{"record":{"id":"cfc6b39f96691d81","repo":"dromara/Sa-Token","slug":"30141","errorCode":"30141","errorMessage":"系统暂未开放此授权模式","messagePattern":"系统暂未开放此授权模式","errorType":"exception","errorClass":"SaOAuth2Exception","httpStatus":null,"severity":"error","filePath":"sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java","lineNumber":385,"sourceCode":"\t\telse if(responseType.equals(ResponseType.token)) {\n\t\t\tif(!cfg.enableImplicit) {\n\t\t\t\tthrowErrorSystemNotEnableModel();\n\t\t\t}\n\t\t\tif(!currClientModel().getAllowGrantTypes().contains(GrantType.implicit)) {\n\t\t\t\tthrowErrorClientNotEnableModel();\n\t\t\t}\n\t\t}\n\t\t// 其它\n\t\telse {\n\t\t\tthrow new SaOAuth2Exception(\"无效 response_type: \" + responseType).setCode(SaOAuth2ErrorCode.CODE_30125);\n\t\t}\n\t}\n\n\t/**\n\t * 系统未开放此授权模式时抛出异常\n\t */\n\tpublic void throwErrorSystemNotEnableModel() {\n\t\tthrow new SaOAuth2Exception(\"系统暂未开放此授权模式\").setCode(SaOAuth2ErrorCode.CODE_30141);\n\t}\n\n\t/**\n\t * 应用未开放此授权模式时抛出异常\n\t */\n\tpublic void throwErrorClientNotEnableModel() {\n\t\tthrow new SaOAuth2Exception(\"应用暂未开放此授权模式\").setCode(SaOAuth2ErrorCode.CODE_30142);\n\t}\n\n}\n","sourceCodeStart":367,"sourceCodeEnd":396,"githubUrl":"https://github.com/dromara/Sa-Token/blob/ac2c7f6e94a78573cf0bcb932dd8b04e68fad189/sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java#L367-L396","documentation":"Thrown by throwErrorSystemNotEnableModel() when a requested authorization mode is disabled globally. The server config (SaOAuth2ServerConfig) has per-mode switches (enableAuthorizationCode, enableImplicit, enablePassword, enableClientCredentials); when the relevant switch is false the request is rejected even if the client allows the mode. Error code 30141.","triggerScenarios":"Using implicit flow while isImplicit=false, password grant with isPassword=false, client-credentials with isClientCredentials=false, or authorization-code with isCode=false (or the newer enableClientCredentials-style flags) in the OAuth2 server config.","commonSituations":"New integration assumes all four OAuth2 modes are on by default; ops hardened a deployment by disabling unused modes and an old client then fails; upgrading sa-token versions where default flag values changed.","solutions":["Enable the needed mode in the server config (e.g. sa-token.oauth2-server config: set is-password=true / is-implicit=true / is-client-credentials=true / is-code=true)","If the mode should stay off, switch the client to an enabled mode (usually authorization_code)","After config changes, restart the service and confirm the config was actually loaded (log the SaOAuth2ServerConfig)"],"exampleFix":"// before\nsaToken:\n  oauth2-server:\n    is-password: false\n\n// after\nsaToken:\n  oauth2-server:\n    is-password: true\n    is-implicit: true\n    is-client-credentials: true","handlingStrategy":"validation","validationCode":"// startup assertion: fail fast if config and expected modes diverge\nSaOAuth2ServerConfig c = SaOAuth2Manager.getServerConfig();\nif(needPasswordGrant && !c.getEnablePassword()) {\n    throw new IllegalStateException(\"oauth2 password mode required but disabled in config\");\n}","typeGuard":null,"tryCatchPattern":"catch(SaOAuth2Exception e) { if(\"30141\".equals(e.getCode())) return 403 \"authorization mode disabled by server config\"; }","preventionTips":["Declare required OAuth2 modes per service in config review checklists","Log the effective SaOAuth2ServerConfig at startup to catch silent default flips after upgrades"],"tags":["oauth2","configuration","feature-flag","sa-token"],"backgroundTag":null,"analyzedSha":"ac2c7f6e94a78573cf0bcb932dd8b04e68fad189","analyzedAt":"2026-08-14T14:36:10.271Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}