{"record":{"id":"cd5dd02057f91d6f","repo":"we-promise/sure","slug":"omniauth-skipping-saml-provider-name-miss","errorCode":null,"errorMessage":"[OmniAuth] Skipping SAML provider '#{name}' - missing IdP configuration","messagePattern":"\\[OmniAuth\\] Skipping SAML provider '#(.+?)' - missing IdP configuration","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/initializers/omniauth.rb","lineNumber":105,"sourceCode":"      provider :github,\n               client_id,\n               client_secret,\n               {\n                 name: name.to_sym,\n                 scope: \"user:email\"\n               }\n\n      Rails.configuration.x.auth.sso_providers << cfg.merge(name: name)\n\n    when \"saml\"\n      settings = cfg[:settings] || {}\n\n      # Require either metadata URL or manual SSO URL\n      idp_metadata_url = settings[:idp_metadata_url].presence || settings[\"idp_metadata_url\"].presence\n      idp_sso_url = settings[:idp_sso_url].presence || settings[\"idp_sso_url\"].presence\n\n      unless idp_metadata_url.present? || idp_sso_url.present?\n        Rails.logger.warn(\"[OmniAuth] Skipping SAML provider '#{name}' - missing IdP configuration\")\n        next\n      end\n\n      # Build SAML options\n      saml_options = {\n        name: name.to_sym,\n        assertion_consumer_service_url: cfg[:redirect_uri].presence || \"#{ENV['APP_URL']}/auth/#{name}/callback\",\n        issuer: cfg[:issuer].presence || ENV[\"APP_URL\"],\n        name_identifier_format: settings[:name_id_format].presence || settings[\"name_id_format\"].presence ||\n                               \"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\",\n        attribute_statements: {\n          email: [ \"email\", \"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\" ],\n          first_name: [ \"first_name\", \"givenName\", \"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname\" ],\n          last_name: [ \"last_name\", \"surname\", \"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname\" ],\n          groups: [ \"groups\", \"http://schemas.microsoft.com/ws/2008/06/identity/claims/groups\" ]\n        }\n      }\n","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/we-promise/sure/blob/e69894adb92547273377398c15f45c979cd9416a/config/initializers/omniauth.rb#L87-L123","documentation":"This warning is emitted at Rails boot inside the OmniAuth initializer. Providers are loaded via ProviderLoader.load_providers (auth.yml, ENV, or database records), and for every entry with strategy \"saml\" the initializer requires either settings[:idp_metadata_url] or settings[:idp_sso_url] (checked with both symbol and string keys). If both are blank, the SAML provider is not registered with OmniAuth (next), no /auth/:name routes are mounted, and the provider is not pushed to Rails.configuration.x.auth.sso_providers, so no SSO login button renders. It is a skip-with-warning, not an exception.","triggerScenarios":"A provider entry with strategy: \"saml\" whose settings hash is missing, empty, or contains neither idp_metadata_url nor idp_sso_url (config/initializers/omniauth.rb:97-107). Also triggered by typos such as sso_url instead of idp_sso_url, or by correct keys nested at the wrong YAML level (top level of the provider entry instead of under settings:).","commonSituations":"Copying an existing openid_connect or google_oauth2 block in auth.yml and switching strategy to saml without adding IdP settings; a SAML provider row created in the settings UI/database with the IdP fields left blank; YAML indentation putting the keys outside the settings map; expecting ENV variables to supply SAML settings when only the settings hash is read.","solutions":["Add settings.idp_metadata_url (preferred, e.g. https://your-idp/metadata) or settings.idp_sso_url plus idp_certificate/idp_cert_fingerprint to the SAML provider entry in auth.yml or the provider record loaded by ProviderLoader","Verify YAML nesting: the IdP keys must live inside the settings: map of the provider entry, spelled exactly idp_metadata_url / idp_sso_url","Confirm where the provider is defined by checking ProviderLoader.load_providers (auth.yml vs ENV vs database providers) and fix it at that source","Restart the app and verify the warning is gone and the provider appears in Rails.configuration.x.auth.sso_providers"],"exampleFix":"# auth.yml - before\nsso:\n  my_saml:\n    strategy: saml\n    name: my_saml\n    # no settings block -> provider skipped\n\n# auth.yml - after\nsso:\n  my_saml:\n    strategy: saml\n    name: my_saml\n    settings:\n      idp_metadata_url: https://idp.example.com/saml/metadata\n      name_id_format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress","handlingStrategy":"validation","validationCode":"# Rails runner / boot-time check (lib/tasks or a rake task)\n# Fail fast in non-dev environments when a SAML provider lacks IdP config\nproviders = ProviderLoader.load_providers\nproviders.select { |p| p[\"strategy\"].to_s == \"saml\" }.each do |p|\n  settings = p[\"settings\"] || {}\n  has_idp = settings[\"idp_metadata_url\"].present? || settings[\"idp_sso_url\"].present?\n  abort(\"SAML provider '#{p['name']}' missing idp_metadata_url or idp_sso_url\") if !has_idp && Rails.env.production?\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep a fully-populated saml example block in auth.yml example files so copy-paste configs include idp_metadata_url","Validate provider settings at save time (settings UI / ProviderLoader) instead of only at boot","Add a post-deploy smoke check that Rails.configuration.x.auth.sso_providers includes every configured provider name"],"tags":["saml","omniauth","sso","configuration","initializer","auth-yml"],"backgroundTag":"sso-provider-misconfigured","analyzedSha":"e69894adb92547273377398c15f45c979cd9416a","analyzedAt":"2026-08-21T18:22:41.165Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}