netbirdio/netbird · error

sso login failed: %v

Error message

sso login failed: %v

What it means

Fires when handleSSOLogin fails after Login returned NeedsSSOLogin=true. That helper (client/cmd/login.go) drives the browser-based OIDC flow: it requests a verification URI from the daemon, opens/prints it, and waits for the daemon to confirm token exchange. Any failure in that exchange — user cancels, timeout, management IdP misconfiguration, or daemon callback error — is wrapped with 'sso login failed'.

Source

Thrown at client/cmd/up.go:387

			s.Code() == codes.PermissionDenied ||
			s.Code() == codes.NotFound ||
			s.Code() == codes.Unimplemented) {
			loginErr = backOffErr
			return nil
		}
		return backOffErr
	})
	if err != nil {
		return fmt.Errorf("login backoff cycle failed: %v", err)
	}

	if loginErr != nil {
		return daemonCallError("login failed", loginErr)
	}

	if loginResp.NeedsSSOLogin {
		if err := handleSSOLogin(ctx, cmd, loginResp, client, pm); err != nil {
			return fmt.Errorf("sso login failed: %v", err)
		}
	}

	if _, err := client.Up(ctx, &proto.UpRequest{
		ProfileName: &profileID,
		Username:    &username,
	}); err != nil {
		return daemonCallError("call service up method", err)
	}

	return nil
}

func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, profileName, username string) *proto.SetConfigRequest {
	var req proto.SetConfigRequest
	req.ProfileName = profileName
	req.Username = username

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Re-run `netbird up` and complete the opened browser flow promptly
2. On headless machines, copy the printed verification URL into a browser on another device
3. Verify the IdP configuration on management (client id/secret, redirect URI, issuer)
4. For unattended machines, register with a setup key instead of SSO: `netbird up --setup-key <key>`

Example fix

# before
netbird up  # interactive SSO on a headless box
# after
netbird up --setup-key AAAAAAAA-BBBB-CCCC-DDDD-EEEEEEEEEEEE

if err := handleSSOLogin(...); err != nil {
	// fallback: register non-interactively with a setup key
	return runUpWithSetupKey(setupKey)
}

When it happens

Trigger: Interactive `netbird up` without a setup key where the IdP flow breaks: browser never completes authorization before timeout, IdP rejects the client, management's IDP configuration is wrong, or the CLI context is canceled while waiting.

Common situations: Self-hosted management with misconfigured OIDC provider/redirect URI, expired auth session, headless environments where the printed URL cannot be opened in time, or clock skew breaking the token exchange.

Related errors

• management client is not initialised
• private services cannot enable bearer auth (SSO): NetBird-on
• user group name cannot be empty
• waiting sso login failed with: %v
• interactive sso login failed: %v

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/a05d1c7b0fa2eab2. Report an issue: GitHub.