What causes "sso login is disabled" in AlistGo/alist?

Enable SSO login in the admin settings (site settings -> SSO -> enable)

sso login is disabled

Error message

sso login is disabled

What it means

Returned by SSOLoginCallback when the ssologin-enabled setting is false. The callback endpoint refuses to process any SSO exchange while the feature is off, returning HTTP 500. This gate exists because the callback URL is publicly reachable and would otherwise leak an OAuth flow against unconfigured providers.

Source

Thrown at server/handles/ssologin.go:288

		}
		html := fmt.Sprintf(`<!DOCTYPE html>
				<head></head>
				<body>
				<script>
				window.opener.postMessage({"token":"%s"}, "*")
				window.close()
				</script>
				</body>`, token)
		c.Data(200, "text/html; charset=utf-8", []byte(html))
		return
	}
}

func SSOLoginCallback(c *gin.Context) {
	enabled := setting.GetBool(conf.SSOLoginEnabled)
	usecompatibility := setting.GetBool(conf.SSOCompatibilityMode)
	if !enabled {
		common.ErrorResp(c, errors.New("sso login is disabled"), 500)
		return
	}
	argument := c.Query("method")
	if usecompatibility {
		argument = path.Base(c.Request.URL.Path)
	}
	if !utils.SliceContains([]string{"get_sso_id", "sso_get_token"}, argument) {
		common.ErrorResp(c, errors.New("invalid request"), 500)
		return
	}
	clientId := setting.GetStr(conf.SSOClientId)
	platform := setting.GetStr(conf.SSOLoginPlatform)
	clientSecret := setting.GetStr(conf.SSOClientSecret)
	var tokenUrl, userUrl, scope, authField, idField, usernameField string
	additionalForm := make(map[string]string)
	switch platform {
	case "Github":
		tokenUrl = "https://github.com/login/oauth/access_token"

View on GitHub (pinned to 843d9dc814)

Solutions

Enable SSO login in the admin settings (site settings -> SSO -> enable)
If SSO is intentionally off, log in with local credentials and remove/disable the SSO login button in the frontend
Clear the IdP-side session if it keeps bouncing users to the callback

Defensive patterns

Strategy: validation

Validate before calling

if !setting.GetBool(conf.SSOLoginEnabled) {
    hideSSOButton() // do not offer SSO login to users
}

Try / catch

if resp.StatusCode() == 500 && strings.Contains(resp.String(), "sso login is disabled") {
    // feature flag off — offer local login instead of retrying the IdP flow
}

Prevention

Gate the frontend SSO button on the SSO-enabled config the server exposes
Keep IdP and AList feature toggles in sync during maintenance windows
After restoring settings from backup, re-verify the SSO toggle before announcing login options

When it happens

Trigger: The IdP redirects the browser back to /api/auth/sso_callback* after the admin disabled SSO login, or a user hits the callback URL directly on an instance where SSO was never enabled.

Common situations: Frontend still shows an SSO login button because it cached an old config; admin toggled SSO off during maintenance but the IdP session re-triggers callbacks; environment restored from a backup without SSO settings.

Related errors

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/049712396fd1e6a1. Report an issue: GitHub.