{"record":{"id":"00ecfe9da2057d24","repo":"mastra-ai/mastra","slug":"sso-not-configured","errorCode":null,"errorMessage":"SSO not configured","messagePattern":"SSO not configured","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"error","filePath":"packages/server/src/server/handlers/auth.ts","lineNumber":358,"sourceCode":"// GET /auth/sso/login\n// ============================================================================\n\nexport const GET_SSO_LOGIN_ROUTE = createPublicRoute({\n  method: 'GET',\n  path: '/auth/sso/login',\n  responseType: 'datastream-response',\n  queryParamSchema: ssoLoginQuerySchema,\n  summary: 'Initiate SSO login',\n  description: 'Returns the SSO login URL and sets PKCE cookies if needed.',\n  tags: ['Auth'],\n  handler: async ctx => {\n    try {\n      const { mastra, redirect_uri, request, routePrefix } = ctx as any;\n      const isStudio = isStudioRequest(request);\n      const auth = getAuthProvider(mastra, isStudio);\n\n      if (!auth || !implementsInterface<ISSOProvider>(auth, 'getLoginUrl')) {\n        throw new HTTPException(404, { message: 'SSO not configured' });\n      }\n\n      // Build OAuth callback URI using the configured route prefix\n      const origin = getPublicOrigin(request);\n      const raw = ((routePrefix as string) || '/api').trim();\n      const withSlash = raw.startsWith('/') ? raw : `/${raw}`;\n      const prefix = withSlash.endsWith('/') ? withSlash.slice(0, -1) : withSlash;\n      const oauthCallbackUri = `${origin}${prefix}/auth/sso/callback`;\n\n      // Encode the post-login redirect in state (where user goes after auth completes)\n      // State format: uuid|postLoginRedirect\n      // Validate redirect_uri to prevent open-redirect attacks: allow relative paths,\n      // same-origin URLs, and localhost URLs (for dev setups where Studio runs on a\n      // different port).\n      let postLoginRedirect = '/';\n      if (redirect_uri) {\n        if (!redirect_uri.startsWith('http')) {\n          // Relative path — always safe","sourceCodeStart":340,"sourceCodeEnd":376,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/handlers/auth.ts#L340-L376","documentation":"This HTTP 404 error is thrown by the SSO login-url route when there is no auth provider for the request context (studio vs non-studio), or the configured provider does not implement `getLoginUrl` (ISSOProvider). Mastra only exposes SSO login when an SSO-capable provider is configured.","triggerScenarios":"GET the SSO login route when: getAuthProvider(mastra, isStudio) returns undefined, or the provider lacks a getLoginUrl method — i.e. no SSO provider configured for that context.","commonSituations":"Running without an auth provider configured at all; using a credentials-only provider and hitting SSO routes; studio/non-studio provider resolution picks a provider without SSO support; misconfigured Mastra server auth options.","solutions":["Configure an SSO provider (implementing getLoginUrl) on the Mastra server auth config.","If you don't need SSO, stop calling the SSO login endpoint and use the credentials/sign-in flow instead.","Check whether the request targets studio or API context — make sure the provider is configured for that context (getAuthProvider's isStudio branch)."],"exampleFix":"// before\nnew Mastra({ server: { authConfig: undefined } });\n// after\nnew Mastra({\n  server: {\n    authConfig: new MySSOProvider(), // implements getLoginUrl()\n  },\n});","handlingStrategy":"validation","validationCode":"// probe whether SSO is available before redirecting the user\nconst res = await fetch('/api/auth/sso/login-url', { method: 'HEAD' });\nconst ssoAvailable = res.status !== 404;","typeGuard":null,"tryCatchPattern":"try {\n  const res = await fetch('/api/auth/sso/login-url');\n  if (res.status === 404) {\n    // SSO not configured: fall back to credentials sign-in UI\n    showCredentialsForm();\n  }\n} catch (e) { showCredentialsForm(); }","preventionTips":["Feature-detect SSO (probe the route or an auth-capabilities endpoint) before linking to it.","Keep provider capabilities (SSO vs credentials) documented per environment.","Match the frontend auth flows to the server's configured provider."],"tags":["http-404","sso","auth-configuration"],"backgroundTag":"auth-provider-not-configured","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}