleterm/daemon/daemon.go
index 6c268f17e623e..c826468ca22da 100644
--- a/lib/teleterm/daemon/daemon.go
+++ b/lib/teleterm/daemon/daemon.go
@@ -39,6 +39,7 @@ import (
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 	"github.com/gravitational/teleport/lib/auth/authclient"
 	"github.com/gravitational/teleport/lib/client"
+	"github.com/gravitational/teleport/lib/client/sso"
 	dtauthn "github.com/gravitational/teleport/lib/devicetrust/authn"
 	"github.com/gravitational/teleport/lib/teleterm/api/uri"
 	"github.com/gravitational/teleport/lib/teleterm/clusters"
@@ -265,6 +266,8 @@ func (s *Service) ResolveClusterURI(uri uri.ResourceURI) (*clusters.Cluster, *cl
 	// Custom MFAPromptConstructor gets removed during the calls to Login and LoginPasswordless RPCs.
 	// Those RPCs assume that the default CLI prompt is in use.
 	clusterClient.MFAPromptConstructor = s.NewMFAPromptConstructor(cluster.URI)
+	clusterClient.SSOMFACeremonyConstructor = sso.NewConnectMFACeremony
+
 	return cluster, clusterClient, nil
 }
 
@@ -1081,7 +1084,6 @@ func (s *Service) GetUserPreferences(ctx context.Context, clusterURI uri.Resourc
 		preferences, err = userpreferences.Get(ctx, rootAuthClient, leafAuthClient)
 		return trace.Wrap(err)
 	})
-
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/teleterm/daemon/mfaprompt.go b/lib/teleterm/daemon/mfaprompt.go
index a40d02130033b..abdcd3dc2089c 100644
--- a/lib/teleterm/daemon/mfaprompt.go
+++ b/lib/teleterm/daemon/mfaprompt.go
@@ -75,13 +75,23 @@ func (s *Service) promptAppMFA(ctx context.Context, in *api.PromptMFARequest) (*
 func (p *mfaPrompt) Run(ctx context.Context, chal *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
 	promptOTP := chal.TOTP != nil
 	promptWebauthn := chal.WebauthnChallenge != nil && p.cfg.WebauthnSupported
+	promptSSO := chal.SSOChallenge != nil && p.cfg.SSOMFACeremony != nil
 
 	// No prompt to run, no-op.
-	if !promptOTP && !promptWebauthn {
+	if !(promptOTP || promptWebauthn || promptSSO) {
 		return &proto.MFAAuthenticateResponse{}, nil
 	}
 
-	// Depending on the run opts, we may spawn an TOTP goroutine, webauth goroutine, or both.
+	var ssoChallenge *api.SSOChallenge
+	if promptSSO {
+		ssoChallenge = &api.SSOChallenge{
+			ConnectorId:   chal.SSOChallenge.Device.ConnectorId,
+			ConnectorType: chal.SSOChallenge.Device.ConnectorType,
+			DisplayName:   chal.SSOChallenge.Device.DisplayName,
+			RedirectUrl:   chal.SSOChallenge.RedirectUrl,
+		}
+	}
+
 	spawnGoroutines := func(ctx context.Context, wg *sync.WaitGroup, respC chan<- libmfa.MFAGoroutineResponse) {
 		ctx, cancel := context.WithCancelCause(ctx)
 
@@ -90,7 +100,13 @@ func (p *mfaPrompt) Run(ctx context.Context, chal *proto.MFAAuthenticateChalleng
 		go func() {
 			defer wg.Done()
 
-			resp, err := p.promptMFA(ctx, promptOTP, promptWebauthn)
+			resp, err := p.promptMFA(ctx, &api.PromptMFARequest{
+				ClusterUri: p.resourceURI.GetClusterURI().String(),
+				Reason:     p.cfg.PromptReason,
+				Totp:       promptOTP,
+				Webauthn:   promptWebauthn,
+				Sso:        ssoChallenge,
+			})
 			respC <- libmfa.MFAGoroutineResponse{Resp: resp, Err: err}
 
 			// If the user closes the modal in the Electron app, we need to be able to cancel the other
@@ -110,11 +126,34 @@ func (p *mfaPrompt) Run(ctx context.Context, chal *proto.MFAAuthenticateChalleng
 				respC <- libmfa.MFAGoroutineResponse{Resp: resp, Err: trace.Wrap(err, "Webauthn authentication failed")}
 			}()
 		}
+
+		// Fire SSO goroutine.
+		if promptSSO {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+
+				resp, err := p.promptSSO(ctx, chal)
+				respC <- libmfa.MFAGoroutineResponse{Resp: resp, Err: trace.Wrap(err, "SSO authentication failed")}
+			}()
+		}
 	}
 
 	return libmfa.HandleMFAPromptGoroutines(ctx, spawnGoroutines)
 }
 
+func (p *mfaPrompt) promptMFA(ctx context.Context, req *api.PromptMFARequest) (*proto.MFAAuthenticateResponse, error) {
+	resp, err := p.promptAppMFA(ctx, req)
+	if err != nil {
+		return nil, trail.FromGRPC(err)
+	}
+	return &proto.MFAAuthenticateResponse{
+		Response: &proto.MFAAuthenticateResponse_TOTP{
+			TOTP: &proto.TOTPResponse{Code: resp.TotpCode},
+		},
+	}, nil
+}
+
 func (p *mfaPrompt) promptWebauthn(ctx context.Context, chal *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
 	prompt := wancli.NewDefaultPrompt(ctx, io.Discard)
 	opts := &wancli.LoginOpts{AuthenticatorAttachment: p.cfg.AuthenticatorAttachment}
@@ -126,19 +165,7 @@ func (p *mfaPrompt) promptWebauthn(ctx context.Context, chal *proto.MFAAuthentic
 	return resp, nil
 }
 
-func (p *mfaPrompt) promptMFA(ctx context.Context, promptOTP, promptWebauthn bool) (*proto.MFAAuthenticateResponse, error) {
-	resp, err := p.promptAppMFA(ctx, &api.PromptMFARequest{
-		ClusterUri: p.resourceURI.GetClusterURI().String(),
-		Reason:     p.cfg.PromptReason,
-		Totp:       promptOTP,
-		Webauthn:   promptWebauthn,
-	})
-	if err != nil {
-		return nil, trail.FromGRPC(err)
-	}
-	return &proto.MFAAuthenticateResponse{
-		Response: &proto.MFAAuthenticateResponse_TOTP{
-			TOTP: &proto.TOTPResponse{Code: resp.TotpCode},
-		},
-	}, nil
+func (c *mfaPrompt) promptSSO(ctx context.Context, chal *proto.MFAAuthenticateChallenge) (*proto.MFAAuthenticateResponse, error) {
+	resp, err := c.cfg.SSOMFACeremony.Run(ctx, chal)
+	return resp, trace.Wrap(err)
 }
diff --git a/proto/teleport/lib/teleterm/v1/tshd_events_service.proto b/proto/teleport/lib/teleterm/v1/tshd_events_service.proto
index de3f127c62a2d..840d1eaad844e 100644
--- a/proto/teleport/lib/teleterm/v1/tshd_events_service.proto
+++ b/proto/teleport/lib/teleterm/v1/tshd_events_service.proto
@@ -38,10 +38,14 @@ service TshdEventsService {
   // which it can use to initiate headless authentication resolution in the UI.
   rpc SendPendingHeadlessAuthentication(SendPendingHeadlessAuthenticationRequest) returns (SendPendingHeadlessAuthenticationResponse);
 
-  // PromptMFA notifies the Electron app that the daemon is waiting for the user to answer an MFA prompt.
-  // If Webauthn is supported, tsh daemon starts another goroutine which readies the hardware key.
-  // If TOTP is supported, tsh daemon expects that the Electron app responds to this RPC with the
-  // code.
+  // PromptMFA notifies the Electron app that the daemon wants to prompt for MFA.
+  // If TOTP is supported, the Electron app can return a totp code to complete the ceremony.
+  // If Webauthn or SSO are supported, tsh daemon waits for the Electron App to choose
+  // an option in the response before prompting for either.
+  //
+  // In order for the WebAuthn and SSO prompts to be reflected in the Electron App, the
+  // Electron app can display a waiting screen and listen for the tsh daemon to send a
+  // notification to close the screen.
   rpc PromptMFA(PromptMFARequest) returns (PromptMFAResponse);
 
   // PromptHardwareKeyPIN notifies the Electron app that the daemon is waiting for the user to
@@ -155,6 +159,15 @@ message PromptMFARequest {
   bool totp = 3;
   bool webauthn = 4;
   string cluster_uri = 5;
+  SSOChallenge sso = 6;
+}
+
+// SSOChallenge contains SSO challenge details.
+message SSOChallenge {
+  string connector_id = 1;
+  string connector_type = 2;
+  string display_name = 3;
+  string redirect_url = 4;
 }
 
 // Response for PromptMFA.
diff --git a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/PromptSsoStatus/PromptSsoStatus.tsx b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/PromptSsoStatus/PromptSsoStatus.tsx
index 3ae7222352b61..812b648caf597 100644
--- a/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/PromptSsoStatus/PromptSsoStatus.tsx
+++ b/web/packages/teleterm/src/ui/ClusterConnect/ClusterLogin/FormLogin/PromptSsoStatus/PromptSsoStatus.tsx
@@ -29,11 +29,13 @@ export default function PromptSsoStatus(props: Props) {
         </Text>
         <LinearProgress />
       </Box>
-      <ButtonSecondary onClick={props.onCancel}>Cancel</ButtonSecondary>
+      {props.onCancel && (
+        <ButtonSecondary onClick={props.onCancel}>Cancel</ButtonSecondary>
+      )}
     </Flex>
   );
 }
 
 export type Props = {
-  onCancel(): void;
+  onCancel?(): void;
 };
diff --git a/web/packages/teleterm/src/ui/ModalsHost/ModalsHost.tsx b/web/packages/teleterm/src/ui/ModalsHost/ModalsHost.tsx
index 09e1c09a94cd3..c43bd061baba8 100644
--- a/web/packages/teleterm/src/ui/ModalsHost/ModalsHost.tsx
+++ b/web/packages/teleterm/src/ui/ModalsHost/ModalsHost.tsx
@@ -178,10 +178,12 @@ function renderDialog(dialog: Dialog, handleClose: () => void) {
       return (
         <ReAuthenticate
           promptMfaRequest={dialog.promptMfaRequest}
-          onSuccess={totpCode => {
+          onOtpSubmit={totpCode => {
             handleClose();
             dialog.onSuccess(totpCode);
           }}
+          // This function needs to be stable between renders.
+          onSsoContinue={dialog.onSsoContinue}
           onCancel={() => {
             handleClose();
             dialog.onCancel();
diff --git a/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.story.tsx b/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.story.tsx
index 42a48089b48a0..bfcaf6f49a4d2 100644
--- a/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.story.tsx
+++ b/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.story.tsx
@@ -39,8 +39,9 @@ export const WithWebauthn = () => (
   <MockAppContextProvider>
     <ReAuthenticate
       promptMfaRequest={{ ...promptMfaRequest, webauthn: true }}
+      onSsoContinue={() => {}}
       onCancel={() => {}}
-      onSuccess={() => {
+      onOtpSubmit={() => {
         window.alert(
           'You somehow submitted a form while only Webauthn was available.'
         );
@@ -56,18 +57,53 @@ export const WithTotp = () => (
   <MockAppContextProvider>
     <ReAuthenticate
       promptMfaRequest={{ ...promptMfaRequest, totp: true }}
+      onSsoContinue={() => {}}
       onCancel={() => {}}
-      onSuccess={showToken}
+      onOtpSubmit={showToken}
     />
   </MockAppContextProvider>
 );
 
-export const WithWebauthnAndTotp = () => (
+export const WithSso = () => (
   <MockAppContextProvider>
     <ReAuthenticate
-      promptMfaRequest={{ ...promptMfaRequest, webauthn: true, totp: true }}
+      promptMfaRequest={{
+        ...promptMfaRequest,
+        sso: {
+          connectorId: '',
+          connectorType: '',
+          displayName: 'Example SSO',
+          redirectUrl: '',
+        },
+      }}
+      onSsoContinue={() => {}}
+      onCancel={() => {}}
+      onOtpSubmit={() => {
+        window.alert(
+          'You somehow submitted a form while only SSO was available.'
+        );
+      }}
+    />
+  </MockAppContextProvider>
+);
+
+export const WithWebauthnAndTotpAndSSO = () => (
+  <MockAppContextProvider>
+    <ReAuthenticate
+      promptMfaRequest={{
+        ...promptMfaRequest,
+        webauthn: true,
+        totp: true,
+        sso: {
+          connectorId: '',
+          connectorType: '',
+          displayName: 'Example SSO',
+          redirectUrl: '',
+        },
+      }}
+      onSsoContinue={() => {}}
       onCancel={() => {}}
-      onSuccess={showToken}
+      onOtpSubmit={showToken}
     />
   </MockAppContextProvider>
 );
@@ -81,8 +117,9 @@ export const MultilineTitle = () => (
         totp: true,
         clusterUri: '/clusters/lorem.cloud.gravitational.io',
       }}
+      onSsoContinue={() => {}}
       onCancel={() => {}}
-      onSuccess={showToken}
+      onOtpSubmit={showToken}
     />
   </MockAppContextProvider>
 );
@@ -96,8 +133,9 @@ export const ForLeafCluster = () => (
         totp: true,
         clusterUri: makeLeafCluster().uri,
       }}
+      onSsoContinue={() => {}}
       onCancel={() => {}}
-      onSuccess={showToken}
+      onOtpSubmit={showToken}
     />
   </MockAppContextProvider>
 );
diff --git a/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.tsx b/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.tsx
index 456b5a2bd494a..ef8b902496dbb 100644
--- a/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.tsx
+++ b/web/packages/teleterm/src/ui/ModalsHost/modals/ReAuthenticate/ReAuthenticate.tsx
@@ -16,7 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-import { FC, useState } from 'react';
+import { FC, useEffect, useState } from 'react';
 
 import { PromptMFARequest } from 'gen-proto-ts/teleport/lib/teleterm/v1/tshd_events_service_pb';
 
@@ -43,39 +43,35 @@ import { FieldSelect } from 'shared/components/FieldSelect';
 
 import { Option } from 'shared/components/Select';
 
-import { assertUnreachable } from 'shared/utils/assertUnreachable';
-
 import { useAppContext } from 'teleterm/ui/appContextProvider';
 import { LinearProgress } from 'teleterm/ui/components/LinearProgress';
 import svgHardwareKey from 'teleterm/ui/ClusterConnect/ClusterLogin/FormLogin/PromptPasswordless/hardware.svg';
-import { useLogger } from 'teleterm/ui/hooks/useLogger';
 import { routing } from 'teleterm/ui/uri';
-
-type MfaType = 'webauthn' | 'totp';
+import PromptSsoStatus from 'teleterm/ui/ClusterConnect/ClusterLogin/FormLogin/PromptSsoStatus';
 
 export const ReAuthenticate: FC<{
   promptMfaRequest: PromptMFARequest;
   onCancel: () => void;
-  onSuccess: (otp: string) => void;
+  onOtpSubmit: (otp: string) => void;
+  onSsoContinue: (redirectUrl: string) => void;
 }> = props => {
-  const logger = useLogger('ReAuthenticate');
-  const { promptMfaRequest: req } = props;
+  const { promptMfaRequest: req, onSsoContinue } = props;
 
-  const availableMfaTypes: MfaType[] = [];
-  // Add Webauthn first to prioritize it if both Webauthn and TOTP are available.
-  if (req.webauthn) {
-    availableMfaTypes.push('webauthn');
-  }
-  if (req.totp) {
-    availableMfaTypes.push('totp');
-  }
-  if (availableMfaTypes.length === 0) {
-    // This shouldn't happen but is technically allowed by the req data structure.
-    logger.warn('availableMfaTypes is empty, defaulting to webauthn and totp');
-    availableMfaTypes.push('webauthn', 'totp');
-  }
+  const availableMfaTypes = makeAvailableMfaTypes(req);
+
+  const [selectedMfaType, setSelectedMfaType] = useState<AvailableMfaType>(
+    availableMfaTypes[0]
+  );
+
+  useEffect(() => {
+    // If SSO is the selected value, open the redirect window instead of waiting for the user to
+    // select SSO. This handles both a situation where the user selects the SSO option and a
+    // situation where SSO is already selected when the component renders.
+    if (selectedMfaType.value === 'sso') {
+      onSsoContinue(req.sso.redirectUrl);
+    }
+  }, [selectedMfaType.value, req.sso?.redirectUrl, onSsoContinue]);
 
-  const [selectedMfaType, setSelectedMfaType] = useState(availableMfaTypes[0]);
   const [otpToken, setOtpToken] = useState('');
 
   const { clusterUri } = req;
@@ -105,7 +101,7 @@ export const ReAuthenticate: FC<{
           <form
             onSubmit={e => {
               e.preventDefault();
-              validator.validate() && props.onSuccess(otpToken);
+              validator.validate() && props.onOtpSubmit(otpToken);
             }}
           >
             <DialogHeader
@@ -137,17 +133,15 @@ export const ReAuthenticate: FC<{
                     <FieldSelect
                       flex="1"
                       label="Two-factor Type"
-                      value={mfaTypeToOption(selectedMfaType)}
-                      options={availableMfaTypes.map(mfaTypeToOption)}
-                      onChange={option =>
-                        setSelectedMfaType(
-                          (option as Option<string, string>).value as MfaType
-                        )
-                      }
+                      value={selectedMfaType}
+                      options={availableMfaTypes}
+                      onChange={mfaType => {
+                        setSelectedMfaType(mfaType);
+                      }}
                     />
                   )}
 
-                  {selectedMfaType === 'totp' ? (
+                  {selectedMfaType.value === 'totp' ? (
                     <FieldInput
                       flex="1"
                       autoFocus
@@ -166,7 +160,7 @@ export const ReAuthenticate: FC<{
                   )}
                 </Flex>
 
-                {selectedMfaType === 'webauthn' && (
+                {selectedMfaType.value === 'webauthn' && (
                   <>
                     <Image width="200px" src={svgHardwareKey} mx="auto" />
                     <Box
@@ -179,12 +173,14 @@ export const ReAuthenticate: FC<{
                     </Box>
                   </>
                 )}
+
+                {selectedMfaType.value === 'sso' && <PromptSsoStatus />}
               </Flex>
             </DialogContent>
 
             <DialogFooter>
               <Flex gap={3}>
-                {selectedMfaType === 'totp' && (
+                {selectedMfaType.value === 'totp' && (
                   <ButtonPrimary type="submit">Continue</ButtonPrimary>
                 )}
                 <ButtonSecondary type="button" onClick={props.onCancel}>
@@ -199,19 +195,34 @@ export const ReAuthenticate: FC<{
   );
 };
 
-const mfaTypeToOption = (mfaType: MfaType): Option<string, string> => {
-  let label: string;
-
-  switch (mfaType) {
-    case 'webauthn':
-      label = 'Hardware Key';
-      break;
-    case 'totp':
-      label = 'Authenticator App';
-      break;
-    default:
-      assertUnreachable(mfaType);
+type MfaType = 'webauthn' | 'totp' | 'sso';
+type AvailableMfaType = Option<MfaType, string>;
+
+const totp = { value: 'totp' as MfaType, label: 'Authenticator App' };
+const webauthn = { value: 'webauthn' as MfaType, label: 'Hardware Key' };
+
+function makeAvailableMfaTypes(req: PromptMFARequest): AvailableMfaType[] {
+  let availableMfaTypes: AvailableMfaType[] = [];
+
+  if (req.webauthn) {
+    availableMfaTypes.push(webauthn);
+  }
+  if (req.totp) {
+    availableMfaTypes.push(totp);
+  }
+  // put sso last in the list so we don't automatically open the browser unless
+  // sso is the only one in the list.
+  if (req.sso) {
+    availableMfaTypes.push({
+      value: 'sso',
+      label: req.sso.displayName || req.sso.connectorId,
+    });
   }
 
-  return { value: mfaType, label };
-};
+  // This shouldn't happen but is technically allowed by the req data structure.
+  if (availableMfaTypes.length === 0) {
+    availableMfaTypes.push(webauthn);
+    availableMfaTypes.push(totp);
+  }
+  return availableMfaTypes;
+}
diff --git a/web/packages/teleterm/src/ui/services/modals/modalsService.ts b/web/packages/teleterm/src/ui/services/modals/modalsService.ts
index 421a45c94398f..65365868e2c32 100644
--- a/web/packages/teleterm/src/ui/services/modals/modalsService.ts
+++ b/web/packages/teleterm/src/ui/services/modals/modalsService.ts
@@ -211,6 +211,7 @@ export interface DialogReAuthenticate {
   kind: 'reauthenticate';
   promptMfaRequest: tshdEventsApi.PromptMFARequest;
   onSuccess(totpCode: string): void;
+  onSsoContinue(redirectUrl: string): void;
   onCancel(): void;
 }
 
diff --git a/web/packages/teleterm/src/ui/tshdEvents.ts b/web/packages/teleterm/src/ui/tshdEvents.ts
index b06aa73196b9e..fa6f1b9623562 100644
--- a/web/packages/teleterm/src/ui/tshdEvents.ts
+++ b/web/packages/teleterm/src/ui/tshdEvents.ts
@@ -58,6 +58,9 @@ export function createTshdEventsContextBridgeService(
           kind: 'reauthenticate',
           promptMfaRequest: request,
           onSuccess: totpCode => resolve({ hasCanceledModal: false, totpCode }),
+          onSsoContinue: (redirectUrl: string) => {
+            window.open(redirectUrl);
+          },
           onCancel: () =>
             resolve({
               hasCanceledModal: true,
@@ -82,7 +85,9 @@ export function createTshdEventsContextBridgeService(
         };
       }
 
-      return { totpCode };
+      return {
+        totpCode,
+      };
     },
 
     getUsageReportingSettings: async () => {