{"record":{"id":"5047ee14d68a8047","repo":"TechnitiumSoftware/DnsServer","slug":"failed-to-initialize-cluster-a-sso-user-cannot-in","errorCode":null,"errorMessage":"Failed to initialize Cluster: a SSO user cannot initialize cluster. Please login with a local administrator user account and try again.","messagePattern":"Failed to initialize Cluster: a SSO user cannot initialize cluster\\. Please login with a local administrator user account and try again\\.","errorType":"exception","errorClass":"DnsServerException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Cluster/ClusterManager.cs","lineNumber":529,"sourceCode":"            _dnsWebService.AuthManager.SaveConfigFile();\n\n            UnloadAndDeleteConfigFile();\n        }\n\n        #endregion\n\n        #region primary node\n\n        public void InitializeCluster(string clusterDomain, IReadOnlyList<IPAddress> primaryNodeIpAddresses, UserSession session)\n        {\n            if (ClusterInitialized)\n                throw new DnsServerException(\"Failed to initialize Cluster: the Cluster is already initialized.\");\n\n            if (!_dnsWebService.IsWebServiceTlsEnabled)\n                throw new InvalidOperationException();\n\n            if (session.User.IsSsoUser)\n                throw new DnsServerException(\"Failed to initialize Cluster: a SSO user cannot initialize cluster. Please login with a local administrator user account and try again.\");\n\n            clusterDomain = clusterDomain.ToLowerInvariant();\n\n            //create self node\n            string serverDomain = _dnsWebService.DnsServer.ServerDomain;\n            if (!serverDomain.EndsWith(\".\" + clusterDomain, StringComparison.OrdinalIgnoreCase))\n            {\n                int x = serverDomain.IndexOf('.');\n                if (x < 0)\n                    serverDomain = serverDomain + \".\" + clusterDomain;\n                else\n                    serverDomain = string.Concat(serverDomain.AsSpan(0, x), \".\", clusterDomain);\n            }\n\n            Uri primaryNodeUrl = new Uri($\"https://{serverDomain}:{_dnsWebService.WebServiceTlsPort}/\");\n\n            ClusterNode selfPrimaryNode = new ClusterNode(this, RandomNumberGenerator.GetInt32(int.MaxValue), primaryNodeUrl, primaryNodeIpAddresses, ClusterNodeType.Primary, ClusterNodeState.Self);\n","sourceCodeStart":511,"sourceCodeEnd":547,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Cluster/ClusterManager.cs#L511-L547","documentation":"Thrown by ClusterManager.InitializeCluster when the session's user is an SSO user. Bootstrapping a cluster creates primary/catalog DNS zones and rewrites server configuration, which requires a local administrator whose credentials are fully under the server's control; an SSO user's privileges and session lifetime are governed externally and cannot be trusted for this destructive, one-time operation. DnsServerException (not InvalidOperationException) is used so the API surfaces a user-facing message.","triggerScenarios":"An administrator logged in via SSO attempts to initialize the cluster through the web API. The guard fires after the already-initialized and TLS-enabled checks, before any cluster domain processing.","commonSituations":"A site that uses SSO exclusively for admin login; an SSO user with admin role tries cluster setup without realizing local creds are required; SSO session outlives a switch back to local auth.","solutions":["Log in with a local administrator account (not SSO) before running cluster initialization.","Ensure at least one local admin account exists before enabling SSO.","Gate the 'initialize cluster' UI action on the session user being a local admin."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (session.User.IsSsoUser)\n    return BadRequest(\"Log in with a local administrator account to initialize the cluster.\");\nclusterManager.InitializeCluster(domain, ips, session);","typeGuard":"static bool CanInitializeCluster(ClusterManager cm, UserSession s) => !cm.ClusterInitialized && !s.User.IsSsoUser;","tryCatchPattern":null,"preventionTips":["Keep at least one local administrator account available before enabling SSO.","Gate the cluster-init UI action on the session being a local admin.","Document that cluster bootstrap requires local credentials."],"tags":["cluster","auth","sso","initialization","permissions","technitium-dns-server"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}