{"record":{"id":"b7b38322ab5d0eba","repo":"rancher/rancher","slug":"provider-is-disabled","errorCode":null,"errorMessage":"Provider is disabled","messagePattern":"Provider is disabled","errorType":"http","errorClass":null,"httpStatus":404,"severity":"warning","filePath":"pkg/auth/handler/handler.go","lineNumber":112,"sourceCode":"\tif !ok {\n\t\tlogrus.Errorf(\"[oidc] Invalid auth config format for provider %s: expected runtime.Unstructured\", provider)\n\t\thttp.Error(w, \"Invalid auth config format\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\tdata := authConfigData.UnstructuredContent()\n\tlogrus.Debugf(\"[oidc] Retrieved auth config for provider: %s\", provider)\n\n\t// Validate that the provider is enabled\n\tif enabledRaw := data[client.GenericOIDCConfigFieldEnabled]; enabledRaw != nil {\n\t\tenabled, ok := enabledRaw.(bool)\n\t\tif !ok {\n\t\t\tlogrus.Errorf(\"[oidc] Invalid enabled field type for provider %s: expected bool, got %T\", provider, enabledRaw)\n\t\t\thttp.Error(w, \"Invalid provider configuration\", http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\t\tif !enabled {\n\t\t\tlogrus.Debugf(\"[oidc] Provider %s is disabled\", provider)\n\t\t\thttp.Error(w, \"Provider is disabled\", http.StatusNotFound)\n\t\t\treturn\n\t\t}\n\t}\n\n\t// Validate PKCE method if configured\n\tvar pkceVerifier string\n\tif pkceMethodRaw := data[client.GenericOIDCConfigFieldPKCEMethod]; pkceMethodRaw != nil {\n\t\tpkceMethod, ok := pkceMethodRaw.(string)\n\t\tif !ok {\n\t\t\tlogrus.Errorf(\"[oidc] Invalid PKCE method type for provider %s: expected string, got %T\", provider, pkceMethodRaw)\n\t\t\thttp.Error(w, \"Invalid PKCE method type\", http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\n\t\t// Validate supported PKCE methods\n\t\tif pkceMethod != \"\" && pkceMethod != oidc.PKCES256Method {\n\t\t\tlogrus.Warnf(\"[oidc] Unsupported PKCE method '%s' for provider %s\", pkceMethod, provider)\n\t\t\thttp.Error(w, \"Unsupported PKCE method. Supported methods: S256\", http.StatusBadRequest)","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/handler/handler.go#L94-L130","documentation":"The OIDC redirect handler checks the genericoidc config's `enabled` field; when it is explicitly false, the handler deliberately returns 404 \"Provider is disabled\" so that disabled providers look absent on the login path (matching the NotFound behavior for unknown providers). This is by design, not a crash.","triggerScenarios":"A request to the oidc redirect route for a provider whose AuthConfig has enabled: false — typically an admin disabled the provider but UI links, bookmarks, or downstream tooling still point at its login URL.","commonSituations":"Provider taken offline for maintenance or migration while old login URLs circulate; SSO cutover periods where one provider is disabled and another enabled; stale UI state after toggling a provider off in the UI.","solutions":["If the provider should be usable, re-enable it: kubectl patch authconfig <provider> --type merge -p '{\"genericOIDCConfig\":{\"enabled\":true}}'","If it should stay disabled, update or remove the login entry points (UI links, bookmarks, IdP-initiated login configs) that still target it","Check the rancher log \"[oidc] Provider <name> is disabled\" to confirm the deliberate 404 path","Distinguish from a typo'd provider name: that yields the plain NotFound branch without this log line"],"exampleFix":"# before\ngenericOIDCConfig:\n  enabled: false\n# after (if the provider must accept logins)\ngenericOIDCConfig:\n  enabled: true","handlingStrategy":"validation","validationCode":"// Before sending users to a provider's login URL, check it is enabled:\nif cfg, err := getAuthConfig(provider); err == nil && !cfg.GenericOIDC.Enabled {\n    return errors.New(\"provider \" + provider + \" is disabled; update login links\")\n}","typeGuard":null,"tryCatchPattern":"On 404 \"Provider is disabled\", stop redirecting users to that provider — retrying is pointless until an admin re-enables it.","preventionTips":["Keep login entry points (bookmarks, IdP-initiated configs, portal links) in sync with provider enablement","Prefer the /v1/authproviders list (which already filters disabled providers) to decide which login links to render","Expect 404 semantics for disabled providers: the login path intentionally hides them"],"tags":["rancher","oidc","authconfig","disabled-provider","login"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}