{"record":{"id":"dba7be676d7fed2b","repo":"bytedance/deer-flow","slug":"sso-authentication-is-not-enabled","errorCode":null,"errorMessage":"SSO authentication is not enabled","messagePattern":"SSO authentication is not enabled","errorType":"http","errorClass":"HTTPException","httpStatus":404,"severity":"warning","filePath":"backend/app/gateway/routers/auth.py","lineNumber":669,"sourceCode":"async def oauth_login(\n    request: Request,\n    provider: str,\n    next: str | None = None,  # noqa: A002 (shadowing built-in is intentional — this is the query param name)\n    remember_me: bool = True,\n):\n    \"\"\"Initiate OIDC login flow.\n\n    Redirects to the OIDC provider's authorization URL with state, nonce,\n    and PKCE parameters. The ``next`` query parameter specifies where to\n    redirect after successful login (default: /workspace).\n    \"\"\"\n    from deerflow.config.app_config import get_app_config\n\n    app_config = get_app_config()\n    oidc_config = app_config.auth.oidc\n\n    if not oidc_config.enabled:\n        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=\"SSO authentication is not enabled\")\n\n    if not _OIDC_PROVIDER_KEY_RE.match(provider):\n        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=\"Invalid provider ID\")\n\n    provider_config = oidc_config.providers.get(provider)\n    if not provider_config:\n        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=f\"Unknown SSO provider: {provider}\")\n\n    # Validate `next` / open redirect prevention\n    redirect_path = validate_next_param(next) or \"/workspace\"\n\n    # Resolve redirect URI\n    redirect_uri = _resolve_oidc_redirect_uri(request, provider, provider_config)\n\n    # Generate state, nonce, PKCE\n    state_value = generate_oidc_state()\n    nonce_value = generate_nonce() if provider_config.nonce_enabled else None\n    code_verifier = generate_code_verifier() if provider_config.pkce_enabled else None","sourceCodeStart":651,"sourceCodeEnd":687,"githubUrl":"https://github.com/bytedance/deer-flow/blob/1dd6ba1acb03700589994b0366c5d1c7d05e2eff/backend/app/gateway/routers/auth.py#L651-L687","documentation":"404 from GET /api/auth/oidc/{provider}/login (and the wider SSO surface): the app config's auth.oidc.enabled is false, so the Gateway intentionally hides the SSO endpoints — 404 rather than 403, so the feature's existence is not leaked. Nothing about the specific provider has been evaluated yet.","triggerScenarios":"Hitting /api/auth/oidc/<provider>/login on any deployment where config.yaml lacks an enabled auth.oidc section or sets enabled: false; frontend SSO buttons rendered despite the flag.","commonSituations":"SSO not configured in config.yaml; OIDC section present but enabled left false after testing; frontend cached an SSO-enabled config.","solutions":["Configure auth.oidc with enabled: true and at least one provider, then restart the Gateway","Verify the served config exposes SSO availability before rendering SSO login buttons","If SSO is intentionally off, remove client links to these endpoints"],"exampleFix":"# config.yaml — before\nauth:\n  oidc:\n    enabled: false\n\n# after\nauth:\n  oidc:\n    enabled: true\n    providers:\n      keycloak:\n        issuer_url: https://sso.example.com/realflows/main\n        client_id: deerflow\n        client_secret: <secret>","handlingStrategy":"validation","validationCode":"const cfg = await getPublicConfig();\nif (!cfg.auth?.oidc?.enabled) hideSsoButtons();","typeGuard":null,"tryCatchPattern":"try { await startOidcLogin(provider); } catch (e) { if (e.status === 404) { showMessage('SSO not enabled on this deployment'); return; } throw e; }","preventionTips":["Render SSO entry points only when the served config reports oidc.enabled","After toggling auth.oidc, restart the Gateway and re-fetch config before testing"],"tags":["auth","http-404","oidc","sso","config"],"backgroundTag":null,"analyzedSha":"1dd6ba1acb03700589994b0366c5d1c7d05e2eff","analyzedAt":"2026-08-14T21:20:34.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}