{"record":{"id":"acfad0eb071f9e63","repo":"rancher/rancher","slug":"saml-failed-to-retrieve-samlconfig-error-v","errorCode":null,"errorMessage":"SAML: failed to retrieve SamlConfig, error: %v","messagePattern":"SAML: failed to retrieve SamlConfig, error: (.+?)","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"pkg/auth/providers/saml/saml_provider.go","lineNumber":259,"sourceCode":"\t\t\t\"idpRedirectUrl\": idpRedirectURL,\n\t\t\t\"type\":           \"samlLoginOutput\",\n\t\t}\n\n\t\tw.Header().Set(\"Content-Type\", \"application/json\")\n\t\tif err := json.NewEncoder(w).Encode(data); err != nil {\n\t\t\treturn fmt.Errorf(\"SAML: Failed to encode samlLoginOutput: %w\", err)\n\t\t}\n\n\t\treturn nil\n\t}\n\n\treturn nil\n}\n\nfunc (s *Provider) getSamlConfigFromUnstructured() (*apiv3.SamlConfig, error) {\n\tauthConfigObj, err := s.authConfigs.ObjectClient().UnstructuredClient().Get(s.name, metav1.GetOptions{})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"SAML: failed to retrieve SamlConfig, error: %v\", err)\n\t}\n\n\tu, ok := authConfigObj.(runtime.Unstructured)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"SAML: failed to retrieve SamlConfig, cannot read k8s Unstructured data\")\n\t}\n\tstoredSamlConfigMap := u.UnstructuredContent()\n\n\tstoredSamlConfig := &apiv3.SamlConfig{}\n\terr = common.Decode(storedSamlConfigMap, storedSamlConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to decode Saml Config: %w\", err)\n\t}\n\n\tif enabled, ok := storedSamlConfigMap[\"enabled\"].(bool); ok {\n\t\tstoredSamlConfig.Enabled = enabled\n\t}\n","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/saml/saml_provider.go#L241-L277","documentation":"getSamlConfigFromUnstructured fetches the provider's authconfig custom resource through the management API (UnstructuredClient().Get(name)). This error wraps that k8s Get failure: resource not found, API server unreachable, RBAC denial, or a missing/stale CRD. The SAML provider code reads its own config lazily, so this surfaces during operations that need the stored config.","triggerScenarios":"The <provider> authconfig CR (e.g. keycloak, ping) does not exist or was deleted; the management cluster API is down or unreachable mid-request; the service account lacks RBAC on the authconfig resource; CRD missing after a botched upgrade.","commonSituations":"Authconfig manually deleted while the provider stayed registered; etcd/apiserver instability; Rancher upgraded or restored from backup without the management.cattle.io CRDs fully applied.","solutions":["Verify the resource exists: kubectl get <samlprovider> -A (e.g. kubectl get keycloak -A) and recreate/re-apply it if missing","Check API server health and Rancher's connectivity to the management cluster","Confirm RBAC for the Rancher service account on the authconfig resource","Reinstall/repair the management.cattle.io CRDs if the Get consistently fails with a 'no matches for kind' style error"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-flight: confirm the authconfig resource exists before operating\n_, err := dynamicClient.Resource(authConfigGVR).Namespace(ns).Get(ctx, providerName, metav1.GetOptions{})\nif apierrors.IsNotFound(err) {\n    return fmt.Errorf(\"authconfig %s/%s missing; (re)configure the provider\", ns, providerName)\n}","typeGuard":null,"tryCatchPattern":"cfg, err := s.getSamlConfigFromUnstructured()\nif err != nil {\n    if apierrors.IsNotFound(errors.Unwrap(err)) || strings.Contains(err.Error(), \"not found\") {\n        return retryWithBackoff(s.getSamlConfigFromUnstructured, 3) // transient during controller races\n    }\n    return err\n}","preventionTips":["Keep provider authconfig CRs under version control so they can be re-applied","Verify management-cluster API health as part of Rancher readiness","Avoid deleting authconfigs while the provider stays registered"],"tags":["saml","kubernetes","crd","rbac","configuration"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}