the management server, %s, does not support SSO providers, p

Error message

the management server, %s, does not support SSO providers, please update your server or use Setup Keys to login

What it means

Returned by authenticateWithDeviceCodeFlow when the getDeviceFlow management RPC fails with gRPC code Unimplemented (client/internal/auth/oauth.go:122-124). The connected management server is too old to expose the SSO provider login API at all - the method does not exist on that build. The message names the management URL so the operator knows which server to upgrade.

Source

Thrown at client/internal/auth/oauth.go:123

}

// authenticateWithDeviceCodeFlow initializes the Device Code auth Flow
func authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {
	authClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)
	if err != nil {
		return nil, fmt.Errorf("failed to create auth client: %v", err)
	}
	defer authClient.Close()

	deviceFlowInfo, err := authClient.getDeviceFlow(authClient.client)
	if err != nil {
		switch s, ok := gstatus.FromError(err); {
		case ok && s.Code() == codes.NotFound:
			return nil, fmt.Errorf("no SSO provider returned from management. " +
				"Please proceed with setting up this device using setup keys " +
				"https://docs.netbird.io/how-to/register-machines-using-setup-keys")
		case ok && s.Code() == codes.Unimplemented:
			return nil, fmt.Errorf("the management server, %s, does not support SSO providers, "+
				"please update your server or use Setup Keys to login", config.ManagementURL)
		default:
			return nil, fmt.Errorf("getting device authorization flow info failed with error: %v", err)
		}
	}

	if hint != "" {
		deviceFlowInfo.SetLoginHint(hint)
	}

	return deviceFlowInfo, nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

Upgrade the self-hosted management service to a release matching or newer than the client, then retry netbird up
As an immediate workaround, register with a setup key: netbird up --setup-key <key>
After upgrading, verify the version handshake in netbird status

Defensive patterns

Strategy: fallback

Try / catch

if err != nil {
	if s, ok := gstatus.FromError(errors.Unwrap(err)); ok && s.Code() == codes.Unimplemented {
		// management predates SSO-provider RPCs: upgrade it or fall back to setup keys
	}
}

Prevention

Pin management and client versions to compatible releases in deployment runbooks
Use setup-key enrollment during management upgrade windows
Check the management release notes for the SSO login API before enabling SSO flows

When it happens

Trigger: A recent client (which requests provider config during login) talks to a legacy self-hosted management that predates the getDeviceFlow/login-provider gRPC endpoint. Management returns Unimplemented and the client aborts interactive login with this message.

Common situations: Long-running self-hosted management pinned to an old version or image tag; client auto-updated while management did not; hybrid fleets where some nodes still point at an old server.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/bf4697f210f1c846. Report an issue: GitHub.