{"record":{"id":"e4cf50fc35662301","repo":"usememos/memos","slug":"deployment-configuration-disables-password-authent","errorCode":null,"errorMessage":"deployment configuration disables password authentication for regular users but has no effective identity provider","messagePattern":"deployment configuration disables password authentication for regular users but has no effective identity provider","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"store/deployment_config.go","lineNumber":385,"sourceCode":"\tif configured := config.instanceSettings[storepb.InstanceSettingKey_GENERAL]; configured != nil {\n\t\tgeneral = cloneInstanceSetting(configured)\n\t}\n\tif general == nil || !general.GetGeneralSetting().DisallowPasswordAuth {\n\t\treturn nil\n\t}\n\tproviders, err := s.listStoredIdentityProviders(ctx, &FindIdentityProvider{})\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"failed to read stored identity providers\")\n\t}\n\teffectiveUIDs := map[string]struct{}{}\n\tfor _, provider := range providers {\n\t\teffectiveUIDs[provider.Uid] = struct{}{}\n\t}\n\tfor uid := range config.identityProviders {\n\t\teffectiveUIDs[uid] = struct{}{}\n\t}\n\tif len(effectiveUIDs) == 0 {\n\t\treturn errors.New(\"deployment configuration disables password authentication for regular users but has no effective identity provider\")\n\t}\n\treturn nil\n}\n\nfunc (s *Store) warnShadowedStoredIdentityProviders(ctx context.Context, config *deploymentConfiguration) error {\n\tif len(config.identityProviders) == 0 {\n\t\treturn nil\n\t}\n\tproviders, err := s.listStoredIdentityProviders(ctx, &FindIdentityProvider{})\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"failed to inspect stored identity providers\")\n\t}\n\tfor _, provider := range providers {\n\t\tif _, ok := config.identityProviders[provider.Uid]; ok {\n\t\t\tslog.Warn(\"deployment identity provider shadows a stored provider; the stored configuration remains in the database\", \"uid\", provider.Uid)\n\t\t}\n\t}\n\treturn nil","sourceCodeStart":367,"sourceCodeEnd":403,"githubUrl":"https://github.com/usememos/memos/blob/14d757ce1fb31c78590f374bc042f8dbedbc20d7/store/deployment_config.go#L367-L403","documentation":"A cross-file safety check (validateDeploymentAuthenticationState): the deployment configuration disables password authentication for regular users (via the GENERAL setting's disallowPasswordAuth-like option) but there is no effective identity provider — neither in the deployment files nor stored in the database. Accepting this config would lock every regular user out of sign-in, so LoadDeploymentConfiguration returns this error and the configuration is not published.","triggerScenarios":"The GENERAL instance-setting file disables password auth while no memos-idp-*.json file exists and no IdP was previously created through the admin API; or all IdP files were deleted in the same deployment that disables passwords.","commonSituations":"Hardening a deployment to SSO-only and forgetting to ship the IdP file; a typo'd IdP filename (not matching memos-idp-*.json) so the file is silently ignored while the GENERAL file still disables passwords.","solutions":["Ship a valid memos-idp-*.json file (in /etc/secrets) alongside the GENERAL setting that disables password auth.","Or keep password auth enabled until the IdP file is verified to load (check the 'loaded deployment configuration' log line counts identityProviders > 0).","Or pre-create the IdP through the admin UI/API so it is stored in the database before disabling passwords."],"exampleFix":"// before: only memos-instance-setting-general.json with password auth disabled, no idp file\n// after: also mount /etc/secrets/memos-idp-github.json\n{ \"uid\": \"github\", \"name\": \"GitHub\", \"type\": \"OAUTH2\",\n  \"config\": { \"oauth2Config\": { \"clientId\": \"...\", \"clientSecret\": \"...\", \"authUrl\": \"...\", \"tokenUrl\": \"...\", \"userInfoUrl\": \"...\", \"scopes\": [\"read:user\"], \"fieldMapping\": { \"identifier\": \"login\" } } } }","handlingStrategy":"validation","validationCode":"// Before disabling password auth in the GENERAL file, confirm an IdP exists\nidpCount := 0 // count memos-idp-*.json files matching ^memos-idp-[a-z0-9-]+\\.json$ in the config dir\nif idpCount == 0 {\n    return errors.New(\"refusing to disable password auth: no identity provider deployed or stored\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Deploy the IdP file first, confirm the 'loaded deployment configuration' log shows identityProviders >= 1, then disable password auth in a later rollout.","Keep a break-glass admin/host account that does not depend on SSO.","Remember filename rules: unrecognized memos-* files are ignored with only a warning."],"tags":["configuration","validation","authentication","lockout","startup"],"backgroundTag":null,"analyzedSha":"14d757ce1fb31c78590f374bc042f8dbedbc20d7","analyzedAt":"2026-08-15T09:27:36.538Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}