What causes "External JWT auth is not open source" in windmill-labs/windmill?

Run Windmill Enterprise Edition (enterprise feature build) where jwt_ext_auth is implemented

External JWT auth is not open source

Error message

External JWT auth is not open source

What it means

jwt_ext_auth is the open-source (CE) stub for external JWT/JWKS authentication in windmill-api-auth. The real implementation lives behind the enterprise feature flag; in the OSS build the function unconditionally returns 'External JWT auth is not open source'. It is thrown whenever the code path for external JWT token validation is invoked without an enterprise build.

Source

Thrown at backend/windmill-api-auth/src/ee_oss.rs:24

 * LICENSE-AGPL for a copy of the license.
 */

#[cfg(feature = "private")]
#[allow(unused)]
pub use crate::ee::*;

#[cfg(all(feature = "enterprise", not(feature = "private")))]
use {std::sync::Arc, tokio::sync::RwLock};

#[cfg(all(feature = "enterprise", not(feature = "private")))]
pub async fn jwt_ext_auth(
    _w_id: Option<&String>,
    _token: &str,
    _external_jwks: Option<Arc<RwLock<ExternalJwks>>>,
    _db: &windmill_common::DB,
) -> anyhow::Result<(crate::ApiAuthed, usize, Option<uuid::Uuid>)> {
    // Implementation is not open source
    Err(anyhow::anyhow!("External JWT auth is not open source"))
}

#[cfg(all(feature = "enterprise", not(feature = "private")))]
pub struct ExternalJwks;

#[cfg(all(feature = "enterprise", not(feature = "private")))]
impl ExternalJwks {
    pub async fn load() -> Option<Arc<RwLock<Self>>> {
        // Implementation is not open source
        None
    }
}

View on GitHub (pinned to e474e8803c)

Solutions

Run Windmill Enterprise Edition (enterprise feature build) where jwt_ext_auth is implemented
Remove the external JWT auth configuration and use built-in token/OAuth auth instead
Use a generic OIDC/OAuth identity-provider integration available in CE

Defensive patterns

Strategy: try-catch

Validate before calling

// check build capability before configuring external JWT
if !cfg!(feature = "enterprise") {
    panic!("external JWT auth requires Windmill EE");
}

Try / catch

match jwt_ext_auth(...).await {
    Ok(authed) => authed,
    Err(e) if e.to_string().contains("not open source") => {
        return Err(Status::unimplemented("external JWT auth requires Windmill EE"));
    }
    Err(e) => return Err(Status::internal(format!("{e:#}"))),
}

Prevention

Only configure external_jwks in instance settings on EE builds
Detect CE vs EE at startup and refuse EE-only auth configs early
Keep fallback token auth enabled

When it happens

Trigger: Configuring an instance to authenticate API tokens via an external JWT issuer (external_jwks) on a community-edition Windmill build; any call to token auth routing that dispatches to jwt_ext_auth in a non-enterprise binary.

Common situations: Operator sets up an external OIDC/JWT identity provider for token validation but runs the CE image instead of Windmill EE; self-hosted user copies an EE-only auth config into a CE deployment.

Related errors

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/2f0d082c68ef8c75. Report an issue: GitHub.