{"record":{"id":"a3666544c523ab7a","repo":"langgenius/dify","slug":"workspace-not-found-please-contact-system-admin-t","errorCode":null,"errorMessage":"Workspace not found, please contact system admin to invite you to join in a workspace.","messagePattern":"Workspace not found, please contact system admin to invite you to join in a workspace\\.","errorType":"exception","errorClass":"WorkSpaceNotAllowedCreateError","httpStatus":null,"severity":"error","filePath":"api/controllers/console/auth/oauth.py","lineNumber":297,"sourceCode":"\n    return account\n\n\ndef _generate_account(\n    provider: str,\n    user_info: OAuthUserInfo,\n    timezone: str | None = None,\n    language: str | None = None,\n) -> tuple[Account, bool]:\n    # Get account by openid or email.\n    account = _get_account_by_openid_or_email(provider, user_info)\n    oauth_new_user = False\n\n    if account:\n        tenants = TenantService.get_join_tenants(account, session=db.session())\n        if not tenants:\n            if not FeatureService.is_workspace_creation_allowed():\n                raise WorkSpaceNotAllowedCreateError()\n            else:\n                TenantService.create_owner_tenant(account, session=db.session())\n\n    if not account:\n        normalized_email = user_info.email.lower()\n        oauth_new_user = True\n        if not FeatureService.get_system_features().is_allow_register:\n            if dify_config.DEPLOYMENT_EDITION == DeploymentEdition.CLOUD and BillingService.is_email_in_freeze(\n                normalized_email\n            ):\n                raise AccountRegisterError(\n                    description=(\n                        \"This email account has been deleted within the past \"\n                        \"30 days and is temporarily unavailable for new account registration\"\n                    )\n                )\n            raise AccountRegisterError(description=(\"Invalid email or password\"))\n        account_name = user_info.name or \"Dify\"","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/langgenius/dify/blob/ef8544b173fd6cd7a8e71df2cab576e52bebbfbc/api/controllers/console/auth/oauth.py#L279-L315","documentation":"Originates as WorkSpaceNotAllowedCreateError at oauth.py:297 inside _generate_account: an existing OAuth-authenticated account has NO joined tenants, and FeatureService.is_workspace_creation_allowed() returns False. The OAuth callback handler catches it at oauth.py:239 and redirects the browser to /signin with the query message 'Workspace not found, please contact system admin to invite you to join in a workspace.' (the same text as NotAllowedCreateWorkspace). So the user sees a redirect, not a JSON error.","triggerScenarios":"OAuth provider callback for a returning user whose account exists (matched by openid or email) but who has zero tenants, on a deployment where workspace creation is disabled (e.g. FeatureService policy or edition restricts it). TenantService.get_join_tenants returns empty -> WorkSpaceNotAllowedCreateError.","commonSituations":"SSO/OAuth user whose workspace was later deleted or who was removed from all tenants, trying to sign in again. Also occurs on managed deployments where self-service workspace creation is intentionally turned off and no admin invite exists for the user.","solutions":["Have a workspace admin invite the user via /console/api/workspaces/invite so they join an existing tenant, bypassing the auto-create path.","If policy allows, enable workspace creation via FeatureService so the else-branch at oauth.py:299 runs create_owner_tenant.","Confirm the user is signing in with the same identity (openid/email) that is actually a member of a tenant — a different email can look like 'no tenants'.","Check that the user's account is not in a deleted/banned state that removed tenant memberships."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before relying on OAuth sign-in, ensure the user has a tenant membership.\n// Admin-side: pre-create the membership so the OAuth callback's create path is not hit.\nawait adminInviteUser({email, workspace_id});","typeGuard":null,"tryCatchPattern":"// In the OAuth redirect handler, parse the ?message= query.\nconst url = new URL(window.location.href);\nif (url.searchParams.get('message')?.includes('Workspace not found')) {\n  showContactAdminPrompt();\n}","preventionTips":["Keep workspace creation enabled unless an invite-first policy is enforced.","When disabling workspace creation, provision invites for all known SSO users.","Educate users that 'Workspace not found' on OAuth means 'no membership', not a server outage."],"tags":["oauth","workspace","invite","policy","redirect"],"backgroundTag":null,"analyzedSha":"ef8544b173fd6cd7a8e71df2cab576e52bebbfbc","analyzedAt":"2026-08-12T05:15:17.394Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}