rancher/rancher · warning

Provider is disabled

Error message

Provider is disabled

What it means

The OIDC redirect handler checks the genericoidc config's `enabled` field; when it is explicitly false, the handler deliberately returns 404 "Provider is disabled" so that disabled providers look absent on the login path (matching the NotFound behavior for unknown providers). This is by design, not a crash.

Source

Thrown at pkg/auth/handler/handler.go:112

	if !ok {
		logrus.Errorf("[oidc] Invalid auth config format for provider %s: expected runtime.Unstructured", provider)
		http.Error(w, "Invalid auth config format", http.StatusInternalServerError)
		return
	}
	data := authConfigData.UnstructuredContent()
	logrus.Debugf("[oidc] Retrieved auth config for provider: %s", provider)

	// Validate that the provider is enabled
	if enabledRaw := data[client.GenericOIDCConfigFieldEnabled]; enabledRaw != nil {
		enabled, ok := enabledRaw.(bool)
		if !ok {
			logrus.Errorf("[oidc] Invalid enabled field type for provider %s: expected bool, got %T", provider, enabledRaw)
			http.Error(w, "Invalid provider configuration", http.StatusInternalServerError)
			return
		}
		if !enabled {
			logrus.Debugf("[oidc] Provider %s is disabled", provider)
			http.Error(w, "Provider is disabled", http.StatusNotFound)
			return
		}
	}

	// Validate PKCE method if configured
	var pkceVerifier string
	if pkceMethodRaw := data[client.GenericOIDCConfigFieldPKCEMethod]; pkceMethodRaw != nil {
		pkceMethod, ok := pkceMethodRaw.(string)
		if !ok {
			logrus.Errorf("[oidc] Invalid PKCE method type for provider %s: expected string, got %T", provider, pkceMethodRaw)
			http.Error(w, "Invalid PKCE method type", http.StatusInternalServerError)
			return
		}

		// Validate supported PKCE methods
		if pkceMethod != "" && pkceMethod != oidc.PKCES256Method {
			logrus.Warnf("[oidc] Unsupported PKCE method '%s' for provider %s", pkceMethod, provider)
			http.Error(w, "Unsupported PKCE method. Supported methods: S256", http.StatusBadRequest)

View on GitHub (pinned to 932558d4e6)

Solutions

1. If the provider should be usable, re-enable it: kubectl patch authconfig <provider> --type merge -p '{"genericOIDCConfig":{"enabled":true}}'
2. If it should stay disabled, update or remove the login entry points (UI links, bookmarks, IdP-initiated login configs) that still target it
3. Check the rancher log "[oidc] Provider <name> is disabled" to confirm the deliberate 404 path
4. Distinguish from a typo'd provider name: that yields the plain NotFound branch without this log line

Example fix

# before
genericOIDCConfig:
  enabled: false
# after (if the provider must accept logins)
genericOIDCConfig:
  enabled: true

// Before sending users to a provider's login URL, check it is enabled:
if cfg, err := getAuthConfig(provider); err == nil && !cfg.GenericOIDC.Enabled {
    return errors.New("provider " + provider + " is disabled; update login links")
}

On 404 "Provider is disabled", stop redirecting users to that provider — retrying is pointless until an admin re-enables it.

When it happens

Trigger: A request to the oidc redirect route for a provider whose AuthConfig has enabled: false — typically an admin disabled the provider but UI links, bookmarks, or downstream tooling still point at its login URL.

Common situations: Provider taken offline for maintenance or migration while old login URLs circulate; SSO cutover periods where one provider is disabled and another enabled; stale UI state after toggling a provider off in the UI.

Related errors

• Failed to get provider configuration
• Invalid provider configuration
• Invalid PKCE method type
• Unsupported PKCE method. Supported methods: S256
• can't find authprovider

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/b7b38322ab5d0eba. Report an issue: GitHub.