{"record":{"id":"2f0d082c68ef8c75","repo":"windmill-labs/windmill","slug":"external-jwt-auth-is-not-open-source","errorCode":null,"errorMessage":"External JWT auth is not open source","messagePattern":"External JWT auth is not open source","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-api-auth/src/ee_oss.rs","lineNumber":24,"sourceCode":" * LICENSE-AGPL for a copy of the license.\n */\n\n#[cfg(feature = \"private\")]\n#[allow(unused)]\npub use crate::ee::*;\n\n#[cfg(all(feature = \"enterprise\", not(feature = \"private\")))]\nuse {std::sync::Arc, tokio::sync::RwLock};\n\n#[cfg(all(feature = \"enterprise\", not(feature = \"private\")))]\npub async fn jwt_ext_auth(\n    _w_id: Option<&String>,\n    _token: &str,\n    _external_jwks: Option<Arc<RwLock<ExternalJwks>>>,\n    _db: &windmill_common::DB,\n) -> anyhow::Result<(crate::ApiAuthed, usize, Option<uuid::Uuid>)> {\n    // Implementation is not open source\n    Err(anyhow::anyhow!(\"External JWT auth is not open source\"))\n}\n\n#[cfg(all(feature = \"enterprise\", not(feature = \"private\")))]\npub struct ExternalJwks;\n\n#[cfg(all(feature = \"enterprise\", not(feature = \"private\")))]\nimpl ExternalJwks {\n    pub async fn load() -> Option<Arc<RwLock<Self>>> {\n        // Implementation is not open source\n        None\n    }\n}\n","sourceCodeStart":6,"sourceCodeEnd":37,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-api-auth/src/ee_oss.rs#L6-L37","documentation":"jwt_ext_auth is the open-source (CE) stub for external JWT/JWKS authentication in windmill-api-auth. The real implementation lives behind the enterprise feature flag; in the OSS build the function unconditionally returns 'External JWT auth is not open source'. It is thrown whenever the code path for external JWT token validation is invoked without an enterprise build.","triggerScenarios":"Configuring an instance to authenticate API tokens via an external JWT issuer (external_jwks) on a community-edition Windmill build; any call to token auth routing that dispatches to jwt_ext_auth in a non-enterprise binary.","commonSituations":"Operator sets up an external OIDC/JWT identity provider for token validation but runs the CE image instead of Windmill EE; self-hosted user copies an EE-only auth config into a CE deployment.","solutions":["Run Windmill Enterprise Edition (enterprise feature build) where jwt_ext_auth is implemented","Remove the external JWT auth configuration and use built-in token/OAuth auth instead","Use a generic OIDC/OAuth identity-provider integration available in CE"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// check build capability before configuring external JWT\nif !cfg!(feature = \"enterprise\") {\n    panic!(\"external JWT auth requires Windmill EE\");\n}","typeGuard":null,"tryCatchPattern":"match jwt_ext_auth(...).await {\n    Ok(authed) => authed,\n    Err(e) if e.to_string().contains(\"not open source\") => {\n        return Err(Status::unimplemented(\"external JWT auth requires Windmill EE\"));\n    }\n    Err(e) => return Err(Status::internal(format!(\"{e:#}\"))),\n}","preventionTips":["Only configure external_jwks in instance settings on EE builds","Detect CE vs EE at startup and refuse EE-only auth configs early","Keep fallback token auth enabled"],"tags":["auth","jwt","enterprise","licensing"],"backgroundTag":"feature-requires-enterprise","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}