Error codes for SSO

These are the codes CloudRepo answers with when single sign-on (SSO) refuses a request. Each code is the value of the error field in the response, or, for a sign-in, the code at the end of the sign-in page’s address.

403 Forbidden

sso_enforced

Your organization enforces SSO. What you see depends on what was refused:

Where	What you see (status 403)	Fix
Maven, npm or pip, with a password	Password access is refused: SSO is enforced for this organization. Sign in with SSO and create a repository token.	A member signs in through your identity provider and creates a repository token. A pipeline uses a service key.
Maven, npm or pip, with a token	This token was not created after a sign-in through this organization's current identity provider, and SSO is enforced. Sign in with SSO and create a new repository token.	The member signs in through your identity provider and creates a new token. A pipeline uses a service key.
Docker, with a member’s password	denied: Password access is refused: SSO is enforced for this organization. Sign in with SSO and create a repository token.	The same as for Maven, npm or pip with a password.
Docker, with a member’s token	denied: This token was not created after a sign-in through this organization's current identity provider, and SSO is enforced. Sign in with SSO and create a new repository token.	The same as for Maven, npm or pip with a token.
The CloudRepo sign-in page, with a password	This organization signs in with SSO.	Sign in through SSO. If the page asks you to contact your administrator, ask your organization’s owner.
Creating or rotating a repository token	Repository token mint is unavailable; SSO is enforced for this organization. Non-owner identities must obtain tokens via SSO-authenticated workflows.	Sign out, sign in again through your identity provider, and create the token from that session.
Creating a user	User creation is unavailable; users in this organization log in via your identity provider.	Add the person through your identity provider instead.
Finishing npm login in the browser, signed in to the portal with a password	SSO is enforced for this organization. npm-login mint is not permitted via password-authenticated portal session for non-owner identities.	Sign in to the portal through your identity provider, then run npm login again.
Turning off MFA for your own account	MFA disable is unavailable; users in this organization log in via your identity provider.	You sign in through your identity provider. Manage your second factor there.

Status 409, when you disconnect SSO while it is enforced. The portal says SSO was not disconnected because it is enforced. Fix: stop enforcing SSO first, then disconnect it.

idp_switched

What you see (status 403):

This token was created after a sign-in through an identity provider this organization no longer uses. Sign in again and create a new token.

CopyCopied

Why: your organization switched identity providers, and this token was created after a sign-in through the old one. This happens whether or not SSO is enforced.

Fix: the member who owns the token signs in through your current identity provider and creates a new token.

owner_mfa_required_before_sso_enforce

What you see, when you enforce SSO:

Set up two-factor authentication on your own account first: SSO can be enforced only once the owner has a second factor.

Why: enforcing SSO needs the organization’s owner to have a second factor.

Fix: set up a second factor on your own account, then enforce SSO again.

409 Conflict

sso_enforced_owner_mfa_required

What you see, when the owner removes or resets their own second factor:

Your organization enforces single sign-on, so the owner’s multi-factor authentication cannot be removed or reset.

Why: once SSO is enforced, the owner’s password and second factor are how the owner signs in, so CloudRepo keeps the second factor in place.

Fix: keep your second factor and your backup codes safe. If you lose your authenticator and have no backup codes left, the way back is the owner reset process.

While your organization enforces single sign-on, there is no other administrator who can confirm: your other administrators sign in through your identity provider.

sso_enforced_same_idp_required

What the API answers (status 409), when you save an identity provider configuration while SSO is enforced and the change would point CloudRepo at another provider:

Your organization enforces single sign-on, so it cannot switch to a different identity provider. To update a certificate or client secret, keep the same protocol and exactly the same entity ID (SAML) or issuer URL (OIDC).

CopyCopied

Why: your organization enforces SSO, and the new configuration names another protocol, or another SAML entity ID or OIDC issuer URL. Nothing is saved.

Fix: keep the same protocol and exactly the same entity ID or issuer URL. That lets you update a certificate or a client secret. Disconnecting SSO is refused while it is enforced, so it is no way round.

503 Service Unavailable

mfa_reset_unavailable

Status 503, from the CloudRepo API, when the owner resets a member’s MFA.

Why: the reset could not be completed right now. Nothing was changed.

Fix: try again in a few minutes.

owner_mfa_reset_unavailable

What you see, on the page where an administrator confirms or refuses a request to reset the owner’s MFA:

CloudRepo could not read this request just now, so nothing changed. Try again in a minute.

The owner’s sign-in can get the same code while a reset of their MFA is pending.

Why: CloudRepo could not complete the reset just now.

Fix: try again in a minute. If the owner’s sign-in keeps getting this code, contact support@cloudrepo.io.

Sign-in codes

These codes come back on the CloudRepo sign-in page’s address after a sign-in through your identity provider, as ?error= and the code.

sso_link_required

What you see, on the CloudRepo sign-in page after signing in through your identity provider:

Your organization has to make a change before you can sign in with SSO, so signing in again will not work yet. Contact your organization’s administrator.

Why: CloudRepo already holds something at this member’s address, such as their CloudRepo account, an invitation, or a record your identity provider added through SCIM, and the owner has not allowed SSO sign-in for it. An allowance also lapses when the member does not sign in within 7 days. With OIDC, a member you invited is refused too when the ID token does not say your identity provider verified their address. Microsoft Entra ID’s ID token does not say so by default.

Fix: the owner allows SSO sign-in for this member in the portal’s SSO settings, and the member signs in through your identity provider within 7 days.

subject_id_mismatch

What you see, on the CloudRepo sign-in page:

Your email address is linked to a different identity provider account, so this sign-in was refused.

Why: CloudRepo has this address linked to another account at your identity provider, for example after your organization switched identity providers.

Fix: the owner allows SSO sign-in for this member again in the portal’s SSO settings, and the member signs in again.

owner_password_required

What you see, on the CloudRepo sign-in page after signing in through your identity provider:

The organization owner never signs in through an identity provider. To reach the password form, go to /login/your-organization, using your organization ID.

Why: the address you signed in with is your organization owner’s, and the owner never signs in through single sign-on.

Fix: go to /login/ followed by your organization ID, and sign in with your password.