Ah, interesting! Thanks for your response. What do you use to get this work flow going? Would be really interested in the underlying infra. Do you have any pointers to get me deeper in this subject?
Quickstart: https://gravitational.com/teleport/docs/quickstart/
To quickly answer your question: if you rename teleport client "tsh" to "ssh", trying to use it without a certificate will trigger SSO workflow. The alternative is to issue "tsh login" CLI command in the morning.