[Bug]: Licence for SSO and api endpoint unauthorized

[awb-gt]

Installation Method

Docker fat

The Problem

We upgraded to Stirling PDF 2.1.0, but SSO no longer works like it did with version 1.6.0. In the callback, I see that the oauthcallback returns "/error:OAuth=oAuth2RequiresLicense.". Do we need a license to use SSO?

Also, during the initial load, there are many unauthorized requests (/api/v1/info/wau, /api/v1/config/config-app, and /api/v1/config/endpoints-availability). Is this related to the missing license?

Finally when i set up SECURITY_OAUTH2_SCOPES="openid, email, profile" (or "openid email profile") I have an error on load and I am forced to only use openid.

Thank you, and congratulations on the new version, which looks great.

Version of Stirling-PDF

2.1.0

Last Working Version of Stirling-PDF

1.6.0

Page Where the Problem Occurred

/login

Docker Configuration

- SECURITY_OAUTH2_ENABLED=true
- SECURITY_OAUTH2_AUTOCREATEUSER=true
- SECURITY_OAUTH2_ISSUER=https://my-oauth
- SECURITY_OAUTH2_CLIENTID=my-client-id
- SECURITY_OAUTH2_CLIENTSECRET=my-client-secret
- SECURITY_OAUTH2_BLOCKREGISTRATION=false
- SECURITY_OAUTH2_SCOPES=openid
- SECURITY_OAUTH2_USEASUSERNAME=email
- SECURITY_OAUTH2_PROVIDER=my-provider

Relevant Log Output

Additional Information

No response

Browsers Affected

No response

No Duplicate of the Issue

• I have verified that there are no existing issues raised related to my problem.

[dosubot]

Yes, as of Stirling-PDF 2.1.0, OAuth2 SSO login now requires a Server or Enterprise license unless you are grandfathered in (i.e., you used SSO before the licensing change, including pending/invited users who never logged in). The error /error:OAuth=oAuth2RequiresLicense means the app is blocking SSO login because it doesn't detect a valid license for this feature. If you were using SSO in 1.6.0, you should be grandfathered and not need a paid license—this is handled automatically during upgrade for both active and pending users source.

SAML SSO is now enterprise-only and always requires an Enterprise license source.

The unauthorized API requests you see on initial load (like /api/v1/info/wau, /api/v1/config/config-app, /api/v1/config/endpoints-availability) are not directly linked to licensing. They are more likely due to authentication or authorization misconfiguration, or bugs introduced in v2.x. These issues are known and being addressed by maintainers source.

For your OAuth2 scopes, the correct format is a comma-separated list with spaces, like SECURITY_OAUTH2_SCOPES="openid, profile, email". Using space-separated values or commas without spaces will cause the IllegalArgumentException you saw source.

If you set SECURITY_OAUTH2_USEASUSERNAME=email, make sure your OAuth2 provider actually supplies the email claim, or login will fail source.

If you were using SSO before the upgrade and are still blocked, there may be a bug with the grandfathering logic. Otherwise, check your license status and scope formatting. Let me know if you need help checking your grandfathered status or troubleshooting further.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[awb-gt]

Hello,

When I setup my environment variable like : - SECURITY_OAUTH2_SCOPES="openid, profile, email"

I have this error :

[awb-gt]

I am sorry I closed the issue by mistake

[Frooodle]

Sorry this is a bug any old users should not lose SSO in any way, we are working on fixing this

[Faustpfand]

Are you kidding me? OAuth was broken in 2.0x for Authentik etc. and now I cant use it because you put a paywall in front of it? Is this satire?

[Frooodle]

If you used it previously you totally get it keep it...

Yes it was broken sorry for that bug we are working on resolving

[knightglyder]

I was using 1.6.0 but couldn't even find the section to configure users/SSO - and now all of your old doc pages have been removed from the site?

Where even was this option? What are the parameters to be "grandfathered"? Just having a user... or did that user have to have used SSO? Where were the instructions...?

[DarioGii]

• SECURITY_OAUTH2_SCOPES="openid, profile, email"

Hi @awb-gt, can you try adding the scopes without the quotes i.e. - SECURITY_OAUTH2_SCOPES=openid, profile, email? The error may be due to Docker misinterpreting the property because of that

[awb-gt]

Hi @DarioGii, yes, you are correct! The error is gone, and the OAUTH2 configuration no longer triggers an error when I start the service. Thank you.

[DarioGii]

I was using 1.6.0 but couldn't even find the section to configure users/SSO - and now all of your old doc pages have been removed from the site?

Where even was this option? What are the parameters to be "grandfathered"? Just having a user... or did that user have to have used SSO? Where were the instructions...?

Hi @knightglyder, apologies for the confusion. For now the old docs for SSO can be found here. Yes for grandfathering, a user would either have had to have used SSO or had an invite for SSO login.