SOLFIND
Web Lens		Portal home
Home  |  New Lens  |  About
Web address:

SSO and Authentication Errors | Appsmith

https://docs.appsmith.com/help-and-support/troubleshooting-guide/sso-authentication-errors • 57 KB fetched
Open original page

SSO and Authentication Errors | Appsmith

Skip to main content

Ask AI Search
Ask Appsmith AI Submit message

Examples How do I install Appsmith using Docker? How do I connect to my local PostgreSQL database? How do I pass inputs from a widget to a query? How do I trigger multiple queries conditionally? How do I fix the error: This value does not evaluate to type Array<Object>?

Try Appsmith

* Get Started

* Introduction

* Build Your First App

* Self Hosting

* New Installation Guides

* Manage Installation

* Upgrade Installation Guides

* Concepts

* Connect Data

* Overview

* How-to Guides

* Reference

* Datasources

* Query Settings

* Concepts

* Build Apps

* Overview

* Quickstart

* How-to Guides

* Reference

* Widgets

* Accessibility

* Theme

* Sample Apps

* Write Code

* Overview

* How-to Guides

* Reference

* Global Objects

* Global Functions

* JS Libraries

* Fetch API

* Data Transformation

* JavaScript Settings

* Concepts

* Best Practices

* Manage Apps and Users

* Authentication

* Granular Access Control

* Versioning with Git

* Setup SCIM Provisioning

* Embed Appsmith

* Migrate Applications

* Audit Logs

* Branding

* External Client Portal

* Packages

* Overview

* Tutorial

* How-to Guides

* Reference

* Package Version Control

* GIT Apps with Packages Best Practices

* Code Packages

* UI Packages

* Workflows

* Overview

* Tutorial

* How-to Guides

* Reference

* Workflow Triggers

* Workflow Queries

* Workflow Functions

* Pass Parameters to Workflows

* Run History

* Troubleshooting

* Overview

* Self-hosting Errors

* MongoDB Startup Error Post Migration to Version 5

* Schema Mismatch Error

* Kubernetes Helm Chart 3.0.4 Upgrade Error

* Recover admin access when you don't know the admin email

* Backup and Restore Errors

* License and Activation Errors

* Verify connectivity to cs.appsmith.com

* SSO and Authentication Errors

* User Management and Permissions Errors

* SSL, Certificate, and Reverse Proxy Errors

* Email and SMTP Errors

* Performance and Resource Errors

* Monitoring and Audit Log Errors

* Upgrade and Migration Errors

* Application Errors

* Product

* FAQ

* Security

* Telemetry

* Support at Appsmith

* Privacy Policy

* Release Notes

* Contribute

© 2026 Appsmith, Inc.

*

* Troubleshooting

* Self-hosting Errors

* SSO and Authentication Errors
On this page
SSO and Authentication Errors

This page shows how to resolve common Single Sign-On (SSO) and authentication errors on self-hosted Appsmith instances using OIDC, SAML, or Google OAuth. SSO (OIDC and SAML) is available on the Enterprise Edition. For setup guides, see Authentication .

Locked out after misconfiguring or disconnecting SSO ​

Cause ​

When SSO is the only enabled login method and the provider is misconfigured, disabled, disconnected, or has an expired client secret, all users—including admins—can be unable to sign in because there is no working fallback to form login.

Solution ​

To regain admin access, re-enable form login and sign up with a new admin account:

* Re-enable form login on the running instance with appsmithctl enable-form-login , or toggle Form Login under Admin Settings → User Management if you still have admin access. See User Management .

* Ensure signup is not restricted (check APPSMITH_SIGNUP_DISABLED ).

* Follow Recover admin access when you don't know the admin email to add a new instance administrator.

* Once logged in, open Admin Settings to reconfigure SSO or update the provider's client secret.

Users locked out after disconnecting OIDC SSO ​

Cause ​

Disconnecting OIDC SSO does not automatically restore password access for users who were created through SSO. Those users have no password set, so they cannot log in once SSO is removed.

Solution ​

* Before disconnecting SSO, ensure a working email setup is configured on your instance and that email verification is enabled with all users email-verified.

* After disconnecting SSO, affected users must trigger the forgot-password flow to regain access to their accounts.

* An instance admin can re-enable form login from Admin Settings to expose the password login form.

SSO configuration lost after restart ​

OIDC/SAML configuration reset and the SSO login button missing after a pod or container restart

Cause ​

For SAML (Keycloak), the configuration is written to an H2 database under the /appsmith-stacks/data directory. Without a persistent volume mounted there, this data is lost on restart. OIDC configuration is stored in the MongoDB database, so a missing MongoDB persistent volume causes OIDC settings and the SSO button to disappear after restart.

Solution ​

* Confirm a persistent volume is configured for the relevant data directories so configuration survives restarts.

* For SAML/Keycloak, connect Appsmith to an external PostgreSQL instead of the bundled H2 database using APPSMITH_KEYCLOAK_DB_URL . The connection string format is postgres://<username>:<password>@<hostname>:<port>/<database_name> .

Unregistered redirect URI (OIDC) ​

Unregistered redirect_uri

Cause ​

The redirect (callback) URL that Appsmith sends to the identity provider does not exactly match the one registered with the provider. This commonly happens after the instance host or domain changes.

Solution ​

* Copy the Redirect URL shown on the Appsmith OIDC configuration page ( Admin Settings → Authentication → OIDC ) and register that exact value with your identity provider. See OpenID Connect (OIDC) .

* Ensure the host in the redirect URI matches your current Appsmith base URL.

* If the mismatch persists, remove the OIDC configuration entirely and configure it again.

Redirect URI mismatch (SAML / Entra ID) ​

Cause ​

The redirect URI sent by Appsmith does not match the value configured for the registered application in the identity provider (for example Azure AD / Entra ID), often due to an http vs https protocol mismatch.

Solution ​

* Ensure both Appsmith and the identity provider use the same protocol (use https , not http ).

* Add the Redirect URL from the Appsmith SAML 2.0 configuration page to the Reply URL (Assertion Consumer Service URL) in Entra ID. See Configure SAML with Microsoft Entra ID .

Invalid client ID breaks OIDC and Google login ​

Audience is not a valid client ID

Cause ​

An incorrect value entered in the OIDC authentication configuration (for example a wrong audience) can break OIDC login, and may also cause Google SSO to fail. If form login is disabled, this can lock everyone out.

Solution ​

* Regain admin access by enabling form login and signing up with a new APPSMITH_ADMIN_EMAILS account (see the lockout recovery steps above).

* In Admin Settings , correct the OIDC configuration value, or remove and reconfigure OIDC.

SSO button missing or SSO unavailable ​

SSO login button is gone and no one can log in

Cause ​

The SSO login button can disappear if the SSO configuration was lost (see the restart issue above) or if the license is not being recognized, causing SSO to show as unavailable.

Solution ​

* Regain access by following Recover admin access when you don't know the admin email .

* In Admin Settings , if SSO shows unavailable, click the Refresh button next to your license key.

* Confirm you are running the Enterprise Edition image ( appsmith/appsmith-ee ), since SSO (OIDC and SAML) is an Enterprise feature.

Account already exists at SSO signup ​

Account already exists

Cause ​

When a user signs up via SSO with an incorrect email, the record is retained in Keycloak, preventing them from re-registering with the correct email.

Solution ​

Delete the affected user from Keycloak so they can register again:

* Visit <Appsmith-Deployment-URL>/auth .

* Log in with the KEYCLOAK_ADMIN_USERNAME and KEYCLOAK_ADMIN_PASSWORD credentials from your docker.env file.

* Open the Appsmith realm.

* Go to the Users tab and delete the affected user.

SAML stops redirecting correctly ​

Cause ​

SAML authentication can intermittently stop redirecting correctly so that users requiring fresh authentication cannot log in, while users with active cached sessions are unaffected.

Solution ​

* Restart the Appsmith deployment (containers/pods); this has resolved the symptom in reported cases.

* If a restart does not help, remove the SAML configuration and configure it again.

Was this page helpful?

Edit this page

Previous
Verify connectivity to cs.appsmith.com
Next
User Management and Permissions Errors

* Locked out after misconfiguring or disconnecting SSO

* Users locked out after disconnecting OIDC SSO

* SSO configuration lost after restart

* Unregistered redirect URI (OIDC)

* Redirect URI mismatch (SAML / Entra ID)

* Invalid client ID breaks OIDC and Google login

* SSO button missing or SSO unavailable

* Account already exists at SSO signup

* SAML stops redirecting correctly

Links found on this page

  1. Skip to main content [direct]
  2. Try Appsmith [direct]
  3. Get Started [direct]
  4. Build Your First App [direct]
  5. Self Hosting [direct]
  6. New Installation Guides [direct]
  7. Manage Installation [direct]
  8. Upgrade Installation Guides [direct]
  9. Concepts [direct]
  10. Connect Data [direct]
  11. How-to Guides [direct]
  12. Reference [direct]
  13. Query Settings [direct]
  14. Concepts [direct]
  15. Build Apps [direct]
  16. Quickstart [direct]
  17. How-to Guides [direct]
  18. Reference [direct]
  19. Widgets [direct]
  20. Accessibility [direct]
  21. Theme [direct]
  22. Sample Apps [direct]
  23. Write Code [direct]
  24. How-to Guides [direct]
  25. Reference [direct]
  26. Global Objects [direct]
  27. Global Functions [direct]
  28. JS Libraries [direct]
  29. Fetch API [direct]
  30. Data Transformation [direct]
  31. JavaScript Settings [direct]
  32. Concepts [direct]
  33. Best Practices [direct]
  34. Manage Apps and Users [direct]
  35. Granular Access Control [direct]
  36. Versioning with Git [direct]
  37. Setup SCIM Provisioning [direct]
  38. Embed Appsmith [direct]
  39. Migrate Applications [direct]
  40. Audit Logs [direct]
  41. Branding [direct]
  42. External Client Portal [direct]
  43. Packages [direct]
  44. Tutorial [direct]
  45. How-to Guides [direct]
  46. Reference [direct]
  47. GIT Apps with Packages Best Practices [direct]
  48. Code Packages [direct]
  49. UI Packages [direct]
  50. Workflows [direct]
  51. Tutorial [direct]
  52. How-to Guides [direct]
  53. Reference [direct]
  54. Workflow Queries [direct]
  55. Workflow Functions [direct]
  56. Pass Parameters to Workflows [direct]
  57. Run History [direct]
  58. Troubleshooting [direct]
  59. Self-hosting Errors [direct]
  60. MongoDB Startup Error Post Migration to Version 5 [direct]
  61. Schema Mismatch Error [direct]
  62. Kubernetes Helm Chart 3.0.4 Upgrade Error [direct]
  63. Recover admin access when you don't know the admin email [direct]
  64. Backup and Restore Errors [direct]
  65. License and Activation Errors [direct]
  66. Verify connectivity to cs.appsmith.com [direct]
  67. User Management and Permissions Errors [direct]
  68. SSL, Certificate, and Reverse Proxy Errors [direct]
  69. Email and SMTP Errors [direct]
  70. Performance and Resource Errors [direct]
  71. Monitoring and Audit Log Errors [direct]
  72. Upgrade and Migration Errors [direct]
  73. Application Errors [direct]
  74. Product [direct]
  75. Security [direct]
  76. Telemetry [direct]
  77. Support at Appsmith [direct]
  78. Privacy Policy [direct]
  79. Release Notes [direct]
  80. Contribute [direct]
SolFind Lens does not relay logins, forms, files, images, audio, or video.Portal home
With content from Curlie.org - the largest human-edited directory of the web. Contribute by submitting a website or becoming an editor.