gotify/server · error

local authentication is disabled

Error message

local authentication is disabled

What it means

SessionAPI.Login returns 403 'local authentication is disabled' when the handler runs with a.LocalAuthEnabled == false. The deployment has turned off local username/password (basic-auth) login — typically because only SSO/OIDC login is allowed — so any attempt to log in via the local /login endpoint is rejected before credentials are even read. This is a deliberate policy refusal, not an authentication failure.

Source

Thrown at api/session.go:63

//	  200:
//	    description: Ok
//	    schema:
//	        $ref: "#/definitions/CurrentUser"
//	    headers:
//	      Set-Cookie:
//	        type: string
//	        description: session cookie
//	  401:
//	    description: Unauthorized
//	    schema:
//	        $ref: "#/definitions/Error"
//	  403:
//	    description: Forbidden
//	    schema:
//	        $ref: "#/definitions/Error"
func (a *SessionAPI) Login(ctx *gin.Context) {
	if !a.LocalAuthEnabled {
		ctx.AbortWithError(403, errors.New("local authentication is disabled"))
		return
	}

	name, pass, ok := ctx.Request.BasicAuth()
	if !ok {
		ctx.AbortWithError(401, errors.New("basic auth required"))
		return
	}

	user, err := a.DB.GetUserByName(name)
	if err != nil {
		ctx.AbortWithError(500, err)
		return
	}
	if user == nil || !password.ComparePassword(user.Pass, []byte(pass)) {
		ctx.AbortWithError(401, errors.New("invalid credentials"))
		return
	}

View on GitHub (pinned to 14bfc25627)

Solutions

1. Authenticate via the configured SSO/OIDC provider instead of local basic auth
2. If local login is intended, enable it in the server configuration (set local-auth enabled / LocalAuthEnabled=true) and restart
3. Update scripts and CI to use the SSO flow or an API token instead of local credentials
4. Check deployment docs/changelog for when local auth was disabled

Example fix

// before (client)
curl -u user:pass https://host/api/session
// after (client) — use the SSO flow/token instead
curl -H "Authorization: Bearer $SSO_ACCESS_TOKEN" https://host/api/session

// probe whether local auth is usable before sending credentials
conf := fetchServerConfig(baseURL) // e.g. /api/config or OIDC discovery
if !conf.LocalAuthEnabled {
    return startSSOLoginFlow(conf.OIDCIssuer)
}

if resp.StatusCode == 403 && strings.Contains(body, "local authentication is disabled") {
    return fallbackToSSOLogin() // redirect user to the OIDC/SSO provider
}

When it happens

Trigger: POST /api/session (or /login) with Basic Auth credentials while the server was started with local authentication disabled (e.g. LocalAuthEnabled=false in config).

Common situations: Deployments configured with SSO-only auth where users still try curl -u or basic auth to obtain a session token; CI scripts using old local credentials after the org switched to SSO; config flag flipped during an upgrade; API docs/examples not updated after disabling local auth.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• basic auth required
• cannot delete internal application
• file with key 'file' must be present
• invalid file extension
• user does not exist and auto-registration is disabled

AI-assisted analysis of gotify/server@14bfc25627 (2026-09-05). Data as JSON: /api/errors/337b42bb0b0035f7. Report an issue: GitHub.