{"record":{"id":"a05d1c7b0fa2eab2","repo":"netbirdio/netbird","slug":"sso-login-failed-v-a05d1c","errorCode":null,"errorMessage":"sso login failed: %v","messagePattern":"sso login failed: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/up.go","lineNumber":387,"sourceCode":"\t\t\ts.Code() == codes.PermissionDenied ||\n\t\t\ts.Code() == codes.NotFound ||\n\t\t\ts.Code() == codes.Unimplemented) {\n\t\t\tloginErr = backOffErr\n\t\t\treturn nil\n\t\t}\n\t\treturn backOffErr\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"login backoff cycle failed: %v\", err)\n\t}\n\n\tif loginErr != nil {\n\t\treturn daemonCallError(\"login failed\", loginErr)\n\t}\n\n\tif loginResp.NeedsSSOLogin {\n\t\tif err := handleSSOLogin(ctx, cmd, loginResp, client, pm); err != nil {\n\t\t\treturn fmt.Errorf(\"sso login failed: %v\", err)\n\t\t}\n\t}\n\n\tif _, err := client.Up(ctx, &proto.UpRequest{\n\t\tProfileName: &profileID,\n\t\tUsername:    &username,\n\t}); err != nil {\n\t\treturn daemonCallError(\"call service up method\", err)\n\t}\n\n\treturn nil\n}\n\nfunc setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, profileName, username string) *proto.SetConfigRequest {\n\tvar req proto.SetConfigRequest\n\treq.ProfileName = profileName\n\treq.Username = username\n","sourceCodeStart":369,"sourceCodeEnd":405,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/up.go#L369-L405","documentation":"Fires when handleSSOLogin fails after Login returned NeedsSSOLogin=true. That helper (client/cmd/login.go) drives the browser-based OIDC flow: it requests a verification URI from the daemon, opens/prints it, and waits for the daemon to confirm token exchange. Any failure in that exchange — user cancels, timeout, management IdP misconfiguration, or daemon callback error — is wrapped with 'sso login failed'.","triggerScenarios":"Interactive `netbird up` without a setup key where the IdP flow breaks: browser never completes authorization before timeout, IdP rejects the client, management's IDP configuration is wrong, or the CLI context is canceled while waiting.","commonSituations":"Self-hosted management with misconfigured OIDC provider/redirect URI, expired auth session, headless environments where the printed URL cannot be opened in time, or clock skew breaking the token exchange.","solutions":["Re-run `netbird up` and complete the opened browser flow promptly","On headless machines, copy the printed verification URL into a browser on another device","Verify the IdP configuration on management (client id/secret, redirect URI, issuer)","For unattended machines, register with a setup key instead of SSO: `netbird up --setup-key <key>`"],"exampleFix":"# before\nnetbird up  # interactive SSO on a headless box\n# after\nnetbird up --setup-key AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := handleSSOLogin(...); err != nil {\n\t// fallback: register non-interactively with a setup key\n\treturn runUpWithSetupKey(setupKey)\n}","preventionTips":["Use setup keys for headless/unattended hosts; reserve SSO for interactive desktops","Complete the browser flow promptly; keep IdP clocks synced (NTP)","Validate management's IdP config (redirect URIs, issuer) before onboarding users"],"tags":["go","netbird","sso","oidc","authentication","login"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}