Dokploy/dokploy · error · TRPCError

BAD_REQUEST

BAD_REQUEST

Error message

Forward-auth requires an OIDC provider — SAML is not supported.

What it means

Forward-auth SSO in this platform is implemented on top of OpenID Connect (OIDC); resolveOidcConfig requires the SSO provider to have a non-null oidcConfig field. If the provider record only carries SAML configuration (oidcConfig is null), the request is rejected with BAD_REQUEST because SAML cannot be used for forward-auth.

Source

Thrown at packages/server/src/services/proprietary/forward-auth.ts:34

	setupForwardAuth,
} from "@dokploy/server/setup/forward-auth-setup";
import { manageDomain } from "@dokploy/server/utils/traefik/domain";
import {
	manageForwardAuthDomain,
	removeForwardAuthDomain,
	removeForwardAuthMiddleware,
} from "@dokploy/server/utils/traefik/forward-auth";
import { TRPCError } from "@trpc/server";
import { and, asc, desc, eq, isNotNull, isNull } from "drizzle-orm";
import { findApplicationById } from "../application";
import { findDomainById, updateDomainById } from "../domain";

const resolveOidcConfig = (provider: {
	issuer: string;
	oidcConfig: string | null;
}): ForwardAuthOidcConfig => {
	if (!provider.oidcConfig) {
		throw new TRPCError({
			code: "BAD_REQUEST",
			message:
				"Forward-auth requires an OIDC provider — SAML is not supported.",
		});
	}

	let parsed: any;
	try {
		parsed = JSON.parse(provider.oidcConfig);
	} catch {
		throw new TRPCError({
			code: "INTERNAL_SERVER_ERROR",
			message: "Failed to parse the SSO provider OIDC configuration",
		});
	}

	if (!parsed?.clientId || !parsed?.clientSecret) {
		throw new TRPCError({

View on GitHub (pinned to 546686ea35)

Solutions

1. Re-create or update the SSO provider as an OIDC provider (issuer, clientId, clientSecret) so oidcConfig is populated
2. If SAML is a hard requirement, do not use SSO forward-auth — it is OIDC-only
3. Check the ssoProvider row (SELECT provider_id, oidc_config ...) to confirm oidc_config IS NULL is the cause

const provider = await getProvider(providerId);
if (!provider.oidcConfig) { /* block forward-auth UI with clear message: OIDC required */ }

try { await oidc(provider) } catch (e) { if (e instanceof TRPCError && e.code === 'BAD_REQUEST') { /* prompt: switch provider to OIDC */ } }

When it happens

Trigger: Calling the forward-auth oidc resolver (e.g. deploying/enabling forward-auth) when the organization's SSO provider was created as a SAML provider with no oidcConfig stored in the database.

Common situations: Org configured SAML SSO and then tries to use SSO forward-auth on a domain; provider row created with providerType SAML so oidcConfig column is NULL; migrating from SAML to OIDC without updating the provider record.

Understand the failure class

Background: BAD_REQUEST error code: request rejected as invalid (HTTP 400) - causes and fixes across libraries — this error's family across 8 libraries.

Related errors

• INTERNAL_SERVER_ERROR
• PRECONDITION_FAILED
• INNGEST_BASE_URL is required to list deployment jobs
• UNAUTHORIZED
• Failed to fetch models: ${errorText}

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/fa44cf68f899ce90. Report an issue: GitHub.