{"record":{"id":"5ae649531573c437","repo":"Budibase/budibase","slug":"cannot-enforce-sso-without-an-activated-configurat","errorCode":null,"errorMessage":"Cannot enforce SSO without an activated configuration","messagePattern":"Cannot enforce SSO without an activated configuration","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/worker/src/api/controllers/global/configs.ts","lineNumber":193,"sourceCode":"    // if the password is being replaced, use the existing password\n    if (existingConfig && existingConfig.auth?.pass) {\n      config.auth.pass = existingConfig.auth.pass\n    } else {\n      // otherwise, throw an error\n      throw new BadRequestError(\"SMTP password is required\")\n    }\n  }\n  await email.verifyConfig(config)\n}\n\nasync function processSettingsConfig(\n  config: SettingsInnerConfig & SettingsBrandingConfig,\n  existingConfig?: SettingsInnerConfig & SettingsBrandingConfig\n) {\n  if (config.isSSOEnforced) {\n    const valid = await hasActivatedConfig()\n    if (!valid) {\n      throw new Error(\"Cannot enforce SSO without an activated configuration\")\n    }\n  }\n\n  // always preserve file attributes\n  // these should be set via upload instead\n  // only allow for deletion by checking empty string to bypass this behaviour\n\n  if (existingConfig && config.logoUrl !== \"\") {\n    config.logoUrl = existingConfig.logoUrl\n    config.logoUrlEtag = existingConfig.logoUrlEtag\n  }\n  if (existingConfig && config.faviconUrl !== \"\") {\n    config.faviconUrl = existingConfig.faviconUrl\n    config.faviconUrlEtag = existingConfig.faviconUrlEtag\n  }\n}\n\nasync function verifySSOConfig(type: SSOConfigType, config: SSOConfig) {","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/worker/src/api/controllers/global/configs.ts#L175-L211","documentation":"processSettingsConfig validates that enabling isSSOEnforced is only possible when at least one SSO configuration (Google/OIDC) is activated, checked via hasActivatedConfig(). Enforcing SSO without an activated provider would lock all users out, so the save is rejected.","triggerScenarios":"PUT/POST to the settings config endpoint with isSSOEnforced=true while no activated SSO config exists in the tenant.","commonSituations":"Admins flip 'enforce SSO' before setting up the SSO provider itself, or an existing SSO config was deactivated/deleted leaving the enforcement flag checked in the form.","solutions":["Activate an SSO configuration (Google or OIDC) first, then enable SSO enforcement","Save the settings without isSSOEnforced until the provider is configured and activated","Verify via the config API that at least one SSO config has activated=true","If a provider was intentionally removed, clear the enforcement flag in the same save"],"exampleFix":"// before\n{ \"config\": { \"isSSOEnforced\": true } } // no activated SSO config\n// after\n// 1. activate an SSO config, then:\n{ \"config\": { \"isSSOEnforced\": true } }","handlingStrategy":"validation","validationCode":"const ssoConfigs = await configApi.fetch(ConfigType.GOOGLE, ConfigType.OIDC)\nconst hasActivated = ssoConfigs.some(c => c.config?.activated)\nif (settings.isSSOEnforced && !hasActivated) {\n  throw new Error(\"Activate an SSO provider before enabling enforcement\")\n}","typeGuard":null,"tryCatchPattern":"try {\n  await configApi.save(settings)\n} catch (err) {\n  if (err.message.includes(\"Cannot enforce SSO\")) {\n    // guide admin to activate an SSO provider first\n  } else { throw err }\n}","preventionTips":["Activate the SSO provider before toggling enforcement","In UIs, disable the enforcement toggle until a provider is active","Re-check activation state after deleting any SSO config","Save enforcement and provider activation as coordinated steps"],"tags":["sso","configuration","validation","auth"],"backgroundTag":"sso-config-state-conflict","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}