{"record":{"id":"fa44cf68f899ce90","repo":"Dokploy/dokploy","slug":"bad-request-fa44cf","errorCode":"BAD_REQUEST","errorMessage":"Forward-auth requires an OIDC provider — SAML is not supported.","messagePattern":"Forward-auth requires an OIDC provider — SAML is not supported\\.","errorType":"exception","errorClass":"TRPCError","httpStatus":400,"severity":"error","filePath":"packages/server/src/services/proprietary/forward-auth.ts","lineNumber":34,"sourceCode":"\tsetupForwardAuth,\n} from \"@dokploy/server/setup/forward-auth-setup\";\nimport { manageDomain } from \"@dokploy/server/utils/traefik/domain\";\nimport {\n\tmanageForwardAuthDomain,\n\tremoveForwardAuthDomain,\n\tremoveForwardAuthMiddleware,\n} from \"@dokploy/server/utils/traefik/forward-auth\";\nimport { TRPCError } from \"@trpc/server\";\nimport { and, asc, desc, eq, isNotNull, isNull } from \"drizzle-orm\";\nimport { findApplicationById } from \"../application\";\nimport { findDomainById, updateDomainById } from \"../domain\";\n\nconst resolveOidcConfig = (provider: {\n\tissuer: string;\n\toidcConfig: string | null;\n}): ForwardAuthOidcConfig => {\n\tif (!provider.oidcConfig) {\n\t\tthrow new TRPCError({\n\t\t\tcode: \"BAD_REQUEST\",\n\t\t\tmessage:\n\t\t\t\t\"Forward-auth requires an OIDC provider — SAML is not supported.\",\n\t\t});\n\t}\n\n\tlet parsed: any;\n\ttry {\n\t\tparsed = JSON.parse(provider.oidcConfig);\n\t} catch {\n\t\tthrow new TRPCError({\n\t\t\tcode: \"INTERNAL_SERVER_ERROR\",\n\t\t\tmessage: \"Failed to parse the SSO provider OIDC configuration\",\n\t\t});\n\t}\n\n\tif (!parsed?.clientId || !parsed?.clientSecret) {\n\t\tthrow new TRPCError({","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/packages/server/src/services/proprietary/forward-auth.ts#L16-L52","documentation":"Forward-auth SSO in this platform is implemented on top of OpenID Connect (OIDC); resolveOidcConfig requires the SSO provider to have a non-null oidcConfig field. If the provider record only carries SAML configuration (oidcConfig is null), the request is rejected with BAD_REQUEST because SAML cannot be used for forward-auth.","triggerScenarios":"Calling the forward-auth oidc resolver (e.g. deploying/enabling forward-auth) when the organization's SSO provider was created as a SAML provider with no oidcConfig stored in the database.","commonSituations":"Org configured SAML SSO and then tries to use SSO forward-auth on a domain; provider row created with providerType SAML so oidcConfig column is NULL; migrating from SAML to OIDC without updating the provider record.","solutions":["Re-create or update the SSO provider as an OIDC provider (issuer, clientId, clientSecret) so oidcConfig is populated","If SAML is a hard requirement, do not use SSO forward-auth — it is OIDC-only","Check the ssoProvider row (SELECT provider_id, oidc_config ...) to confirm oidc_config IS NULL is the cause"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const provider = await getProvider(providerId);\nif (!provider.oidcConfig) { /* block forward-auth UI with clear message: OIDC required */ }","typeGuard":null,"tryCatchPattern":"try { await oidc(provider) } catch (e) { if (e instanceof TRPCError && e.code === 'BAD_REQUEST') { /* prompt: switch provider to OIDC */ } }","preventionTips":["Check provider type before enabling forward-auth","Document that forward-auth is OIDC-only"],"tags":["sso","oidc","saml","forward-auth","trpc"],"backgroundTag":"sso-provider-misconfiguration","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}