rancher/rancher · warning

SAML providers do not implement Authenticate User API

Error message

SAML providers do not implement Authenticate User API

What it means

SAML providers in Rancher deliberately do not implement the AuthenticateUser API (the direct, non-browser credential exchange used by e.g. local auth). SAML requires the browser-redirect protocol with the IdP, so Provider.AuthenticateUser always returns this error. It signals an unsupported operation, not a malfunction.

Source

Thrown at pkg/auth/providers/saml/saml_provider.go:111

func (s *Provider) TransformToAuthProvider(authConfig map[string]any) (map[string]any, error) {
	p := common.TransformToAuthProvider(authConfig)
	switch s.name {
	case PingName:
		p[publicclient.PingProviderFieldRedirectURL] = formSamlRedirectURLFromMap(authConfig, s.name)
	case ADFSName:
		p[publicclient.ADFSProviderFieldRedirectURL] = formSamlRedirectURLFromMap(authConfig, s.name)
	case KeyCloakName:
		p[publicclient.KeyCloakProviderFieldRedirectURL] = formSamlRedirectURLFromMap(authConfig, s.name)
	case OKTAName:
		p[publicclient.OKTAProviderFieldRedirectURL] = formSamlRedirectURLFromMap(authConfig, s.name)
	case ShibbolethName:
		p[publicclient.ShibbolethProviderFieldRedirectURL] = formSamlRedirectURLFromMap(authConfig, s.name)
	}
	return p, nil
}

func (s *Provider) AuthenticateUser(http.ResponseWriter, *http.Request, any) (apiv3.Principal, []apiv3.Principal, string, error) {
	return apiv3.Principal{}, nil, "", fmt.Errorf("SAML providers do not implement Authenticate User API")
}

// Logout guards against a regular logout when the system has SLO, i.e. LogoutAll forced.
func (s *Provider) Logout(w http.ResponseWriter, r *http.Request, token accessor.TokenAccessor) error {
	providerName := token.GetAuthProvider()

	logrus.Debugf("SAML [logout]: triggered by provider %s", providerName)

	provider, ok := SamlProviders[providerName]
	if !ok {
		return fmt.Errorf("SAML [logout]: Rancher provider resource `%v` not configured at all", providerName)
	}

	if provider.sloForced {
		return fmt.Errorf("SAML [logout]: Rancher provider resource `%v` configured for forced SLO, rejecting regular logout", providerName)
	}

	return nil

View on GitHub (pinned to 932558d4e6)

Solutions

1. Use the SAML login flow instead: POST the samlLogin action and follow the returned idpRedirectUrl through the IdP
2. For API access, log in via a provider that supports direct authentication (e.g. local) or use a pre-issued API token
3. Gate client-side: skip authenticateUser calls for the five SAML provider names

Example fix

// before
resp, err := client.Post("/v3-public/authProviders/ping/action/authenticateUser", body)

// after: use the redirect-based flow for SAML providers
resp, err := client.Post("/v3-public/authProviders/ping/action/samlLogin", samlLoginBody)
// then open resp.idpRedirectUrl in a browser/session-capable client

var samlProviders = map[string]bool{"ping": true, "adfs": true, "keycloak": true, "okta": true, "shibboleth": true}

func authenticateUser(providerName string, body io.Reader) (*http.Response, error) {
    if samlProviders[providerName] {
        return nil, fmt.Errorf("provider %s requires the browser-based samlLogin flow", providerName)
    }
    return client.Post(fmt.Sprintf("/v3-public/authProviders/%s/action/authenticateUser", providerName), body)
}

func supportsAuthenticateUser(providerName string) bool {
    switch providerName {
    case "ping", "adfs", "keycloak", "okta", "shibboleth":
        return false // SAML: browser redirect flow only
    }
    return true
}

When it happens

Trigger: POST to /v3-public/authProviders/<ping|adfs|keycloak|okta|shibboleth>/action/authenticateUser with credentials in the body; any client code that treats all auth providers as exposing the same authenticateUser interface and calls it against a SAML provider.

Common situations: Automation or CLI scripts written against local/ldap auth reused for SAML; UI code paths that fall back to direct authentication; API clients expecting a token from username/password regardless of provider type.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• error parsing relay state token: %w
• invalid token
• current time %s is before NotBefore %s
• current time %s is on or after NotOnOrAfter %s
• invalid credentials

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/6403c9dc26902605. Report an issue: GitHub.