{"record":{"id":"d6687547f18375c1","repo":"RocketChat/Rocket.Chat","slug":"saml-provider-not-loaded-due-to-invalid-configurat","errorCode":null,"errorMessage":"SAML Provider not loaded due to invalid configuration","messagePattern":"SAML Provider not loaded due to invalid configuration","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"apps/meteor/server/lib/saml/lib/settings.ts","lineNumber":147,"sourceCode":"\n\tif (!services) {\n\t\treturn SAMLUtils.setServiceProvidersList([]);\n\t}\n\n\tconst providers = (\n\t\tawait Promise.all(\n\t\t\tservices.map(async ([key, value]) => {\n\t\t\t\tif (value === true) {\n\t\t\t\t\tconst samlConfigs = getSamlConfigs(key);\n\n\t\t\t\t\tif (isValidConfiguration(key, samlConfigs)) {\n\t\t\t\t\t\tSAMLUtils.log({ msg: 'Loading SAML Provider', key });\n\t\t\t\t\t\tawait LoginServiceConfiguration.createOrUpdateService(serviceName, samlConfigs);\n\t\t\t\t\t\tvoid notifyOnLoginServiceConfigurationChangedByService(serviceName);\n\t\t\t\t\t\treturn configureSamlService(samlConfigs);\n\t\t\t\t\t}\n\n\t\t\t\t\tSAMLUtils.logger?.warn({ msg: 'SAML Provider not loaded due to invalid configuration', key });\n\t\t\t\t}\n\n\t\t\t\tconst service = await LoginServiceConfiguration.removeByService(serviceName);\n\t\t\t\tif (!service) {\n\t\t\t\t\treturn false;\n\t\t\t\t}\n\n\t\t\t\tvoid notifyOnLoginServiceConfigurationChanged({ _id: service._id }, 'removed');\n\n\t\t\t\treturn false;\n\t\t\t}),\n\t\t)\n\t).filter((e) => e) as IServiceProviderOptions[];\n\n\tSAMLUtils.setServiceProvidersList(providers);\n};\n\nexport const addSamlService = function (name: string): void {","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/saml/lib/settings.ts#L129-L165","documentation":"At startup or when SAML settings change, each enabled provider entry (value === true) is validated with isValidConfiguration (required fields present, e.g. entry point/certificate). When validation fails, the provider is not loaded, its login service configuration is removed, and this warning names the offending provider key — users of that provider cannot log in until it is fixed.","triggerScenarios":"A Custom SAML provider flag is true but its config is incomplete — blank Entry Point (SSO URL), missing IdP certificate, or a malformed provider entry — so isValidConfiguration(key, configs) returns false during the settings watch.","commonSituations":"Half-finished provider setup saved with enable=true; certificate pasted incorrectly or into the wrong field; provider removed from settings but flag left true; migrations between servers dropping parts of the config.","solutions":["Open Administration > SAML Enterprise, find the provider matching the warned key, and complete all required fields (Entry Point, IdP certificate, etc.)","Verify the enable flag is boolean true and the config fields are non-empty strings","Disable or delete the half-configured provider so it stops failing validation on every restart","After fixing, confirm logs show 'Loading SAML Provider' and the metadata endpoint /_saml/metadata/<key> responds"],"exampleFix":"// before\nCustom_SAML_test-sp: true\ncustomEntryPoint: '' // blank\n\n// after\nCustom_SAML_test-sp: true\ncustomEntryPoint: 'https://idp.example.com/saml/sso'","handlingStrategy":"validation","validationCode":"const requiredFields = ['customEntryPoint' /* provider name, cert, etc. per isValidConfiguration */] as const;\n\nconst validateProviderConfig = (configs: Record<string, unknown>): boolean =>\n  requiredFields.every((field) => typeof configs[field] === 'string' && (configs[field] as string).trim().length > 0);\n\nif (!validateProviderConfig(samlConfigs)) {\n  throw new Error(`SAML provider \"${key}\" incomplete — fill Entry Point and certificate before enabling`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Complete all required SAML fields before flipping the provider's enable flag to true","Never save half-configured providers; disable them until finished","After each change, confirm the log shows 'Loading SAML Provider' and the metadata URL responds"],"tags":["saml","sso","configuration","startup","provider"],"backgroundTag":"saml-provider-misconfigured","analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}