{"record":{"id":"4432c1b92cb99d85","repo":"theonedev/onedev","slug":"not-authorized-4432c1","errorCode":null,"errorMessage":"Not authorized","messagePattern":"Not authorized","errorType":"http","errorClass":"UnauthorizedException","httpStatus":403,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/SsoProviderResource.java","lineNumber":47,"sourceCode":"\n@Path(\"/sso-providers\")\n@Consumes(MediaType.APPLICATION_JSON)\n@Produces(MediaType.APPLICATION_JSON)\n@Singleton\npublic class SsoProviderResource {\n\n\t@Inject\n\tprivate SsoProviderService ssoProviderService;\n\n\t@Inject\n\tprivate AuditService auditService;\n\t\n\t@Api(order=100)\n    @GET\n\t@Path(\"/{ssoProviderId}\")\n    public SsoProvider getSsoProvider(@PathParam(\"ssoProviderId\") Long ssoProviderId) {\n    \tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n    \treturn ssoProviderService.load(ssoProviderId);\n    }\t\n\n\t@Api(order=200)\n    @GET\n    public List<SsoProvider> listSsoProviders() {\n    \tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n    \treturn ssoProviderService.query();\n    }\t\n\n\t@Api(order=250, description=\"Get SSO provider id by name\")\n\t@Path(\"/ids/{name}\")\n\t@GET\n\tpublic Long getSsoProviderId(@PathParam(\"name\") String name) {\n    \tif (!SecurityUtils.isAdministrator()) \n\t\t\tthrow new UnauthorizedException();\n","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/SsoProviderResource.java#L29-L65","documentation":"Administrator-only guard in SsoProviderResource.getSsoProvider: SSO provider configuration is sensitive, and the caller is not an administrator (SecurityUtils.isAdministrator() false), so UnauthorizedException is thrown before loading the provider. Fix: authenticate as a system administrator.","triggerScenarios":"Fetching SSO provider details via REST as a regular user.","commonSituations":"Non-admin automation inspecting SSO configuration; assuming SSO provider read access is available to all authenticated users.","solutions":["Authenticate as a server administrator","Grant admin privileges if the integration legitimately requires them","Retrieve provider info from non-privileged endpoints if available"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (!isAdminAccount) skipSsoProviderApi();","typeGuard":null,"tryCatchPattern":"try { const p = await api.getSsoProvider(id); } catch (e) { if (e.status === 401) throw new Error('Administrator privileges required'); }","preventionTips":["Use admin credentials for SSO configuration endpoints","Verify account privileges before calling admin-only resources"],"tags":["rest-api","sso","permissions"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}