{"record":{"id":"03d826dfc7c64c0a","repo":"bytedance/deer-flow","slug":"automatic-account-creation-is-disabled-contact-yo","errorCode":null,"errorMessage":"Automatic account creation is disabled. Contact your administrator.","messagePattern":"Automatic account creation is disabled\\. Contact your administrator\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"backend/app/gateway/auth/user_provisioning.py","lineNumber":80,"sourceCode":"            raise HTTPException(\n                status_code=status.HTTP_403_FORBIDDEN,\n                detail=\"Your email domain is not allowed. Please use an approved email address.\",\n            )\n\n    # 4. Block if a local account already owns this email. We never auto-link an\n    # SSO identity onto a pre-existing local account, since that would let an SSO\n    # login take over a password account that happens to share the email.\n    local_user = await local_provider.get_user_by_email(email)\n\n    if local_user:\n        raise HTTPException(\n            status_code=status.HTTP_409_CONFLICT,\n            detail=(\"An account with this email already exists. Contact your administrator to link it to your SSO account.\"),\n        )\n\n    # 5. Auto-create\n    if not provider_config.auto_create_users:\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Automatic account creation is disabled. Contact your administrator.\",\n        )\n\n    role = _resolve_role(email, provider_config.admin_emails)\n    try:\n        user = await local_provider.create_oauth_user(\n            email=email,\n            oauth_provider=provider_id,\n            oauth_id=identity.subject,\n            system_role=role,\n        )\n    except ValueError:\n        # Lost a race: a concurrent callback (double-click, replayed code) already\n        # inserted a row that collides on the unique index. Re-resolve instead of\n        # bubbling a raw 500. If the winner created this same identity, return it;\n        # otherwise the email now belongs to a different account → 409.\n        existing = await local_provider.get_user_by_oauth(provider_id, identity.subject)","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/app/gateway/auth/user_provisioning.py#L62-L98","documentation":"HTTP 403 raised when no existing OAuth link, no blocking local account, but provider_config.auto_create_users is false. The provider is in 'invite-only' mode: unknown identities cannot self-register, so an administrator must create the account (or the link) first.","triggerScenarios":"First SSO login by a user unknown to the system when config.yaml sets auto_create_users: false for that provider. All prior checks (verified email, email present, domain allowed, no conflicting local account) passed.","commonSituations":"Locked-down enterprise deployments where accounts are pre-provisioned; piloting SSO with self-registration disabled; forgetting to flip the flag after the pilot.","solutions":["Have an administrator pre-create/link the user's account","Set auto_create_users: true for the provider in config.yaml and restart the Gateway"],"exampleFix":"# config.yaml (provider entry)\n# before\nauto_create_users: false\n# after\nauto_create_users: true","handlingStrategy":"validation","validationCode":"linked = await local_provider.get_user_by_oauth(provider_id, identity.subject)\nif not linked and not provider_config.auto_create_users:\n    return RedirectResponse(\"/login?error=invite_only\")","typeGuard":null,"tryCatchPattern":"try:\n    await provision_oauth_user(provider_id, identity, provider_config)\nexcept HTTPException as e:\n    if e.status_code == 403 and \"Automatic account creation is disabled\" in e.detail:\n        return page(\"request-access\")\n    raise","preventionTips":["Decide invite-only vs open registration per provider before go-live","Give admins a bulk-provision script when auto_create_users is false","Include the flag in the provider's config checklist"],"tags":["auth","oidc","sso","http-403","user-provisioning"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}