Skip to content

Identity Provider Not Active

URI: https://docs.ankatech.co/errors/idp-not-bound
HTTP Status: 503 Service Unavailable

When you see this

A federated login path resolved no active identity provider for the tenant. Resolution is fail-closed: a caller that expected a federated provider is refused rather than silently downgraded to local authentication, and no federated account is minted against a provider that is not live.

Common Causes

  • The tenant's provider is still in the DECLARED state and was never activated.
  • The provider exists but is disabled, and no deployment-default provider is active either.
  • No provider is bound to the tenant at all, so resolution falls back to local authentication on a path that requires federation.
  • A just-in-time provisioning request names a provider that is not the one currently bound for the tenant.

Response Example

{
  "type": "https://docs.ankatech.co/errors/idp-not-bound",
  "title": "Identity Provider Not Active",
  "status": 503,
  "detail": "The identity provider is not active. Complete declare and a passing self-test before use.",
  "instance": "/api/v3/admin/s2s/auth/idp/resolve",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The detail is a fixed string carrying no tenant identifier, no issuer and no configuration value, so the refusal is byte-identical for any caller and cannot be used to probe which tenants have a provider declared.

How to Resolve

  1. Confirm the tenant's identity provider exists and is enabled — a DECLARED or disabled provider is not usable.
  2. Run the provider's self-test and activate it once it passes.
  3. If the tenant relies on the deployment-default provider, confirm that one is active.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.