No SSO providers enabled; check auth.yml / ENV configuration

Error message

No SSO providers enabled; check auth.yml / ENV configuration or database providers

What it means

Logged at the end of the OmniAuth builder block after every loaded provider has been processed. Rails.configuration.x.auth.sso_providers starts as an empty array and only gains entries when a provider is fully registered (openid_connect with valid options, google_oauth2/github with client credentials, saml with IdP settings). If it is still empty, no SSO strategy was mounted and the app falls back to password-only authentication.

Source

Thrown at config/initializers/omniauth.rb:144

        saml_options[:idp_metadata_url] = idp_metadata_url
      else
        saml_options[:idp_sso_service_url] = idp_sso_url
        saml_options[:idp_cert] = settings[:idp_certificate].presence || settings["idp_certificate"].presence
        saml_options[:idp_cert_fingerprint] = settings[:idp_cert_fingerprint].presence || settings["idp_cert_fingerprint"].presence
      end

      # Optional: IdP SLO (Single Logout) URL
      idp_slo_url = settings[:idp_slo_url].presence || settings["idp_slo_url"].presence
      saml_options[:idp_slo_service_url] = idp_slo_url if idp_slo_url.present?

      provider :saml, saml_options

      Rails.configuration.x.auth.sso_providers << cfg.merge(name: name, strategy: "saml")
    end
  end

  if Rails.configuration.x.auth.sso_providers.empty?
    Rails.logger.warn("No SSO providers enabled; check auth.yml / ENV configuration or database providers")
  end
end

View on GitHub (pinned to e69894adb9)

Solutions

Scan the same boot log for the per-provider skip warnings that precede this line (e.g. "Skipping SAML provider ... missing IdP configuration") and fix each indicated provider first
Ensure at least one provider is complete: copy .env/auth.yml example values and fill client_id/client_secret or SAML/OIDC settings
Verify ProviderLoader.load_providers is reading the source you think (auth.yml present in config/, ENV set, or provider rows in the database) and that the provider records are not disabled/blank
Restart and confirm sso_providers is populated (e.g. from a rails runner) if SSO is required

Example fix

# .env.local - before
# no SSO variables set

# .env.local - after
GOOGLE_OAUTH_CLIENT_ID=xxx.apps.googleusercontent.com
GOOGLE_OAUTH_CLIENT_SECRET=yyy

Defensive patterns

Strategy: validation

Validate before calling

# Boot-time assertion: SSO expected but nothing registered
if Rails.env.production? && ENV["REQUIRE_SSO"] == "1" && Rails.configuration.x.auth.sso_providers.empty?
  raise "No SSO providers enabled - check auth.yml / ENV / database providers"
end

Prevention

Grep boot logs for all 'Skipping ... provider' warnings together, since each skip contributes to the empty list
Codify required SSO providers in CI (e.g. a rake check against sso_providers) for deployments where SSO is mandatory
When SSO is intentionally disabled, document that this warning is expected to reduce alert noise

When it happens

Trigger: ProviderLoader.load_providers returns an empty list (no auth.yml, no ENV provider variables, empty database providers); or every candidate provider was skipped by its own guard in the same loop — OIDC with missing required options (line 44), google_oauth2/github missing client_id/client_secret, SAML missing IdP config (line 105).

Common situations: Fresh deployment where auth.yml was never copied from the example; docker/compose environment not passing the SSO ENV variables; all providers skipped because of individual config gaps (each skip logs its own warning earlier in boot, e.g. index 440); self-hosting users who intend password login only and can ignore this.

Related errors

AI-assisted analysis of we-promise/sure@e69894adb9 (2026-08-21). Data as JSON: /api/errors/50d89c1bbed96134. Report an issue: GitHub.