we-promise/sure · warning

[OmniAuth] Skipping SAML provider '#{name}' - missing IdP co

Error message

[OmniAuth] Skipping SAML provider '#{name}' - missing IdP configuration

What it means

This warning is emitted at Rails boot inside the OmniAuth initializer. Providers are loaded via ProviderLoader.load_providers (auth.yml, ENV, or database records), and for every entry with strategy "saml" the initializer requires either settings[:idp_metadata_url] or settings[:idp_sso_url] (checked with both symbol and string keys). If both are blank, the SAML provider is not registered with OmniAuth (next), no /auth/:name routes are mounted, and the provider is not pushed to Rails.configuration.x.auth.sso_providers, so no SSO login button renders. It is a skip-with-warning, not an exception.

Source

Thrown at config/initializers/omniauth.rb:105

      provider :github,
               client_id,
               client_secret,
               {
                 name: name.to_sym,
                 scope: "user:email"
               }

      Rails.configuration.x.auth.sso_providers << cfg.merge(name: name)

    when "saml"
      settings = cfg[:settings] || {}

      # Require either metadata URL or manual SSO URL
      idp_metadata_url = settings[:idp_metadata_url].presence || settings["idp_metadata_url"].presence
      idp_sso_url = settings[:idp_sso_url].presence || settings["idp_sso_url"].presence

      unless idp_metadata_url.present? || idp_sso_url.present?
        Rails.logger.warn("[OmniAuth] Skipping SAML provider '#{name}' - missing IdP configuration")
        next
      end

      # Build SAML options
      saml_options = {
        name: name.to_sym,
        assertion_consumer_service_url: cfg[:redirect_uri].presence || "#{ENV['APP_URL']}/auth/#{name}/callback",
        issuer: cfg[:issuer].presence || ENV["APP_URL"],
        name_identifier_format: settings[:name_id_format].presence || settings["name_id_format"].presence ||
                               "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
        attribute_statements: {
          email: [ "email", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" ],
          first_name: [ "first_name", "givenName", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" ],
          last_name: [ "last_name", "surname", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" ],
          groups: [ "groups", "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups" ]
        }
      }

View on GitHub (pinned to e69894adb9)

Solutions

1. Add settings.idp_metadata_url (preferred, e.g. https://your-idp/metadata) or settings.idp_sso_url plus idp_certificate/idp_cert_fingerprint to the SAML provider entry in auth.yml or the provider record loaded by ProviderLoader
2. Verify YAML nesting: the IdP keys must live inside the settings: map of the provider entry, spelled exactly idp_metadata_url / idp_sso_url
3. Confirm where the provider is defined by checking ProviderLoader.load_providers (auth.yml vs ENV vs database providers) and fix it at that source
4. Restart the app and verify the warning is gone and the provider appears in Rails.configuration.x.auth.sso_providers

Example fix

# auth.yml - before
sso:
  my_saml:
    strategy: saml
    name: my_saml
    # no settings block -> provider skipped

# auth.yml - after
sso:
  my_saml:
    strategy: saml
    name: my_saml
    settings:
      idp_metadata_url: https://idp.example.com/saml/metadata
      name_id_format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

# Rails runner / boot-time check (lib/tasks or a rake task)
# Fail fast in non-dev environments when a SAML provider lacks IdP config
providers = ProviderLoader.load_providers
providers.select { |p| p["strategy"].to_s == "saml" }.each do |p|
  settings = p["settings"] || {}
  has_idp = settings["idp_metadata_url"].present? || settings["idp_sso_url"].present?
  abort("SAML provider '#{p['name']}' missing idp_metadata_url or idp_sso_url") if !has_idp && Rails.env.production?
end

When it happens

Trigger: A provider entry with strategy: "saml" whose settings hash is missing, empty, or contains neither idp_metadata_url nor idp_sso_url (config/initializers/omniauth.rb:97-107). Also triggered by typos such as sso_url instead of idp_sso_url, or by correct keys nested at the wrong YAML level (top level of the provider entry instead of under settings:).

Common situations: Copying an existing openid_connect or google_oauth2 block in auth.yml and switching strategy to saml without adding IdP settings; a SAML provider row created in the settings UI/database with the IdP fields left blank; YAML indentation putting the keys outside the settings map; expecting ENV variables to supply SAML settings when only the settings hash is read.

Related errors

• No SSO providers enabled; check auth.yml / ENV configuration
• [OmniAuth] Skipping OIDC provider '#{name}' - missing requir
• {result.error}
• {e.record.errors.full_messages.to_sentence.presence || e.mes
• invalid_certificate

AI-assisted analysis of we-promise/sure@e69894adb9 (2026-08-21). Data as JSON: /api/errors/cd5dd02057f91d6f. Report an issue: GitHub.