theonedev/onedev · error · UnauthorizedException

Not authorized

Error message

Not authorized

What it means

Administrator-only guard in SsoProviderResource.getSsoProvider: SSO provider configuration is sensitive, and the caller is not an administrator (SecurityUtils.isAdministrator() false), so UnauthorizedException is thrown before loading the provider. Fix: authenticate as a system administrator.

Source

Thrown at server-core/src/main/java/io/onedev/server/rest/resource/SsoProviderResource.java:47

@Path("/sso-providers")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@Singleton
public class SsoProviderResource {

	@Inject
	private SsoProviderService ssoProviderService;

	@Inject
	private AuditService auditService;
	
	@Api(order=100)
    @GET
	@Path("/{ssoProviderId}")
    public SsoProvider getSsoProvider(@PathParam("ssoProviderId") Long ssoProviderId) {
    	if (!SecurityUtils.isAdministrator()) 
			throw new UnauthorizedException();
    	return ssoProviderService.load(ssoProviderId);
    }	

	@Api(order=200)
    @GET
    public List<SsoProvider> listSsoProviders() {
    	if (!SecurityUtils.isAdministrator()) 
			throw new UnauthorizedException();
    	return ssoProviderService.query();
    }	

	@Api(order=250, description="Get SSO provider id by name")
	@Path("/ids/{name}")
	@GET
	public Long getSsoProviderId(@PathParam("name") String name) {
    	if (!SecurityUtils.isAdministrator()) 
			throw new UnauthorizedException();

View on GitHub (pinned to d44925c47c)

Solutions

1. Authenticate as a server administrator
2. Grant admin privileges if the integration legitimately requires them
3. Retrieve provider info from non-privileged endpoints if available

if (!isAdminAccount) skipSsoProviderApi();

try { const p = await api.getSsoProvider(id); } catch (e) { if (e.status === 401) throw new Error('Administrator privileges required'); }

When it happens

Trigger: Fetching SSO provider details via REST as a regular user.

Common situations: Non-admin automation inspecting SSO configuration; assuming SSO provider read access is available to all authenticated users.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Cannot set primary email address for externally authenticate
• Cannot delete primary email address of externally authentica
• No permission to add specified link for specified issues
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set own estimated time

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/4432c1b92cb99d85. Report an issue: GitHub.