{"record":{"id":"049712396fd1e6a1","repo":"AlistGo/alist","slug":"sso-login-is-disabled","errorCode":null,"errorMessage":"sso login is disabled","messagePattern":"sso login is disabled","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"server/handles/ssologin.go","lineNumber":288,"sourceCode":"\t\t}\n\t\thtml := fmt.Sprintf(`\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t`, token)\n\t\tc.Data(200, \"text/html; charset=utf-8\", []byte(html))\n\t\treturn\n\t}\n}\n\nfunc SSOLoginCallback(c *gin.Context) {\n\tenabled := setting.GetBool(conf.SSOLoginEnabled)\n\tusecompatibility := setting.GetBool(conf.SSOCompatibilityMode)\n\tif !enabled {\n\t\tcommon.ErrorResp(c, errors.New(\"sso login is disabled\"), 500)\n\t\treturn\n\t}\n\targument := c.Query(\"method\")\n\tif usecompatibility {\n\t\targument = path.Base(c.Request.URL.Path)\n\t}\n\tif !utils.SliceContains([]string{\"get_sso_id\", \"sso_get_token\"}, argument) {\n\t\tcommon.ErrorResp(c, errors.New(\"invalid request\"), 500)\n\t\treturn\n\t}\n\tclientId := setting.GetStr(conf.SSOClientId)\n\tplatform := setting.GetStr(conf.SSOLoginPlatform)\n\tclientSecret := setting.GetStr(conf.SSOClientSecret)\n\tvar tokenUrl, userUrl, scope, authField, idField, usernameField string\n\tadditionalForm := make(map[string]string)\n\tswitch platform {\n\tcase \"Github\":\n\t\ttokenUrl = \"https://github.com/login/oauth/access_token\"","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/server/handles/ssologin.go#L270-L306","documentation":"Returned by SSOLoginCallback when the ssologin-enabled setting is false. The callback endpoint refuses to process any SSO exchange while the feature is off, returning HTTP 500. This gate exists because the callback URL is publicly reachable and would otherwise leak an OAuth flow against unconfigured providers.","triggerScenarios":"The IdP redirects the browser back to /api/auth/sso_callback* after the admin disabled SSO login, or a user hits the callback URL directly on an instance where SSO was never enabled.","commonSituations":"Frontend still shows an SSO login button because it cached an old config; admin toggled SSO off during maintenance but the IdP session re-triggers callbacks; environment restored from a backup without SSO settings.","solutions":["Enable SSO login in the admin settings (site settings -> SSO -> enable)","If SSO is intentionally off, log in with local credentials and remove/disable the SSO login button in the frontend","Clear the IdP-side session if it keeps bouncing users to the callback"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if !setting.GetBool(conf.SSOLoginEnabled) {\n hideSSOButton() // do not offer SSO login to users\n}","typeGuard":null,"tryCatchPattern":"if resp.StatusCode() == 500 && strings.Contains(resp.String(), \"sso login is disabled\") {\n // feature flag off — offer local login instead of retrying the IdP flow\n}","preventionTips":["Gate the frontend SSO button on the SSO-enabled config the server exposes","Keep IdP and AList feature toggles in sync during maintenance windows","After restoring settings from backup, re-verify the SSO toggle before announcing login options"],"tags":["sso","auth","config","http-api"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}