langfuse/langfuse · error · Error

Sign in with email and password is disabled for this domain.

Error message

Sign in with email and password is disabled for this domain. Please use SSO.

What it means

authorize() throws when the email's domain appears in the SSO blocked-domains list (getSSOBlockedDomains), forcing users of that domain to authenticate via SSO rather than password.

Source

Thrown at web/src/server/auth.ts:104

    credentials: {
      email: {
        label: "Email",
        type: "email",
        placeholder: "jsmith@example.com",
      },
      password: { label: "Password", type: "password" },
    },
    async authorize(credentials, _req) {
      if (!credentials) throw new Error("No credentials");
      if (env.AUTH_DISABLE_USERNAME_PASSWORD === "true")
        throw new Error(
          "Sign in with email and password is disabled for this instance. Please use SSO.",
        );

      const blockedDomains = getSSOBlockedDomains();
      const domain = credentials.email.split("@")[1]?.toLowerCase();
      if (domain && blockedDomains.includes(domain)) {
        throw new Error(
          "Sign in with email and password is disabled for this domain. Please use SSO.",
        );
      }

      // EE: Check custom SSO enforcement
      const multiTenantSsoProvider =
        await getSsoAuthProviderIdForDomain(domain);
      if (multiTenantSsoProvider) {
        throw new Error(ENTERPRISE_SSO_REQUIRED_MESSAGE);
      }

      const dbUser = await prisma.user.findUnique({
        where: {
          email: credentials.email.toLowerCase(),
        },
      });

      if (!dbUser) {

View on GitHub (pinned to 59d92c7cf3)

Solutions

1. Sign in with the SSO provider associated with your domain
2. If password login for the domain should be re-enabled, remove the domain from the blocked-domains configuration/env
3. Double-check for typos in the configured domain list that may over-block

const domain = email.split('@')[1]?.toLowerCase();
if (blockedDomains.includes(domain)) showSSONotice();

When it happens

Trigger: Signing in with email/password where the part after @ matches a domain configured for SSO enforcement (e.g. via AUTH_SSO_BLOCKED_DOMAINS env or org config).

Common situations: Company domains moved to SSO-only; a contractor with a corporate-domain email trying password login after the domain was blocked.

Related errors

• Sign in with email and password is disabled for this instanc
• No credentials
• ENTERPRISE_SSO_REQUIRED_MESSAGE
• Invalid credentials
• Please sign in with the identity provider (e.g. Google, GitH

AI-assisted analysis of langfuse/langfuse@59d92c7cf3 (2026-08-27). Data as JSON: /api/errors/0d762fda77b0eb1d. Report an issue: GitHub.