{"record":{"id":"541189902f918896","repo":"netbirdio/netbird","slug":"no-sso-provider-returned-from-management-please-p","errorCode":null,"errorMessage":"no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys","messagePattern":"no SSO provider returned from management\\. Please proceed with setting up this device using setup keys https://docs\\.netbird\\.io/how-to/register-machines-using-setup-keys","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/internal/auth/oauth.go","lineNumber":119,"sourceCode":"\t\tpkceFlowInfo.SetLoginHint(hint)\n\t}\n\n\treturn pkceFlowInfo, nil\n}\n\n// authenticateWithDeviceCodeFlow initializes the Device Code auth Flow\nfunc authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {\n\tauthClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create auth client: %v\", err)\n\t}\n\tdefer authClient.Close()\n\n\tdeviceFlowInfo, err := authClient.getDeviceFlow(authClient.client)\n\tif err != nil {\n\t\tswitch s, ok := gstatus.FromError(err); {\n\t\tcase ok && s.Code() == codes.NotFound:\n\t\t\treturn nil, fmt.Errorf(\"no SSO provider returned from management. \" +\n\t\t\t\t\"Please proceed with setting up this device using setup keys \" +\n\t\t\t\t\"https://docs.netbird.io/how-to/register-machines-using-setup-keys\")\n\t\tcase ok && s.Code() == codes.Unimplemented:\n\t\t\treturn nil, fmt.Errorf(\"the management server, %s, does not support SSO providers, \"+\n\t\t\t\t\"please update your server or use Setup Keys to login\", config.ManagementURL)\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"getting device authorization flow info failed with error: %v\", err)\n\t\t}\n\t}\n\n\tif hint != \"\" {\n\t\tdeviceFlowInfo.SetLoginHint(hint)\n\t}\n\n\treturn deviceFlowInfo, nil\n}\n","sourceCodeStart":101,"sourceCodeEnd":136,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/internal/auth/oauth.go#L101-L136","documentation":"Returned by authenticateWithDeviceCodeFlow when the getDeviceFlow management RPC fails with gRPC code NotFound (client/internal/auth/oauth.go:117-121). Management answered definitively: this account/domain has no IdP (SSO provider) configured, so no device authorization flow can be created. The message steers the user to setup keys, which are the non-SSO enrollment path.","triggerScenarios":"netbird up with interactive SSO login attempted against a management account where no IdP integration exists (devcert/local setups, fresh self-hosted installs, domains where the IdP config was deleted). The RPC itself succeeded - the answer is 'no provider'.","commonSituations":"Fresh self-hosted management without IdP configured; user mistakenly expects Google/Azure login on a plain setup-key-based deployment; IdP configuration removed from the account.","solutions":["Enroll with a setup key instead: netbird up --setup-key <key> (https://docs.netbird.io/how-to/register-machines-using-setup-keys)","If SSO is intended, have the management administrator configure the IdP integration for the account/domain","Verify you are connecting to the intended management URL/account - a wrong domain can have no IdP while the real one does"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"flow, err := auth.NewOAuthFlow(ctx, cfg, isDesktop, false, hint)\nif err != nil {\n\tif strings.Contains(err.Error(), \"no SSO provider returned from management\") {\n\t\t// account has no IdP: switch to setup-key enrollment\n\t\treturn enrollWithSetupKey()\n\t}\n}","preventionTips":["Know your account's enrollment mode before running netbird up: setup-key accounts never support interactive SSO","Administrators: configure the IdP integration if interactive login is expected","Double-check the management URL - wrong accounts/domains often look like missing SSO"],"tags":["sso","management","setup-keys","grpc","configuration"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}