{"record":{"id":"5fd904152aa73d1c","repo":"strapi/strapi","slug":"this-role-is-used-as-the-default-sso-role-make-su","errorCode":null,"errorMessage":"This role is used as the default SSO role. Make sure to change this configuration before deleting the role","messagePattern":"This role is used as the default SSO role\\. Make sure to change this configuration before deleting the role","errorType":"exception","errorClass":"ApplicationError","httpStatus":400,"severity":"error","filePath":"packages/core/admin/ee/server/src/services/role.ts","lineNumber":15,"sourceCode":"import { toString } from 'lodash/fp';\nimport { errors } from '@strapi/utils';\n\nconst { ApplicationError } = errors;\n\nconst ssoCheckRolesIdForDeletion = async (ids: any) => {\n  const adminStore = await strapi.store({ type: 'core', name: 'admin' });\n\n  const {\n    providers: { defaultRole },\n  } = (await adminStore.get({ key: 'auth' })) as any;\n\n  for (const roleId of ids) {\n    if (defaultRole && toString(defaultRole) === toString(roleId)) {\n      throw new ApplicationError(\n        'This role is used as the default SSO role. Make sure to change this configuration before deleting the role'\n      );\n    }\n  }\n};\n\nexport default {\n  ssoCheckRolesIdForDeletion,\n};\n","sourceCodeStart":1,"sourceCodeEnd":25,"githubUrl":"https://github.com/strapi/strapi/blob/4a4101264d7098754df36e85fa629fd2f2349d8c/packages/core/admin/ee/server/src/services/role.ts#L1-L25","documentation":"Thrown by the EE SSO role service when one of the role ids passed to ssoCheckRolesIdForDeletion matches the defaultRole stored in the admin 'auth' core store. It prevents deleting the role that SSO defaults new identities into, which would orphan SSO provisioning.","triggerScenarios":"Deleting an admin role whose id equals the configured SSO defaultRole (from the auth store).","commonSituations":"Reorganising roles without updating the SSO default; importing roles from another environment where ids differ; bulk-deleting roles including the SSO default.","solutions":["Change the SSO defaultRole to a non-deleted role in the admin SSO settings before deletion.","Exclude the SSO default role id from the deletion batch.","After role reorg, re-point defaultRole and verify via the admin store before deleting.","Read adminStore.get({ key: 'auth' }).providers.defaultRole to confirm which id is protected."],"exampleFix":"// before\n// delete role 3 while auth.providers.defaultRole === '3'\n// after\n// update SSO default role to 4, then delete role 3","handlingStrategy":"validation","validationCode":"const adminStore = await strapi.store({ type: 'core', name: 'admin' });\nconst { providers: { defaultRole } } = await adminStore.get({ key: 'auth' });\nif (ids.map(String).includes(String(defaultRole))) {\n  throw new Error('Cannot delete the SSO default role; reassign defaultRole first');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await roleService.deleteRoles(ids);\n} catch (e) {\n  if (e instanceof ApplicationError && /default SSO role/i.test(e.message)) {\n    // prompt to reassign defaultRole\n  } else throw e;\n}","preventionTips":["Keep SSO defaultRole in sync with role reorgs.","Exclude protected role ids from bulk delete operations.","Surface the configured defaultRole in the role management UI."],"tags":["admin","ee","sso","roles","rbac"],"backgroundTag":null,"analyzedSha":"4a4101264d7098754df36e85fa629fd2f2349d8c","analyzedAt":"2026-08-12T12:47:50.760Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}