{"record":{"id":"6235ecd470e6555a","repo":"langfuse/langfuse","slug":"sign-in-with-email-and-password-is-disabled-for-th","errorCode":null,"errorMessage":"Sign in with email and password is disabled for this instance. Please use SSO.","messagePattern":"Sign in with email and password is disabled for this instance\\. Please use SSO\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"web/src/server/auth.ts","lineNumber":97,"sourceCode":"  isV4UpgradeUiAvailable,\n} from \"@/src/features/events/lib/v4Rollout\";\nimport { canCreateOrganizations } from \"@/src/features/organizations/server/canCreateOrganizations\";\n\nconst staticProviders: Provider[] = [\n  CredentialsProvider({\n    name: \"credentials\",\n    credentials: {\n      email: {\n        label: \"Email\",\n        type: \"email\",\n        placeholder: \"jsmith@example.com\",\n      },\n      password: { label: \"Password\", type: \"password\" },\n    },\n    async authorize(credentials, _req) {\n      if (!credentials) throw new Error(\"No credentials\");\n      if (env.AUTH_DISABLE_USERNAME_PASSWORD === \"true\")\n        throw new Error(\n          \"Sign in with email and password is disabled for this instance. Please use SSO.\",\n        );\n\n      const blockedDomains = getSSOBlockedDomains();\n      const domain = credentials.email.split(\"@\")[1]?.toLowerCase();\n      if (domain && blockedDomains.includes(domain)) {\n        throw new Error(\n          \"Sign in with email and password is disabled for this domain. Please use SSO.\",\n        );\n      }\n\n      // EE: Check custom SSO enforcement\n      const multiTenantSsoProvider =\n        await getSsoAuthProviderIdForDomain(domain);\n      if (multiTenantSsoProvider) {\n        throw new Error(ENTERPRISE_SSO_REQUIRED_MESSAGE);\n      }\n","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/langfuse/langfuse/blob/59d92c7cf365150d10b753b5a0d1708902a2ed60/web/src/server/auth.ts#L79-L115","documentation":"The credentials authorize() throws when the instance-level env var AUTH_DISABLE_USERNAME_PASSWORD=true, disabling password login entirely in favor of SSO.","triggerScenarios":"Any email/password sign-in attempt while AUTH_DISABLE_USERNAME_PASSWORD=true is set in the environment.","commonSituations":"Orgs enforcing SSO-only authentication set this flag; developers who copy a production .env locally then wonder why password login throws.","solutions":["Sign in via the configured SSO provider instead","If password login should be allowed, unset AUTH_DISABLE_USERNAME_PASSWORD (or set it to false) and restart web","If you are the admin, confirm this disable was intentional before changing it"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const canPasswordLogin = env.AUTH_DISABLE_USERNAME_PASSWORD !== 'true';\nif (!canPasswordLogin) redirect user to SSO sign-in;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Have the UI read the public flag and hide the password form","Document instance auth policy to users"],"tags":["nextauth","authentication","sso","env-config"],"backgroundTag":"authentication-method-disabled","analyzedSha":"59d92c7cf365150d10b753b5a0d1708902a2ed60","analyzedAt":"2026-08-27T22:22:00.402Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}