rancher/rancher · error

SAML: failed to retrieve SamlConfig, error: %v

Error message

SAML: failed to retrieve SamlConfig, error: %v

What it means

getSamlConfigFromUnstructured fetches the provider's authconfig custom resource through the management API (UnstructuredClient().Get(name)). This error wraps that k8s Get failure: resource not found, API server unreachable, RBAC denial, or a missing/stale CRD. The SAML provider code reads its own config lazily, so this surfaces during operations that need the stored config.

Source

Thrown at pkg/auth/providers/saml/saml_provider.go:259

			"idpRedirectUrl": idpRedirectURL,
			"type":           "samlLoginOutput",
		}

		w.Header().Set("Content-Type", "application/json")
		if err := json.NewEncoder(w).Encode(data); err != nil {
			return fmt.Errorf("SAML: Failed to encode samlLoginOutput: %w", err)
		}

		return nil
	}

	return nil
}

func (s *Provider) getSamlConfigFromUnstructured() (*apiv3.SamlConfig, error) {
	authConfigObj, err := s.authConfigs.ObjectClient().UnstructuredClient().Get(s.name, metav1.GetOptions{})
	if err != nil {
		return nil, fmt.Errorf("SAML: failed to retrieve SamlConfig, error: %v", err)
	}

	u, ok := authConfigObj.(runtime.Unstructured)
	if !ok {
		return nil, fmt.Errorf("SAML: failed to retrieve SamlConfig, cannot read k8s Unstructured data")
	}
	storedSamlConfigMap := u.UnstructuredContent()

	storedSamlConfig := &apiv3.SamlConfig{}
	err = common.Decode(storedSamlConfigMap, storedSamlConfig)
	if err != nil {
		return nil, fmt.Errorf("unable to decode Saml Config: %w", err)
	}

	if enabled, ok := storedSamlConfigMap["enabled"].(bool); ok {
		storedSamlConfig.Enabled = enabled
	}

View on GitHub (pinned to 932558d4e6)

Solutions

1. Verify the resource exists: kubectl get <samlprovider> -A (e.g. kubectl get keycloak -A) and recreate/re-apply it if missing
2. Check API server health and Rancher's connectivity to the management cluster
3. Confirm RBAC for the Rancher service account on the authconfig resource
4. Reinstall/repair the management.cattle.io CRDs if the Get consistently fails with a 'no matches for kind' style error

// Pre-flight: confirm the authconfig resource exists before operating
_, err := dynamicClient.Resource(authConfigGVR).Namespace(ns).Get(ctx, providerName, metav1.GetOptions{})
if apierrors.IsNotFound(err) {
    return fmt.Errorf("authconfig %s/%s missing; (re)configure the provider", ns, providerName)
}

cfg, err := s.getSamlConfigFromUnstructured()
if err != nil {
    if apierrors.IsNotFound(errors.Unwrap(err)) || strings.Contains(err.Error(), "not found") {
        return retryWithBackoff(s.getSamlConfigFromUnstructured, 3) // transient during controller races
    }
    return err
}

When it happens

Trigger: The <provider> authconfig CR (e.g. keycloak, ping) does not exist or was deleted; the management cluster API is down or unreachable mid-request; the service account lacks RBAC on the authconfig resource; CRD missing after a botched upgrade.

Common situations: Authconfig manually deleted while the provider stayed registered; etcd/apiserver instability; Rancher upgraded or restored from backup without the management.cattle.io CRDs fully applied.

Related errors

• failed to retrieve OIDCConfig, error: %v
• getting GithubAppConfig, error: %v
• unable to update authconfig: %w
• error creating secret %s: %w
• failed to retrieve ActiveDirectoryConfig, error: %v

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/acfad0eb071f9e63. Report an issue: GitHub.