{"record":{"id":"3cf18bbb8c950d94","repo":"kubesphere/kubesphere","slug":"the-identity-provider-was-disabled","errorCode":null,"errorMessage":"the Identity provider was Disabled","messagePattern":"the Identity provider was Disabled","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/apiserver/authentication/identityprovider/configuration.go","lineNumber":40,"sourceCode":"\nconst (\n\tMappingMethodManual MappingMethod = \"manual\"\n\n\tMappingMethodAuto MappingMethod = \"auto\"\n\n\t// MappingMethodLookup Looks up an existing identity, user identity mapping, and user, but does not automatically\n\t// provision users or identities. Using this method requires you to manually provision users.\n\tMappingMethodLookup MappingMethod = \"lookup\"\n\n\tConfigTypeIdentityProvider = \"identityprovider\"\n\tSecretTypeIdentityProvider = \"config.kubesphere.io/\" + ConfigTypeIdentityProvider\n\n\tSecretDataKey = \"configuration.yaml\"\n)\n\nvar ErrorIdentityProviderNotFound = errors.New(\"the Identity provider was not found\")\n\nvar IdentityProviderIsDisabled = errors.New(\"the Identity provider was Disabled\")\n\ntype MappingMethod string\n\ntype Configuration struct {\n\t// The provider name.\n\tName string `json:\"name\" yaml:\"name\"`\n\n\t// Defines how new identities are mapped to users when they login. Allowed values are:\n\t//  - manual: The user needs to confirm the mapped username on the onboarding page.\n\t//  - auto: Skip the onboarding screen, so the user cannot change its username.\n\t//            Fails if a user with that username is already mapped to another identity.\n\t//  - lookup: Looks up an existing identity, user identity mapping, and user, but does not automatically\n\t//            provision users or identities. Using this method requires you to manually provision users.\n\tMappingMethod MappingMethod `json:\"mappingMethod\" yaml:\"mappingMethod\"`\n\n\t// The type of identity provider\n\tType string `json:\"type\" yaml:\"type\"`\n","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/kubesphere/kubesphere/blob/04a29b5c601470fa6bc2f2e92358dcb802a0d414/pkg/apiserver/authentication/identityprovider/configuration.go#L22-L58","documentation":"IdentityProviderIsDisabled is a sentinel error returned by GetConfiguration when the matching identity provider configuration exists but has Disabled=true. It distinguishes 'configured but turned off' from ErrorIdentityProviderNotFound so callers can report a precise reason to users.","triggerScenarios":"GetConfiguration finds a config entry whose Name matches, but config.Disabled is true, returning `nil, IdentityProviderIsDisabled`.","commonSituations":"An administrator disabled the login method (e.g. during migration or incident response); a stale client/browser still offers the disabled provider button; provider disabled in the ConfigMap but webhook/URLs not updated.","solutions":["Re-enable the identity provider by setting disabled: false in its configuration.yaml inside the identity provider configuration","Ask the cluster administrator why the provider was disabled","Update client UIs/links so the disabled provider is not offered to users","Distinguish this case in code with errors.Is(IdentityProviderIsDisabled, err) and return a clear message like 'login method disabled'"],"exampleFix":"// before\ncfg, err := getter.GetConfiguration(ctx, name)\nif err != nil {\n    return nil, err\n}\n// after\ncfg, err := getter.GetConfiguration(ctx, name)\nif err != nil {\n    if errors.Is(identityprovider.IdentityProviderIsDisabled, err) {\n        return nil, errors.New(\"this login method has been disabled by the administrator\")\n    }\n    return nil, err\n}","handlingStrategy":"type-guard","validationCode":"// Read the provider config and check the flag before login flows:\n// if cfg.Disabled { skip offering this provider in the UI }","typeGuard":"func isIdentityProviderDisabled(err error) bool {\n    return errors.Is(err, identityprovider.IdentityProviderIsDisabled)\n}","tryCatchPattern":"cfg, err := getter.GetConfiguration(ctx, name)\nif err != nil {\n    if isIdentityProviderDisabled(err) {\n        return nil, errors.New(\"login method disabled by administrator\")\n    }\n    return nil, err\n}","preventionTips":["Keep UI provider lists in sync with the Disabled flag","Communicate disablement to users instead of failing silently","Distinguish disabled from not-found with separate errors.Is checks"],"tags":["kubesphere","identity-provider","disabled","configuration"],"backgroundTag":"identity-provider-disabled","analyzedSha":"04a29b5c601470fa6bc2f2e92358dcb802a0d414","analyzedAt":"2026-09-03T18:33:15.017Z","contentChangedAt":"2026-09-03T18:33:15.017Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}