Skip to content

Platform Federated Entry Would Lock Out

URI: https://docs.ankatech.co/errors/platform-federated-entry-would-lock-out
HTTP Status: 409 Conflict

When you see this

The platform authentication posture is FEDERATED_ONLY: platform administrators sign in only through an identity provider approved for platform sign-in. The change you sent would remove the last such provider that is enabled, so no platform administrator could sign in through federation afterwards.

A federated entry is a deployment OIDC or SAML provider that is approved for platform sign-in, ACTIVE and enabled. Disabling or deleting it, withdrawing its approval, and editing it end it: every edit returns the provider to DECLARED and disabled until it passes a self-test and is enabled again. The check is made while the platform's authentication settings are held, so two administrators changing the last two providers at the same time cannot both succeed.

Removing the provider's trust anchors is the remediation of suspected compromise or bad anchors, so it is not refused only to keep federated sign-in available. It is refused when no designated break-glass platform administrator holds the authenticators to sign in without the provider.

Common Causes

  • Disabling, deleting or editing the only enabled provider approved for platform sign-in.
  • Withdrawing the platform-sign-in approval of that provider.
  • Two administrators each disabling one of the last two approved providers at the same time: the one who acts second is refused.
  • Removing the trust anchors of the last approved provider while no break-glass platform administrator is designated.

Response Example

{
  "type": "https://docs.ankatech.co/errors/platform-federated-entry-would-lock-out",
  "title": "Platform Federated Entry Would Lock Out",
  "status": 409,
  "detail": "The platform plane admits federated sign-in only (FEDERATED_ONLY), and this is its last identity provider approved for platform sign-in, so no platform administrator could sign in through federation. Change the platform authentication posture first. Nothing was changed.",
  "instance": "/api/v3/admin/platform/idp/c41e7b02-9d3a-4f58-b6e1-27a0d8f5c913/disable",
  "timestamp": 1760864400,
  "extensions": {
    "requestId": "e1c47a93-0d5b-4f26-9a38-7b2e6c0f4d15"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

Nothing is changed, and the refusal is recorded in the administrative audit trail on the platform plane as a DENIED change of the provider. When trust anchors are removed while a break-glass platform administrator is designated, the removal is applied and its audit record carries federatedEntryLost: true, and the platform security alert PLATFORM_FEDERATED_ENTRY_LOST is raised until a person acknowledges it.

How to Resolve

  1. Approve and enable another OIDC or SAML provider for platform sign-in, then retry the change; or
  2. Change the platform authentication posture away from FEDERATED_ONLY, then retry the change.
  3. To remove the trust anchors of the last approved provider, designate a break-glass platform administrator who holds the required authenticators first.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.