netbirdio/netbird · error

interactive sso login failed: %v

Error message

interactive sso login failed: %v

What it means

This wraps a failure of foregroundGetTokenInfo, the interactive SSO step of a session extend on Android. The flow drives a browser-based (or Android TV code-entry) OAuth exchange against the IdP via the URLOpener callbacks; any failure before a usable token is obtained — user cancellation, browser open failure, IdP or management connectivity loss, or the device-flow timing out — surfaces here.

Source

Thrown at client/android/session.go:302

	}
	engine := cc.Engine()
	if engine == nil {
		return fmt.Errorf("engine is not initialized")
	}

	authClient, err := auth.NewAuth(ctx, cfg.PrivateKey, cfg.ManagementURL, cfg)
	if err != nil {
		return fmt.Errorf("failed to create auth client: %v", err)
	}
	defer authClient.Close()

	// Passing the config path makes the flow pick up the login_hint: an extend
	// renews the session of the account already signed in, so it must not stop to
	// offer a choice.
	a := NewAuthWithConfig(ctx, cfg, cfgPath)
	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
	if err != nil {
		return fmt.Errorf("interactive sso login failed: %v", err)
	}

	if _, err := engine.ExtendAuthSession(ctx, tokenInfo.GetTokenToUse()); err != nil {
		return err
	}
	c.clearLoginRequired()

	go urlOpener.OnLoginSuccess()
	return nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Check the inner error string: 'canceled' means user abort (harmless, retry from UI), connectivity messages mean network/IdP reachability
2. Verify the IdP and management are both reachable from the device, then retry the extend — the flow is idempotent
3. On Android TV, ensure the user completes the code entry at the shown URL within the stated time window
4. If the browser never opens, check that urlOpener.OpenURL receives an https URL and a default handler exists (disable per-app browser restrictions)
5. Persistent failure with an IdP error code: review the IdP application configuration (client ID, redirect URI) in the management setup

Example fix

// before: single attempt surfaces as opaque 'interactive sso login failed'
return fmt.Errorf("interactive sso login failed: %v", err)

// after: keep the cause but distinguish user cancellation for the UI layer
if errors.Is(err, context.Canceled) {
    return err // let the UI show 'sign-in canceled' instead of an error
}
return fmt.Errorf("interactive sso login failed: %v", err)

// In the caller of extendAuthSession:
if err := c.extendAuthSession(ctx, opener, isTV); err != nil {
    if errors.Is(err, context.Canceled) || strings.Contains(err.Error(), "canceled") {
        notifyUser("Sign-in canceled") // not an error condition
        return nil
    }
    if strings.Contains(err.Error(), "interactive sso login failed") {
        notifyRetryable(err) // network/IdP issue; user can tap retry
        return nil
    }
    return err
}

When it happens

Trigger: urlOpener.OpenURL fails or the user closes the browser/tab without completing login; the IdP rejects the request (expired client registration, redirect mismatch, IdP outage); management connection drops between NewAuth and the token request; Android TV flow where the user never enters/finishes the verification code; flow deadline exceeded waiting for token polling.

Common situations: User dismisses the login prompt (cancel button on the expiry notification); default browser on a managed device blocks the custom redirect; IdP sign-in policy requires MFA the device cannot complete; captive/limited network where the IdP domain is blocked but management is reachable.

Related errors

• interactive sso login failed: %v
• interactive sso login failed: %v
• failed to check SSO support: %v
• login failed: %v
• failed to check login requirement: %v

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/8c78837519f7bd3e. Report an issue: GitHub.