RocketChat/Rocket.Chat · warning

SAML Provider not loaded due to invalid configuration

Error message

SAML Provider not loaded due to invalid configuration

What it means

At startup or when SAML settings change, each enabled provider entry (value === true) is validated with isValidConfiguration (required fields present, e.g. entry point/certificate). When validation fails, the provider is not loaded, its login service configuration is removed, and this warning names the offending provider key — users of that provider cannot log in until it is fixed.

Source

Thrown at apps/meteor/server/lib/saml/lib/settings.ts:147

	if (!services) {
		return SAMLUtils.setServiceProvidersList([]);
	}

	const providers = (
		await Promise.all(
			services.map(async ([key, value]) => {
				if (value === true) {
					const samlConfigs = getSamlConfigs(key);

					if (isValidConfiguration(key, samlConfigs)) {
						SAMLUtils.log({ msg: 'Loading SAML Provider', key });
						await LoginServiceConfiguration.createOrUpdateService(serviceName, samlConfigs);
						void notifyOnLoginServiceConfigurationChangedByService(serviceName);
						return configureSamlService(samlConfigs);
					}

					SAMLUtils.logger?.warn({ msg: 'SAML Provider not loaded due to invalid configuration', key });
				}

				const service = await LoginServiceConfiguration.removeByService(serviceName);
				if (!service) {
					return false;
				}

				void notifyOnLoginServiceConfigurationChanged({ _id: service._id }, 'removed');

				return false;
			}),
		)
	).filter((e) => e) as IServiceProviderOptions[];

	SAMLUtils.setServiceProvidersList(providers);
};

export const addSamlService = function (name: string): void {

View on GitHub (pinned to b2c16d5842)

Solutions

1. Open Administration > SAML Enterprise, find the provider matching the warned key, and complete all required fields (Entry Point, IdP certificate, etc.)
2. Verify the enable flag is boolean true and the config fields are non-empty strings
3. Disable or delete the half-configured provider so it stops failing validation on every restart
4. After fixing, confirm logs show 'Loading SAML Provider' and the metadata endpoint /_saml/metadata/<key> responds

Example fix

// before
Custom_SAML_test-sp: true
customEntryPoint: '' // blank

// after
Custom_SAML_test-sp: true
customEntryPoint: 'https://idp.example.com/saml/sso'

const requiredFields = ['customEntryPoint' /* provider name, cert, etc. per isValidConfiguration */] as const;

const validateProviderConfig = (configs: Record<string, unknown>): boolean =>
  requiredFields.every((field) => typeof configs[field] === 'string' && (configs[field] as string).trim().length > 0);

if (!validateProviderConfig(samlConfigs)) {
  throw new Error(`SAML provider "${key}" incomplete — fill Entry Point and certificate before enabling`);
}

When it happens

Trigger: A Custom SAML provider flag is true but its config is incomplete — blank Entry Point (SSO URL), missing IdP certificate, or a malformed provider entry — so isValidConfiguration(key, configs) returns false during the settings watch.

Common situations: Half-finished provider setup saved with enable=true; certificate pasted incorrectly or into the wrong field; provider removed from settings but flag left true; migrations between servers dropping parts of the config.

Related errors

• SLO redirect not configured
• Invalid MONGO_OPTIONS environment variable: must be valid JS
• user-not-found
• registration-disabled-authentication-services
• Invalid connection details

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/d6687547f18375c1. Report an issue: GitHub.