What causes "Not implemented in Windmill's Open Source repository" in windmill-labs/windmill?

Use Windmill's Enterprise Edition build/image, which contains the private implementation of get_private_key.

Not implemented in Windmill's Open Source repository

Error message

Not implemented in Windmill's Open Source repository

What it means

`get_private_key` in windmill-common's oidc_oss.rs is a compile-time stub: when the crate is built with the `enterprise`/`openidconnect` features but WITHOUT the `private` feature (i.e. the public OSS build), the function unconditionally returns this error. It signals that the OIDC private-key logic lives in Windmill's closed-source enterprise code and can never succeed in this build.

Source

Thrown at backend/windmill-common/src/oidc_oss.rs:93

pub async fn generate_id_token<T: AdditionalClaims>(
    _db: Option<&DB>,
    _claim: T,
    _audience: &str,
    _identifier: String,
    _email: Option<String>,
) -> Result<WindmillIdToken> {
    Err(Error::internal_err(
        "Not implemented in Windmill's Open Source repository".to_string(),
    ))
}

#[cfg(all(
    feature = "enterprise",
    feature = "openidconnect",
    not(feature = "private")
))]
pub async fn get_private_key(_db: Option<&DB>) -> anyhow::Result<String> {
    Err(anyhow::anyhow!(
        "Not implemented in Windmill's Open Source repository"
    ))
}

View on GitHub (pinned to e474e8803c)

Solutions

Use Windmill's Enterprise Edition build/image, which contains the private implementation of get_private_key.
Remove or disable the OIDC SSO configuration in instance settings that requires the private key on an OSS deployment.
If you control the build, compile with the `private` feature to link the EE implementation.
Provide the key through an alternative supported mechanism (e.g. env-based config) if available for your auth flow.

Example fix

// before (OSS build)
let key = windmill_common::oidc_oss::get_private_key(Some(&db)).await?;
// after: guard with feature/config check or use EE image
#[cfg(feature = "private")]
let key = windmill_common::oidc_oss::get_private_key(Some(&db)).await?;

Defensive patterns

Strategy: try-catch

Validate before calling

if cfg!(not(feature = "private")) {
    anyhow::bail!("OIDC private key requires the Enterprise build");
}

Try / catch

match windmill_common::oidc_oss::get_private_key(Some(&db)).await {
    Ok(key) => use_key(&key),
    Err(e) if e.to_string().contains("Open Source") => fallback_to_non_oidc_auth(),
    Err(e) => return Err(e),
}

Prevention

Check whether the deployed image is EE before enabling OIDC/SSO features.
Gate enterprise-only code paths behind the `private` cargo feature.
Surface a clear config error at startup when OSS build + OIDC config is detected.

When it happens

Trigger: Any call to `windmill_common::oidc_oss::get_private_key(db)` on a public (OSS) Windmill build, e.g. code paths that need the OIDC client private key for token signing/decryption.

Common situations: Deploying the open-source Windmill image (GHCR windmill) while configuring enterprise-only OIDC/SSO features; custom backend code calling this helper expecting the EE implementation; mixing OSS backend with EE-only auth settings.

Related errors

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/5a6b47e5831e7679. Report an issue: GitHub.