bytedance/deer-flow · error · HTTPException

Unknown SSO provider: {provider}

Error message

Unknown SSO provider: {provider}

What it means

Raised by the SSO login-initiation endpoint (GET /api/auth/login/{provider} style route) in backend/app/gateway/routers/auth.py:676. The provider path segment passed the regex shape check (_OIDC_PROVIDER_KEY_RE) but no entry with that key exists under auth.oidc.providers in config.yaml. It is a 400 Bad Request, deliberately distinct from the shape-based 'Invalid provider ID'.

Source

Thrown at backend/app/gateway/routers/auth.py:676

    Redirects to the OIDC provider's authorization URL with state, nonce,
    and PKCE parameters. The ``next`` query parameter specifies where to
    redirect after successful login (default: /workspace).
    """
    from deerflow.config.app_config import get_app_config

    app_config = get_app_config()
    oidc_config = app_config.auth.oidc

    if not oidc_config.enabled:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="SSO authentication is not enabled")

    if not _OIDC_PROVIDER_KEY_RE.match(provider):
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid provider ID")

    provider_config = oidc_config.providers.get(provider)
    if not provider_config:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=f"Unknown SSO provider: {provider}")

    # Validate `next` / open redirect prevention
    redirect_path = validate_next_param(next) or "/workspace"

    # Resolve redirect URI
    redirect_uri = _resolve_oidc_redirect_uri(request, provider, provider_config)

    # Generate state, nonce, PKCE
    state_value = generate_oidc_state()
    nonce_value = generate_nonce() if provider_config.nonce_enabled else None
    code_verifier = generate_code_verifier() if provider_config.pkce_enabled else None
    code_challenge = compute_code_challenge(code_verifier) if code_verifier else None

    # Get provider metadata via discovery
    overrides = {
        "authorization_endpoint": provider_config.authorization_endpoint,
        "token_endpoint": provider_config.token_endpoint,
        "userinfo_endpoint": provider_config.userinfo_endpoint,

View on GitHub (pinned to 1dd6ba1acb)

Solutions

1. Compare the requested provider slug against the keys of auth.oidc.providers in config.yaml (top-level repo config) and fix the mismatch on whichever side is wrong
2. If the provider should exist, add a full entry under auth.oidc.providers with issuer, client_id, client_secret (and scopes) then restart the Gateway
3. If the provider was intentionally removed, update the frontend login UI / templates to stop emitting that provider link

Example fix

# config.yaml (before)
auth:
  oidc:
    enabled: true
    providers:
      google: {issuer: "https://accounts.google.com", ...}

# after — provider key now matches the requested slug 'okta'
auth:
  oidc:
    enabled: true
    providers:
      google: {issuer: "https://accounts.google.com", ...}
      okta: {issuer: "https://dev-123.okta.com", client_id: "...", client_secret: "...", scopes: ["openid","email","profile"]}

# Before redirecting the user, confirm the provider exists in the server's SSO config
KNOWN_SSO_PROVIDERS = {"google", "github"}  # keep in sync with auth.oidc.providers
if provider not in KNOWN_SSO_PROVIDERS:
    render_login_error(f"Unknown SSO provider: {provider}")
else:
    window.location = `/api/auth/sso/${provider}/login`

const isSsoProvider = (p: string): p is SsoProvider =>
  ["google", "github"].includes(p);

try { await ssoStart(provider) } catch (e) { if (e.status === 400 && /Unknown SSO provider/.test(e.detail)) showProviderConfigError(); else throw e; }

When it happens

Trigger: GET /api/auth/sso/{provider}/login (or equivalent start route) where provider is a syntactically valid key like 'okta' but auth.oidc.providers in config.yaml only defines 'google' and 'github'.

Common situations: Operator typo between the provider key configured in config.yaml and the one the frontend/login button requests; a provider entry removed from config but the frontend still links to it; stale browser bookmark to an old provider slug after a config rename.

Related errors

• SSO authentication is not enabled
• Your email could not be verified by the identity provider. P
• The identity provider did not provide an email address.
• Your email domain is not allowed. Please use an approved ema
• An account with this email already exists. Contact your admi

AI-assisted analysis of bytedance/deer-flow@1dd6ba1acb (2026-08-14). Data as JSON: /api/errors/76021b4bc3783782. Report an issue: GitHub.