bytedance/deer-flow · warning · HTTPException

SSO authentication is not enabled

Error message

SSO authentication is not enabled

What it means

404 from GET /api/auth/oidc/{provider}/login (and the wider SSO surface): the app config's auth.oidc.enabled is false, so the Gateway intentionally hides the SSO endpoints — 404 rather than 403, so the feature's existence is not leaked. Nothing about the specific provider has been evaluated yet.

Source

Thrown at backend/app/gateway/routers/auth.py:669

async def oauth_login(
    request: Request,
    provider: str,
    next: str | None = None,  # noqa: A002 (shadowing built-in is intentional — this is the query param name)
    remember_me: bool = True,
):
    """Initiate OIDC login flow.

    Redirects to the OIDC provider's authorization URL with state, nonce,
    and PKCE parameters. The ``next`` query parameter specifies where to
    redirect after successful login (default: /workspace).
    """
    from deerflow.config.app_config import get_app_config

    app_config = get_app_config()
    oidc_config = app_config.auth.oidc

    if not oidc_config.enabled:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="SSO authentication is not enabled")

    if not _OIDC_PROVIDER_KEY_RE.match(provider):
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid provider ID")

    provider_config = oidc_config.providers.get(provider)
    if not provider_config:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=f"Unknown SSO provider: {provider}")

    # Validate `next` / open redirect prevention
    redirect_path = validate_next_param(next) or "/workspace"

    # Resolve redirect URI
    redirect_uri = _resolve_oidc_redirect_uri(request, provider, provider_config)

    # Generate state, nonce, PKCE
    state_value = generate_oidc_state()
    nonce_value = generate_nonce() if provider_config.nonce_enabled else None
    code_verifier = generate_code_verifier() if provider_config.pkce_enabled else None

View on GitHub (pinned to 1dd6ba1acb)

Solutions

1. Configure auth.oidc with enabled: true and at least one provider, then restart the Gateway
2. Verify the served config exposes SSO availability before rendering SSO login buttons
3. If SSO is intentionally off, remove client links to these endpoints

Example fix

# config.yaml — before
auth:
  oidc:
    enabled: false

# after
auth:
  oidc:
    enabled: true
    providers:
      keycloak:
        issuer_url: https://sso.example.com/realflows/main
        client_id: deerflow
        client_secret: <secret>

const cfg = await getPublicConfig();
if (!cfg.auth?.oidc?.enabled) hideSsoButtons();

try { await startOidcLogin(provider); } catch (e) { if (e.status === 404) { showMessage('SSO not enabled on this deployment'); return; } throw e; }

When it happens

Trigger: Hitting /api/auth/oidc/<provider>/login on any deployment where config.yaml lacks an enabled auth.oidc section or sets enabled: false; frontend SSO buttons rendered despite the flag.

Common situations: SSO not configured in config.yaml; OIDC section present but enabled left false after testing; frontend cached an SSO-enabled config.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unknown SSO provider: {provider}
• Your email could not be verified by the identity provider. P
• The identity provider did not provide an email address.
• Your email domain is not allowed. Please use an approved ema
• An account with this email already exists. Contact your admi

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/dba7be676d7fed2b. Report an issue: GitHub.