dromara/Sa-Token · error · SaOAuth2Exception

30141

30141

Error message

系统暂未开放此授权模式

What it means

Thrown by throwErrorSystemNotEnableModel() when a requested authorization mode is disabled globally. The server config (SaOAuth2ServerConfig) has per-mode switches (enableAuthorizationCode, enableImplicit, enablePassword, enableClientCredentials); when the relevant switch is false the request is rejected even if the client allows the mode. Error code 30141.

Source

Thrown at sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java:385

		else if(responseType.equals(ResponseType.token)) {
			if(!cfg.enableImplicit) {
				throwErrorSystemNotEnableModel();
			}
			if(!currClientModel().getAllowGrantTypes().contains(GrantType.implicit)) {
				throwErrorClientNotEnableModel();
			}
		}
		// 其它
		else {
			throw new SaOAuth2Exception("无效 response_type: " + responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
		}
	}

	/**
	 * 系统未开放此授权模式时抛出异常
	 */
	public void throwErrorSystemNotEnableModel() {
		throw new SaOAuth2Exception("系统暂未开放此授权模式").setCode(SaOAuth2ErrorCode.CODE_30141);
	}

	/**
	 * 应用未开放此授权模式时抛出异常
	 */
	public void throwErrorClientNotEnableModel() {
		throw new SaOAuth2Exception("应用暂未开放此授权模式").setCode(SaOAuth2ErrorCode.CODE_30142);
	}

}

View on GitHub (pinned to ac2c7f6e94)

Solutions

1. Enable the needed mode in the server config (e.g. sa-token.oauth2-server config: set is-password=true / is-implicit=true / is-client-credentials=true / is-code=true)
2. If the mode should stay off, switch the client to an enabled mode (usually authorization_code)
3. After config changes, restart the service and confirm the config was actually loaded (log the SaOAuth2ServerConfig)

Example fix

// before
saToken:
  oauth2-server:
    is-password: false

// after
saToken:
  oauth2-server:
    is-password: true
    is-implicit: true
    is-client-credentials: true

// startup assertion: fail fast if config and expected modes diverge
SaOAuth2ServerConfig c = SaOAuth2Manager.getServerConfig();
if(needPasswordGrant && !c.getEnablePassword()) {
    throw new IllegalStateException("oauth2 password mode required but disabled in config");
}

catch(SaOAuth2Exception e) { if("30141".equals(e.getCode())) return 403 "authorization mode disabled by server config"; }

When it happens

Trigger: Using implicit flow while isImplicit=false, password grant with isPassword=false, client-credentials with isClientCredentials=false, or authorization-code with isCode=false (or the newer enableClientCredentials-style flags) in the OAuth2 server config.

Common situations: New integration assumes all four OAuth2 modes are on by default; ops hardened a deployment by disabling unused modes and an old client then fails; upgrading sa-token versions where default flag values changed.

Related errors

• 30105
• 12002
• 10004
• UsernameAndPassword 不能为空
• 未配置全局 Http Digest 认证参数

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/cfc6b39f96691d81. Report an issue: GitHub.