{"record":{"id":"50d89c1bbed96134","repo":"we-promise/sure","slug":"no-sso-providers-enabled-check-auth-yml-env-con","errorCode":null,"errorMessage":"No SSO providers enabled; check auth.yml / ENV configuration or database providers","messagePattern":"No SSO providers enabled; check auth\\.yml / ENV configuration or database providers","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/initializers/omniauth.rb","lineNumber":144,"sourceCode":"        saml_options[:idp_metadata_url] = idp_metadata_url\n      else\n        saml_options[:idp_sso_service_url] = idp_sso_url\n        saml_options[:idp_cert] = settings[:idp_certificate].presence || settings[\"idp_certificate\"].presence\n        saml_options[:idp_cert_fingerprint] = settings[:idp_cert_fingerprint].presence || settings[\"idp_cert_fingerprint\"].presence\n      end\n\n      # Optional: IdP SLO (Single Logout) URL\n      idp_slo_url = settings[:idp_slo_url].presence || settings[\"idp_slo_url\"].presence\n      saml_options[:idp_slo_service_url] = idp_slo_url if idp_slo_url.present?\n\n      provider :saml, saml_options\n\n      Rails.configuration.x.auth.sso_providers << cfg.merge(name: name, strategy: \"saml\")\n    end\n  end\n\n  if Rails.configuration.x.auth.sso_providers.empty?\n    Rails.logger.warn(\"No SSO providers enabled; check auth.yml / ENV configuration or database providers\")\n  end\nend\n","sourceCodeStart":126,"sourceCodeEnd":147,"githubUrl":"https://github.com/we-promise/sure/blob/e69894adb92547273377398c15f45c979cd9416a/config/initializers/omniauth.rb#L126-L147","documentation":"Logged at the end of the OmniAuth builder block after every loaded provider has been processed. Rails.configuration.x.auth.sso_providers starts as an empty array and only gains entries when a provider is fully registered (openid_connect with valid options, google_oauth2/github with client credentials, saml with IdP settings). If it is still empty, no SSO strategy was mounted and the app falls back to password-only authentication.","triggerScenarios":"ProviderLoader.load_providers returns an empty list (no auth.yml, no ENV provider variables, empty database providers); or every candidate provider was skipped by its own guard in the same loop — OIDC with missing required options (line 44), google_oauth2/github missing client_id/client_secret, SAML missing IdP config (line 105).","commonSituations":"Fresh deployment where auth.yml was never copied from the example; docker/compose environment not passing the SSO ENV variables; all providers skipped because of individual config gaps (each skip logs its own warning earlier in boot, e.g. index 440); self-hosting users who intend password login only and can ignore this.","solutions":["Scan the same boot log for the per-provider skip warnings that precede this line (e.g. \"Skipping SAML provider ... missing IdP configuration\") and fix each indicated provider first","Ensure at least one provider is complete: copy .env/auth.yml example values and fill client_id/client_secret or SAML/OIDC settings","Verify ProviderLoader.load_providers is reading the source you think (auth.yml present in config/, ENV set, or provider rows in the database) and that the provider records are not disabled/blank","Restart and confirm sso_providers is populated (e.g. from a rails runner) if SSO is required"],"exampleFix":"# .env.local - before\n# no SSO variables set\n\n# .env.local - after\nGOOGLE_OAUTH_CLIENT_ID=xxx.apps.googleusercontent.com\nGOOGLE_OAUTH_CLIENT_SECRET=yyy","handlingStrategy":"validation","validationCode":"# Boot-time assertion: SSO expected but nothing registered\nif Rails.env.production? && ENV[\"REQUIRE_SSO\"] == \"1\" && Rails.configuration.x.auth.sso_providers.empty?\n  raise \"No SSO providers enabled - check auth.yml / ENV / database providers\"\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Grep boot logs for all 'Skipping ... provider' warnings together, since each skip contributes to the empty list","Codify required SSO providers in CI (e.g. a rake check against sso_providers) for deployments where SSO is mandatory","When SSO is intentionally disabled, document that this warning is expected to reduce alert noise"],"tags":["sso","omniauth","configuration","boot","auth-yml"],"backgroundTag":"sso-provider-misconfigured","analyzedSha":"e69894adb92547273377398c15f45c979cd9416a","analyzedAt":"2026-08-21T18:22:41.165Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}