{"record":{"id":"5a6b47e5831e7679","repo":"windmill-labs/windmill","slug":"not-implemented-in-windmill-s-open-source-reposito-5a6b47","errorCode":null,"errorMessage":"Not implemented in Windmill's Open Source repository","messagePattern":"Not implemented in Windmill's Open Source repository","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-common/src/oidc_oss.rs","lineNumber":93,"sourceCode":"pub async fn generate_id_token<T: AdditionalClaims>(\n    _db: Option<&DB>,\n    _claim: T,\n    _audience: &str,\n    _identifier: String,\n    _email: Option<String>,\n) -> Result<WindmillIdToken> {\n    Err(Error::internal_err(\n        \"Not implemented in Windmill's Open Source repository\".to_string(),\n    ))\n}\n\n#[cfg(all(\n    feature = \"enterprise\",\n    feature = \"openidconnect\",\n    not(feature = \"private\")\n))]\npub async fn get_private_key(_db: Option<&DB>) -> anyhow::Result<String> {\n    Err(anyhow::anyhow!(\n        \"Not implemented in Windmill's Open Source repository\"\n    ))\n}\n","sourceCodeStart":75,"sourceCodeEnd":97,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-common/src/oidc_oss.rs#L75-L97","documentation":"`get_private_key` in windmill-common's oidc_oss.rs is a compile-time stub: when the crate is built with the `enterprise`/`openidconnect` features but WITHOUT the `private` feature (i.e. the public OSS build), the function unconditionally returns this error. It signals that the OIDC private-key logic lives in Windmill's closed-source enterprise code and can never succeed in this build.","triggerScenarios":"Any call to `windmill_common::oidc_oss::get_private_key(db)` on a public (OSS) Windmill build, e.g. code paths that need the OIDC client private key for token signing/decryption.","commonSituations":"Deploying the open-source Windmill image (GHCR windmill) while configuring enterprise-only OIDC/SSO features; custom backend code calling this helper expecting the EE implementation; mixing OSS backend with EE-only auth settings.","solutions":["Use Windmill's Enterprise Edition build/image, which contains the private implementation of get_private_key.","Remove or disable the OIDC SSO configuration in instance settings that requires the private key on an OSS deployment.","If you control the build, compile with the `private` feature to link the EE implementation.","Provide the key through an alternative supported mechanism (e.g. env-based config) if available for your auth flow."],"exampleFix":"// before (OSS build)\nlet key = windmill_common::oidc_oss::get_private_key(Some(&db)).await?;\n// after: guard with feature/config check or use EE image\n#[cfg(feature = \"private\")]\nlet key = windmill_common::oidc_oss::get_private_key(Some(&db)).await?;","handlingStrategy":"try-catch","validationCode":"if cfg!(not(feature = \"private\")) {\n    anyhow::bail!(\"OIDC private key requires the Enterprise build\");\n}","typeGuard":null,"tryCatchPattern":"match windmill_common::oidc_oss::get_private_key(Some(&db)).await {\n    Ok(key) => use_key(&key),\n    Err(e) if e.to_string().contains(\"Open Source\") => fallback_to_non_oidc_auth(),\n    Err(e) => return Err(e),\n}","preventionTips":["Check whether the deployed image is EE before enabling OIDC/SSO features.","Gate enterprise-only code paths behind the `private` cargo feature.","Surface a clear config error at startup when OSS build + OIDC config is detected."],"tags":["oidc","enterprise","feature-gate","rust"],"backgroundTag":"feature-not-available-in-open-source","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}