{"record":{"id":"bf4697f210f1c846","repo":"netbirdio/netbird","slug":"the-management-server-s-does-not-support-sso-pr","errorCode":null,"errorMessage":"the management server, %s, does not support SSO providers, please update your server or use Setup Keys to login","messagePattern":"the management server, (.+?), does not support SSO providers, please update your server or use Setup Keys to login","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/internal/auth/oauth.go","lineNumber":123,"sourceCode":"}\n\n// authenticateWithDeviceCodeFlow initializes the Device Code auth Flow\nfunc authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {\n\tauthClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create auth client: %v\", err)\n\t}\n\tdefer authClient.Close()\n\n\tdeviceFlowInfo, err := authClient.getDeviceFlow(authClient.client)\n\tif err != nil {\n\t\tswitch s, ok := gstatus.FromError(err); {\n\t\tcase ok && s.Code() == codes.NotFound:\n\t\t\treturn nil, fmt.Errorf(\"no SSO provider returned from management. \" +\n\t\t\t\t\"Please proceed with setting up this device using setup keys \" +\n\t\t\t\t\"https://docs.netbird.io/how-to/register-machines-using-setup-keys\")\n\t\tcase ok && s.Code() == codes.Unimplemented:\n\t\t\treturn nil, fmt.Errorf(\"the management server, %s, does not support SSO providers, \"+\n\t\t\t\t\"please update your server or use Setup Keys to login\", config.ManagementURL)\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"getting device authorization flow info failed with error: %v\", err)\n\t\t}\n\t}\n\n\tif hint != \"\" {\n\t\tdeviceFlowInfo.SetLoginHint(hint)\n\t}\n\n\treturn deviceFlowInfo, nil\n}\n","sourceCodeStart":105,"sourceCodeEnd":136,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/internal/auth/oauth.go#L105-L136","documentation":"Returned by authenticateWithDeviceCodeFlow when the getDeviceFlow management RPC fails with gRPC code Unimplemented (client/internal/auth/oauth.go:122-124). The connected management server is too old to expose the SSO provider login API at all - the method does not exist on that build. The message names the management URL so the operator knows which server to upgrade.","triggerScenarios":"A recent client (which requests provider config during login) talks to a legacy self-hosted management that predates the getDeviceFlow/login-provider gRPC endpoint. Management returns Unimplemented and the client aborts interactive login with this message.","commonSituations":"Long-running self-hosted management pinned to an old version or image tag; client auto-updated while management did not; hybrid fleets where some nodes still point at an old server.","solutions":["Upgrade the self-hosted management service to a release matching or newer than the client, then retry netbird up","As an immediate workaround, register with a setup key: netbird up --setup-key <key>","After upgrading, verify the version handshake in netbird status"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil {\n\tif s, ok := gstatus.FromError(errors.Unwrap(err)); ok && s.Code() == codes.Unimplemented {\n\t\t// management predates SSO-provider RPCs: upgrade it or fall back to setup keys\n\t}\n}","preventionTips":["Pin management and client versions to compatible releases in deployment runbooks","Use setup-key enrollment during management upgrade windows","Check the management release notes for the SSO login API before enabling SSO flows"],"tags":["sso","management","version-mismatch","grpc","upgrade"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}