{"record":{"id":"1d36b7eacdf11b54","repo":"postalserver/postal","slug":"oidc-cannot-be-used-unless-enabled-in-the-configur","errorCode":null,"errorMessage":"OIDC cannot be used unless enabled in the configuration","messagePattern":"OIDC cannot be used unless enabled in the configuration","errorType":"exception","errorClass":"Postal::Error","httpStatus":500,"severity":"error","filePath":"app/controllers/sessions_controller.rb","lineNumber":72,"sourceCode":"      flash.now[:alert] = \"You must enter a new password\"\n      return\n    end\n\n    @user.password = params[:password]\n    @user.password_confirmation = params[:password_confirmation]\n    return unless @user.save\n\n    login(@user)\n    redirect_to_with_return_to root_path, notice: \"Your new password has been set and you've been logged in.\"\n  end\n\n  def ip\n    render plain: \"ip: #{request.ip} remote ip: #{request.remote_ip}\"\n  end\n\n  def create_from_oidc\n    unless Postal::Config.oidc.enabled?\n      raise Postal::Error, \"OIDC cannot be used unless enabled in the configuration\"\n    end\n\n    auth = request.env[\"omniauth.auth\"]\n    user = User.find_from_oidc(auth.extra.raw_info, logger: Postal.logger)\n    if user.nil?\n      redirect_to login_path, alert: \"No user was found matching your identity. Please contact your administrator.\"\n      return\n    end\n\n    login(user)\n    flash[:remember_login] = true\n    redirect_to_with_return_to root_path\n  end\n\n  def oauth_failure\n    redirect_to login_path, alert: \"An issue occurred while logging you in with OpenID. Please try again later or contact your administrator.\"\n  end\n","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/postalserver/postal/blob/d038eaa8c763d3cafa797ccd6f773d53470bd336/app/controllers/sessions_controller.rb#L54-L90","documentation":"Raised by SessionsController#create_from_oidc, the OmniAuth callback handler for Postal's login. Before touching the identity payload it asserts Postal::Config.oidc.enabled?; when the oidc section is absent or disabled in postal.yml the callback must be inert, so any request to it fails fast with Postal::Error instead of silently mis-authenticating.","triggerScenarios":"The OmniAuth callback request (GET /auth/postal/callback after the IdP redirects back) reaches the controller while postal.yml has no oidc block or enabled is false - e.g. clicking a stale SSO link on a server where OIDC was never turned on, or the callback URL is hit directly by a scanner.","commonSituations":"Enabling omniauth routes but forgetting the matching postal.yml oidc section (host, client_id, client_secret, issuer, scope, etc.); the oidc block placed under the wrong Rails environment key so it never loads; typos in the config key; testing the callback locally against production-style config; environment variable substitution producing an empty oidc section.","solutions":["Enable OIDC in postal.yml under the correct environment: oidc.enabled plus host, client_id, client_secret, issuer/authorization_endpoint/token_endpoint/userinfo_endpoint, then restart Postal","Verify the config is actually loaded (e.g. Postal::Config.oidc.enabled? in a rails console on the same env)","Check the block is nested under the right Rails.env key and that ENV interpolation for the oidc values resolves","If OIDC is not meant to be used, remove/avoid the /auth/postc-style SSO entry points rather than leaving the callback reachable"],"exampleFix":"# before (postal.yml)\nproduction:\n  # no oidc section -> callback raises\n\n# after\nproduction:\n  oidc:\n    enabled: true\n    host: postal.example.com\n    client_id: <%= ENV[\"POSTAL_OIDC_CLIENT_ID\"] %>\n    client_secret: <%= ENV[\"POSTAL_OIDC_CLIENT_SECRET\"] %>\n    issuer: https://idp.example.com\n    scope: openid email profile\n    authorization_endpoint: https://idp.example.com/authorize\n    token_endpoint: https://idp.example.com/token\n    userinfo_endpoint: https://idp.example.com/me","handlingStrategy":"validation","validationCode":"# before linking/redirecting users to SSO\nredirect_to login_path, alert: \"Single sign-on is not enabled.\" unless Postal::Config.oidc.enabled?","typeGuard":"def oidc_usable?\n  Postal::Config.oidc.respond_to?(:enabled?) && Postal::Config.oidc.enabled?\nend","tryCatchPattern":"begin\n  post \"/auth/postal/callback\"\nrescue Postal::Error => e\n  # configuration problem, not a user mistake: report loudly\n  render plain: \"SSO is not configured on this server\", status: :service_unavailable\nend","preventionTips":["Add a boot/startup check that fails fast when omniauth routes exist but Postal::Config.oidc.enabled? is false","Keep the oidc YAML block and the omniauth provider wiring in the same change so they cannot drift","Smoke-test the full IdP redirect flow after any config deploy","Load config from ENV consistently on all nodes behind the load balancer"],"tags":["postal","oidc","sso","omniauth","configuration"],"backgroundTag":"oauth-provider-misconfigured","analyzedSha":"d038eaa8c763d3cafa797ccd6f773d53470bd336","analyzedAt":"2026-08-21T13:52:57.446Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}