{"record":{"id":"337b42bb0b0035f7","repo":"gotify/server","slug":"local-authentication-is-disabled","errorCode":null,"errorMessage":"local authentication is disabled","messagePattern":"local authentication is disabled","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"api/session.go","lineNumber":63,"sourceCode":"//\t  200:\n//\t    description: Ok\n//\t    schema:\n//\t        $ref: \"#/definitions/CurrentUser\"\n//\t    headers:\n//\t      Set-Cookie:\n//\t        type: string\n//\t        description: session cookie\n//\t  401:\n//\t    description: Unauthorized\n//\t    schema:\n//\t        $ref: \"#/definitions/Error\"\n//\t  403:\n//\t    description: Forbidden\n//\t    schema:\n//\t        $ref: \"#/definitions/Error\"\nfunc (a *SessionAPI) Login(ctx *gin.Context) {\n\tif !a.LocalAuthEnabled {\n\t\tctx.AbortWithError(403, errors.New(\"local authentication is disabled\"))\n\t\treturn\n\t}\n\n\tname, pass, ok := ctx.Request.BasicAuth()\n\tif !ok {\n\t\tctx.AbortWithError(401, errors.New(\"basic auth required\"))\n\t\treturn\n\t}\n\n\tuser, err := a.DB.GetUserByName(name)\n\tif err != nil {\n\t\tctx.AbortWithError(500, err)\n\t\treturn\n\t}\n\tif user == nil || !password.ComparePassword(user.Pass, []byte(pass)) {\n\t\tctx.AbortWithError(401, errors.New(\"invalid credentials\"))\n\t\treturn\n\t}","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/gotify/server/blob/14bfc256276775c425f988d621dccfe705de18ac/api/session.go#L45-L81","documentation":"SessionAPI.Login returns 403 'local authentication is disabled' when the handler runs with a.LocalAuthEnabled == false. The deployment has turned off local username/password (basic-auth) login — typically because only SSO/OIDC login is allowed — so any attempt to log in via the local /login endpoint is rejected before credentials are even read. This is a deliberate policy refusal, not an authentication failure.","triggerScenarios":"POST /api/session (or /login) with Basic Auth credentials while the server was started with local authentication disabled (e.g. LocalAuthEnabled=false in config).","commonSituations":"Deployments configured with SSO-only auth where users still try curl -u or basic auth to obtain a session token; CI scripts using old local credentials after the org switched to SSO; config flag flipped during an upgrade; API docs/examples not updated after disabling local auth.","solutions":["Authenticate via the configured SSO/OIDC provider instead of local basic auth","If local login is intended, enable it in the server configuration (set local-auth enabled / LocalAuthEnabled=true) and restart","Update scripts and CI to use the SSO flow or an API token instead of local credentials","Check deployment docs/changelog for when local auth was disabled"],"exampleFix":"// before (client)\ncurl -u user:pass https://host/api/session\n// after (client) — use the SSO flow/token instead\ncurl -H \"Authorization: Bearer $SSO_ACCESS_TOKEN\" https://host/api/session","handlingStrategy":"fallback","validationCode":"// probe whether local auth is usable before sending credentials\nconf := fetchServerConfig(baseURL) // e.g. /api/config or OIDC discovery\nif !conf.LocalAuthEnabled {\n    return startSSOLoginFlow(conf.OIDCIssuer)\n}","typeGuard":null,"tryCatchPattern":"if resp.StatusCode == 403 && strings.Contains(body, \"local authentication is disabled\") {\n    return fallbackToSSOLogin() // redirect user to the OIDC/SSO provider\n}","preventionTips":["Discover the auth mode from server config/discovery before login attempts","Prefer SSO/OIDC flows in deployments where local auth is off","Update CI scripts to use tokens/SSO instead of basic auth credentials","Check release notes for local-auth flags before upgrading environments"],"tags":["http-403","authentication","sso","gin"],"backgroundTag":"local-auth-disabled","analyzedSha":"14bfc256276775c425f988d621dccfe705de18ac","analyzedAt":"2026-09-05T12:52:36.781Z","contentChangedAt":"2026-09-05T12:52:36.781Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}