When using a GUI (like an IDE) that makes SSH connections, it can retry on failed connections. This can leave a user with hundreds of browser tabs open in their browser prompting them to SSO login.

This same behavior happened with tsh kube credentials, and was fixed by introducing a lock file. A similar lock file would be appropriate here too.

References:

• tsh kube credentials should not open browser when invoked from a kube gui #22494 - original issue reporting this behavior with kube
• Add kube credentials lockfile to prevent possibility of excessive login attempts #26102 - PR that introduced the lock file