{"record":{"id":"0d762fda77b0eb1d","repo":"langfuse/langfuse","slug":"sign-in-with-email-and-password-is-disabled-for-th-0d762f","errorCode":null,"errorMessage":"Sign in with email and password is disabled for this domain. Please use SSO.","messagePattern":"Sign in with email and password is disabled for this domain\\. Please use SSO\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"web/src/server/auth.ts","lineNumber":104,"sourceCode":"    credentials: {\n      email: {\n        label: \"Email\",\n        type: \"email\",\n        placeholder: \"jsmith@example.com\",\n      },\n      password: { label: \"Password\", type: \"password\" },\n    },\n    async authorize(credentials, _req) {\n      if (!credentials) throw new Error(\"No credentials\");\n      if (env.AUTH_DISABLE_USERNAME_PASSWORD === \"true\")\n        throw new Error(\n          \"Sign in with email and password is disabled for this instance. Please use SSO.\",\n        );\n\n      const blockedDomains = getSSOBlockedDomains();\n      const domain = credentials.email.split(\"@\")[1]?.toLowerCase();\n      if (domain && blockedDomains.includes(domain)) {\n        throw new Error(\n          \"Sign in with email and password is disabled for this domain. Please use SSO.\",\n        );\n      }\n\n      // EE: Check custom SSO enforcement\n      const multiTenantSsoProvider =\n        await getSsoAuthProviderIdForDomain(domain);\n      if (multiTenantSsoProvider) {\n        throw new Error(ENTERPRISE_SSO_REQUIRED_MESSAGE);\n      }\n\n      const dbUser = await prisma.user.findUnique({\n        where: {\n          email: credentials.email.toLowerCase(),\n        },\n      });\n\n      if (!dbUser) {","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/langfuse/langfuse/blob/59d92c7cf365150d10b753b5a0d1708902a2ed60/web/src/server/auth.ts#L86-L122","documentation":"authorize() throws when the email's domain appears in the SSO blocked-domains list (getSSOBlockedDomains), forcing users of that domain to authenticate via SSO rather than password.","triggerScenarios":"Signing in with email/password where the part after @ matches a domain configured for SSO enforcement (e.g. via AUTH_SSO_BLOCKED_DOMAINS env or org config).","commonSituations":"Company domains moved to SSO-only; a contractor with a corporate-domain email trying password login after the domain was blocked.","solutions":["Sign in with the SSO provider associated with your domain","If password login for the domain should be re-enabled, remove the domain from the blocked-domains configuration/env","Double-check for typos in the configured domain list that may over-block"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const domain = email.split('@')[1]?.toLowerCase();\nif (blockedDomains.includes(domain)) showSSONotice();","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fetch blocked domains once and validate the form client-side","Keep the blocked-domain list curated to avoid over-blocking"],"tags":["nextauth","authentication","sso","domain-blocking"],"backgroundTag":"authentication-method-disabled","analyzedSha":"59d92c7cf365150d10b753b5a0d1708902a2ed60","analyzedAt":"2026-08-27T22:22:00.402Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}