kubesphere/kubesphere · warning

the Identity provider was Disabled

Error message

the Identity provider was Disabled

What it means

IdentityProviderIsDisabled is a sentinel error returned by GetConfiguration when the matching identity provider configuration exists but has Disabled=true. It distinguishes 'configured but turned off' from ErrorIdentityProviderNotFound so callers can report a precise reason to users.

Source

Thrown at pkg/apiserver/authentication/identityprovider/configuration.go:40

const (
	MappingMethodManual MappingMethod = "manual"

	MappingMethodAuto MappingMethod = "auto"

	// MappingMethodLookup Looks up an existing identity, user identity mapping, and user, but does not automatically
	// provision users or identities. Using this method requires you to manually provision users.
	MappingMethodLookup MappingMethod = "lookup"

	ConfigTypeIdentityProvider = "identityprovider"
	SecretTypeIdentityProvider = "config.kubesphere.io/" + ConfigTypeIdentityProvider

	SecretDataKey = "configuration.yaml"
)

var ErrorIdentityProviderNotFound = errors.New("the Identity provider was not found")

var IdentityProviderIsDisabled = errors.New("the Identity provider was Disabled")

type MappingMethod string

type Configuration struct {
	// The provider name.
	Name string `json:"name" yaml:"name"`

	// Defines how new identities are mapped to users when they login. Allowed values are:
	//  - manual: The user needs to confirm the mapped username on the onboarding page.
	//  - auto: Skip the onboarding screen, so the user cannot change its username.
	//            Fails if a user with that username is already mapped to another identity.
	//  - lookup: Looks up an existing identity, user identity mapping, and user, but does not automatically
	//            provision users or identities. Using this method requires you to manually provision users.
	MappingMethod MappingMethod `json:"mappingMethod" yaml:"mappingMethod"`

	// The type of identity provider
	Type string `json:"type" yaml:"type"`

View on GitHub (pinned to 04a29b5c60)

Solutions

1. Re-enable the identity provider by setting disabled: false in its configuration.yaml inside the identity provider configuration
2. Ask the cluster administrator why the provider was disabled
3. Update client UIs/links so the disabled provider is not offered to users
4. Distinguish this case in code with errors.Is(IdentityProviderIsDisabled, err) and return a clear message like 'login method disabled'

Example fix

// before
cfg, err := getter.GetConfiguration(ctx, name)
if err != nil {
    return nil, err
}
// after
cfg, err := getter.GetConfiguration(ctx, name)
if err != nil {
    if errors.Is(identityprovider.IdentityProviderIsDisabled, err) {
        return nil, errors.New("this login method has been disabled by the administrator")
    }
    return nil, err
}

// Read the provider config and check the flag before login flows:
// if cfg.Disabled { skip offering this provider in the UI }

func isIdentityProviderDisabled(err error) bool {
    return errors.Is(err, identityprovider.IdentityProviderIsDisabled)
}

cfg, err := getter.GetConfiguration(ctx, name)
if err != nil {
    if isIdentityProviderDisabled(err) {
        return nil, errors.New("login method disabled by administrator")
    }
    return nil, err
}

When it happens

Trigger: GetConfiguration finds a config entry whose Name matches, but config.Disabled is true, returning `nil, IdentityProviderIsDisabled`.

Common situations: An administrator disabled the login method (e.g. during migration or incident response); a stale client/browser still offers the disabled provider button; provider disabled in the ConfigMap but webhook/URLs not updated.

Related errors

• the Identity provider was not found
• unable to setup identity provider: %v
• failed to validate member cluster configuration, err: %v
• hostcluster Jwt is not equal to member cluster jwt, please e
• invalid mapping method found %s

AI-assisted analysis of kubesphere/kubesphere@04a29b5c60 (2026-09-03). Data as JSON: /api/errors/3cf18bbb8c950d94. Report an issue: GitHub.