Cannot enable SSO via admin interface or config file

SensibleSalmon

I have a new Cryptpad instance (2025.6.0) running on a Debian VM. I have an admin account and am attempting to set up SSO.

I've installed the SSO plugin (v 0.3.0) to lib/plugins and now see the SSO section in the Admin view. However, I cannot check the 'enable SSO' box; if I click it, it unchecks itself almost instantly.

If I write an sso.js file it seems to be unused; SSO is never offered and doesn't appear to be set up on the server.

There's nothing in the logs (either browser console or server-side logs, even at 'verbose' output) that indicate any problem.

Here is my SSO config (basically just the example with 'enabled' turned on):

// SPDX-FileCopyrightText: 2023 XWiki CryptPad Team <contact@cryptpad.org> and contributors
//
// SPDX-License-Identifier: AGPL-3.0-or-later

//const fs = require('node:fs');
module.exports = {
    // Enable SSO login on this instance
    enabled: true,
    // Block registration for non-SSO users on this instance
    enforced: false,
    // Allow users to add an additional CryptPad password to their SSO account
    cpPassword: false,
    // You can also force your SSO users to add a CryptPad password
    forceCpPassword: false,
    // List of SSO providers
    list: [
    /*
    {
        name: 'google',
        type: 'oidc',
        url: 'https://accounts.google.com',
        client_id: "{your_client_id}",
        client_secret: "{your_client_secret}",
        jwt_alg: 'RS256' (optional)
    }, {
        name: 'samltest',
        type: 'saml',
        url: 'https://samltest.id/idp/profile/SAML2/Redirect/SSO',
        issuer: 'your-cryptpad-issuer-id',
        cert: String or fs.readFileSync("./your/cert/location", "utf-8"),
        privateKey: fs.readFileSync("./your/private/key/location", "utf-8"),
        signingCert: fs.readFileSync("./your/signing/cert/location", "utf-8"),
    }
    */
    ]
};

I tried it before with an actual block for my Authentik instance:

module.exports = {
    // Enable SSO login on this instance
    enabled: true,
    // Block registration for non-SSO users on this instance
    enforced: false,
    // Allow users to add an additional CryptPad password to their SSO account
    cpPassword: false,
    // You can also force your SSO users to add a CryptPad password
    forceCpPassword: false,
    // List of SSO providers
    list: [
{
            {
      name: 'Authentik',
      type: 'oidc',
      url: 'https://authentik.<my domain here>>/application/o/cryptpad/',
      client_id: "<client secret here>",
      client_secret: "<client id here>",
      jwt_alg: 'RS256',
      username_scope: 'profile',
      username_claim: 'preferred_username',
    },
}

SensibleSalmon

Here's some of the server-side logs:

Aug 06 15:37:20 cryptpad systemd[1]: Started cryptpad.service - CryptPad Service.

[ ... TRIMMED ... ]

Aug 06 15:37:21 cryptpad node[693]: ["INFO","2025-08-06T19:37:21.524Z","WORKER_ENV_UPDATE","Updating HTTP workers with latest state"]
Aug 06 15:37:21 cryptpad node[693]: ["INFO","2025-08-06T19:37:21.524Z","WORKER_CACHE_FLUSH","Instructing HTTP workers to flush cache"]
Aug 06 15:37:21 cryptpad node[693]: ["INFO","2025-08-06T19:37:21.975Z","SERVER_TELEMETRY",{"version":"2025.6.0","installMethod":"unspecified","httpUnsafeO>
Aug 06 15:37:22 cryptpad node[693]: ["WARN","2025-08-06T19:37:22.473Z","dailyPing",{"output":"SERVER ERROR 404","message":"dailyPing","stack":"Error: dail>
Aug 06 15:37:27 cryptpad node[704]: (node:704) [DEP0060] DeprecationWarning: The `util._extend` API is deprecated. Please use Object.assign() instead.
Aug 06 15:37:27 cryptpad node[704]: (Use `node --trace-deprecation ...` to show where the warning was created)
Aug 06 15:39:23 cryptpad node[693]: ["ERROR","2025-08-06T19:39:23.204Z","HK_GET_OLDER_HISTORY","000000000000000000000000000000000"]
Aug 06 15:39:25 cryptpad node[693]: ["ERROR","2025-08-06T19:39:25.658Z","HK_GET_OLDER_HISTORY","000000000000000000000000000000000"]
Aug 06 15:39:27 cryptpad node[693]: ["VERBOSE","2025-08-06T19:39:27.826Z","SSO_ADMIN_DECREE_RECEIVED",["ADD_SSO_DECREE",["ENABLE_SSO",[true]]]]
Aug 06 15:39:28 cryptpad node[693]: ["VERBOSE","2025-08-06T19:39:28.454Z","SSO_ADMIN_DECREE_RECEIVED",["ADD_SSO_DECREE",["ENABLE_SSO",[true]]]]
Aug 06 15:39:29 cryptpad node[693]: ["VERBOSE","2025-08-06T19:39:29.269Z","SSO_ADMIN_DECREE_RECEIVED",["ADD_SSO_DECREE",["ENABLE_SSO",[true]]]]
Aug 06 15:39:29 cryptpad node[693]: ["VERBOSE","2025-08-06T19:39:29.409Z","SSO_ADMIN_DECREE_RECEIVED",["ADD_SSO_DECREE",["ENABLE_SSO",[true]]]]
Aug 06 15:39:29 cryptpad node[693]: ["VERBOSE","2025-08-06T19:39:29.562Z","SSO_ADMIN_DECREE_RECEIVED",["ADD_SSO_DECREE",["ENABLE_SSO",[true]]]]
Aug 06 15:39:29 cryptpad node[693]: ["VERBOSE","2025-08-06T19:39:29.728Z","SSO_ADMIN_DECREE_RECEIVED",["ADD_SSO_DECREE",["ENABLE_SSO",[true]]]]
Aug 06 15:42:52 cryptpad node[693]: ["VERBOSE","2025-08-06T19:42:52.555Z","SSO_ADMIN_DECREE_RECEIVED",["ADD_SSO_DECREE",["ENABLE_SSO",[true]]]]
Aug 06 15:42:53 cryptpad node[693]: ["VERBOSE","2025-08-06T19:42:53.027Z","SSO_ADMIN_DECREE_RECEIVED",["ADD_SSO_DECREE",["ENABLE_SSO",[true]]]]
Aug 06 15:42:53 cryptpad node[693]: ["VERBOSE","2025-08-06T19:42:53.191Z","SSO_ADMIN_DECREE_RECEIVED",["ADD_SSO_DECREE",["ENABLE_SSO",[true]]]]
Aug 06 15:42:53 cryptpad node[693]: ["VERBOSE","2025-08-06T19:42:53.348Z","SSO_ADMIN_DECREE_RECEIVED",["ADD_SSO_DECREE",["ENABLE_SSO",[true]]]]

SensibleSalmon

I examined the sso.js file and found I had double nested my ODIC object in another object.

Mathilde

Thanks for sharing the solution!