Budibase/budibase · error

Cannot enforce SSO without an activated configuration

Error message

Cannot enforce SSO without an activated configuration

What it means

processSettingsConfig validates that enabling isSSOEnforced is only possible when at least one SSO configuration (Google/OIDC) is activated, checked via hasActivatedConfig(). Enforcing SSO without an activated provider would lock all users out, so the save is rejected.

Source

Thrown at packages/worker/src/api/controllers/global/configs.ts:193

    // if the password is being replaced, use the existing password
    if (existingConfig && existingConfig.auth?.pass) {
      config.auth.pass = existingConfig.auth.pass
    } else {
      // otherwise, throw an error
      throw new BadRequestError("SMTP password is required")
    }
  }
  await email.verifyConfig(config)
}

async function processSettingsConfig(
  config: SettingsInnerConfig & SettingsBrandingConfig,
  existingConfig?: SettingsInnerConfig & SettingsBrandingConfig
) {
  if (config.isSSOEnforced) {
    const valid = await hasActivatedConfig()
    if (!valid) {
      throw new Error("Cannot enforce SSO without an activated configuration")
    }
  }

  // always preserve file attributes
  // these should be set via upload instead
  // only allow for deletion by checking empty string to bypass this behaviour

  if (existingConfig && config.logoUrl !== "") {
    config.logoUrl = existingConfig.logoUrl
    config.logoUrlEtag = existingConfig.logoUrlEtag
  }
  if (existingConfig && config.faviconUrl !== "") {
    config.faviconUrl = existingConfig.faviconUrl
    config.faviconUrlEtag = existingConfig.faviconUrlEtag
  }
}

async function verifySSOConfig(type: SSOConfigType, config: SSOConfig) {

View on GitHub (pinned to a81a902e9a)

Solutions

1. Activate an SSO configuration (Google or OIDC) first, then enable SSO enforcement
2. Save the settings without isSSOEnforced until the provider is configured and activated
3. Verify via the config API that at least one SSO config has activated=true
4. If a provider was intentionally removed, clear the enforcement flag in the same save

Example fix

// before
{ "config": { "isSSOEnforced": true } } // no activated SSO config
// after
// 1. activate an SSO config, then:
{ "config": { "isSSOEnforced": true } }

const ssoConfigs = await configApi.fetch(ConfigType.GOOGLE, ConfigType.OIDC)
const hasActivated = ssoConfigs.some(c => c.config?.activated)
if (settings.isSSOEnforced && !hasActivated) {
  throw new Error("Activate an SSO provider before enabling enforcement")
}

try {
  await configApi.save(settings)
} catch (err) {
  if (err.message.includes("Cannot enforce SSO")) {
    // guide admin to activate an SSO provider first
  } else { throw err }
}

When it happens

Trigger: PUT/POST to the settings config endpoint with isSSOEnforced=true while no activated SSO config exists in the tenant.

Common situations: Admins flip 'enforce SSO' before setting up the SSO provider itself, or an existing SSO config was deactivated/deleted leaving the enforcement flag checked in the form.

Related errors

• Configuration invalid. Must contain clientID, clientSecret,
• CouchDB password not set
• Configuration invalid. Must contain google clientID and clie
• Error constructing google authentication strategy: ${err}
• Error constructing OIDC authentication strategy - ${err}

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/5ae649531573c437. Report an issue: GitHub.