OIDC user provisioning does not reactivate user accounts, fails with a customer-facing stacktrace

### Describe the bug

Trying to authenticate via OIDC using a disabled Metabase user fails with a raw JSON stacktrace (notice the successful login in the URL). This happens even if user provisioning is enabled, which should reactivate any deactivated accounts.

### To Reproduce

1. Enable OIDC with user provisioning
2. Disable any Metabase user's account
3. Log in with that user with OIDC
4. See error

### Expected behavior

Re-enable user accounts when OIDC user provisioning is enabled.

Never return raw stack traces as errors.

### Logs

Details

```json
{
"via": [
{
"type": "java.lang.ClassCastException",
"message": "class metabase.util.i18n.UserLocalizedString cannot be cast to class java.lang.String (metabase.util.i18n.UserLocalizedString is in unnamed module of loader 'app'; java.lang.String is in module java.base of loader 'bootstrap')",
"at": [
"clojure.core$ex_info",
"invokeStatic",
"core.clj",
4832
]
}
],
"trace": [
[
"clojure.core$ex_info",
"invokeStatic",
"core.clj",
4832
],
[
"clojure.core$ex_info",
"invoke",
"core.clj",
4832
],
[
"metabase_enterprise.sso.integrations.oidc$sso_callback",
"invokeStatic",
"oidc.clj",
97
],
[
"metabase_enterprise.sso.integrations.oidc$sso_callback",
"invoke",
"oidc.clj",
69
],
[
"metabase_enterprise.sso.api.sso$fn__174933$fn__174939",
"invoke",
"sso.clj",
178
],
[
"metabase.api.macros$_core_fn$core_fn__113167",
"invoke",
"macros.clj",
432
],
[
"metabase.api.macros$endpoint_handler_STAR_$handler__113205",
"invoke",
"macros.clj",
642
],
[
"metabase.api.macros.scope$ensure_scopes_checked$fn__112691",
"invoke",
"scope.clj",
78
],
[
"metabase.api.macros$build_ns_handler$ns_handler_STAR___113228",
"invoke",
"macros.clj",
716
],
[
"metabase.api.open_api.HandlerWithOpenAPISpec",
"invoke",
"open_api.clj",
42
],
[
"metabase.api.util.handlers$_route_map_handler$fn__113554",
"invoke",
"handlers.clj",
23
],
[
"metabase.api.open_api.HandlerWithOpenAPISpec",
"invoke",
"open_api.clj",
42
],
[
"metabase.api.util.handlers$_route_map_handler$fn__113554",
"invoke",
"handlers.clj",
23
],
[
"metabase.api.open_api.HandlerWithOpenAPISpec",
"invoke",
"open_api.clj",
42
],
[
"clojure.lang.Var",
"invoke",
"Var.java",
395
],
[
"compojure.core$routes$fn__113491$f__113492",
"invoke",
"core.clj",
198
],
[
"compojure.core$routes$fn__113491$f__113492$respond_SINGLEQUOTE___113493",
"invoke",
"core.clj",
197
],
[
"metabase.api.util.handlers$_route_map_handler$fn__113554",
"invoke",
"handlers.clj",
24
],
[
"metabase.api.open_api.HandlerWithOpenAPISpec",
"invoke",
"open_api.clj",
42
],
[
"metabase.api.util.handlers$_route_map_handler$fn__113554",
"invoke",
"handlers.clj",
23
],
[
"metabase.api.open_api.HandlerWithOpenAPISpec",
"invoke",
"open_api.clj",
42
],
[
"metabase.api.util.handlers$_route_map_handler$fn__113554",
"invoke",
"handlers.clj",
23
],
[
"metabase.api.open_api.HandlerWithOpenAPISpec",
"invoke",
"open_api.clj",
42
],
[
"compojure.core$routes$fn__113491$f__113492",
"invoke",
"core.clj",
198
],
[
"compojure.core$routes$fn__113491",
"invoke",
"core.clj",
200
],
[
"metabase.api.open_api.HandlerWithOpenAPISpec",
"invoke",
"open_api.clj",
42
],
[
"compojure.core$routes$fn__113491$f__113492",
"invoke",
"core.clj",
198
],
[
"compojure.core$routes$fn__113491",
"invoke",
"core.clj",
200
],
[
"metabase.server.middleware.exceptions$catch_uncaught_exceptions$fn__127747",
"invoke",
"exceptions.clj",
94
],
[
"metabase.server.middleware.exceptions$catch_api_exceptions$fn__127742",
"invoke",
"exceptions.clj",
83
],
[
"metabase.server.middleware.log$log_api_call$fn__127421",
"invoke",
"log.clj",
223
],
[
"metabase.server.middleware.browser_cookie$ensure_browser_id_cookie$fn__127989",
"invoke",
"browser_cookie.clj",
40
],
[
"metabase.server.middleware.security$add_security_headers$fn__127700",
"invoke",
"security.clj",
442
],
[
"metabase.server.middleware.json$wrap_json_body$fn__127505",
"invoke",
"json.clj",
128
],
[
"metabase.server.middleware.offset_paging$handle_paging$fn__127841",
"invoke",
"offset_paging.clj",
48
],
[
"metabase.server.middleware.json$wrap_streamed_json_response$fn__127493",
"invoke",
"json.clj",
83
],
[
"metabase.server.middleware.metadata_provider_cache$wrap_metadata_provider_cache$fn__127999",
"invoke",
"metadata_provider_cache.clj",
11
],
[
"ring.middleware.keyword_params$wrap_keyword_params$fn__128264",
"invoke",
"keyword_params.clj",
55
],
[
"ring.middleware.params$wrap_params$fn__128283",
"invoke",
"params.clj",
77
],
[
"metabase.server.middleware.auth$verify_slack_request$fn__127449",
"invoke",
"auth.clj",
86
],
[
"metabase.server.middleware.misc$maybe_set_site_url$fn__126932",
"invoke",
"misc.clj",
102
],
[
"metabase.server.middleware.session$reset_session_timeout$fn__127977",
"invoke",
"session.clj",
410
],
[
"metabase.server.middleware.session$bind_current_user$fn__127963$fn__127964",
"invoke",
"session.clj",
367
],
[
"metabase.request.session$do_with_current_user$fn__70130",
"invoke",
"session.clj",
59
],
[
"metabase.request.session$do_with_current_user$do_with_user_local_values__70125",
"invoke",
"session.clj",
55
],
[
"metabase.request.session$do_with_current_user",
"invokeStatic",
"session.clj",
56
],
[
"metabase.request.session$do_with_current_user",
"invoke",
"session.clj",
36
],
[
"metabase.server.middleware.session$bind_current_user$fn__127963",
"invoke",
"session.clj",
366
],
[
"metabase.server.middleware.session$wrap_current_user_info$fn__127946",
"invoke",
"session.clj",
342
],
[
"metabase.server.middleware.premium_features_cache$wrap_premium_features_cache_check$fn__127819",
"invoke",
"premium_features_cache.clj",
57
],
[
"metabase.server.middleware.settings_cache$wrap_settings_cache_check$fn__127783",
"invoke",
"settings_cache.clj",
50
],
[
"metabase.analytics.sdk$embedding_mw$embedding_mw_fn__75950",
"invoke",
"sdk.clj",
184
],
[
"metabase.server.middleware.session$wrap_session_key$fn__127878",
"invoke",
"session.clj",
94
],
[
"metabase.server.middleware.auth$wrap_static_api_key$fn__127441",
"invoke",
"auth.clj",
48
],
[
"ring.middleware.cookies$wrap_cookies$fn__128184",
"invoke",
"cookies.clj",
200
],
[
"metabase.server.middleware.misc$add_version$fn__126885",
"invoke",
"misc.clj",
30
],
[
"metabase.server.middleware.misc$add_content_type$fn__126893",
"invoke",
"misc.clj",
48
],
[
"metabase.server.middleware.misc$disable_streaming_buffering$fn__126940",
"invoke",
"misc.clj",
118
],
[
"ring.middleware.gzip$wrap_gzip$fn__128226",
"invoke",
"gzip.clj",
86
],
[
"metabase.server.middleware.trace$wrap_trace$fn__127522",
"invoke",
"trace.clj",
116
],
[
"metabase.server.middleware.request_id$wrap_request_id$fn__125932",
"invoke",
"request_id.clj",
10
],
[
"metabase.server.middleware.misc$bind_request$fn__126943$fn__126944",
"invoke",
"misc.clj",
130
],
[
"metabase.request.current$do_with_current_request",
"invokeStatic",
"current.clj",
22
],
[
"metabase.request.current$do_with_current_request",
"invoke",
"current.clj",
18
],
[
"metabase.server.middleware.misc$bind_request$fn__126943",
"invoke",
"misc.clj",
129
],
[
"metabase.server.middleware.ssl$redirect_to_https_middleware$fn__128013",
"invoke",
"ssl.clj",
52
],
[
"metabase.server.instance$async_proxy_handler$fn__127131",
"invoke",
"instance.clj",
88
],
[
"metabase.server.instance.proxy$org.eclipse.jetty.ee9.servlet.ServletHandler$ff19274a",
"doHandle",
null,
-1
],
[
"org.eclipse.jetty.ee9.nested.ScopedHandler",
"handle",
"ScopedHandler.java",
125
],
[
"metabase.server.statistics_handler$new_handler$fn__117101",
"invoke",
"statistics_handler.clj",
106
],
[
"metabase.server.statistics_handler.proxy$org.eclipse.jetty.ee9.nested.HandlerWrapper$ff19274a",
"handle",
null,
-1
],
[
"org.eclipse.jetty.ee9.nested.HandlerWrapper",
"handle",
"HandlerWrapper.java",
124
],
[
"org.eclipse.jetty.ee9.nested.ScopedHandler",
"nextHandle",
"ScopedHandler.java",
195
],
[
"org.eclipse.jetty.ee9.nested.ContextHandler",
"doHandle",
"ContextHandler.java",
1047
],
[
"org.eclipse.jetty.ee9.nested.ScopedHandler",
"nextScope",
"ScopedHandler.java",
162
],
[
"org.eclipse.jetty.ee9.servlet.ServletHandler",
"doScope",
"ServletHandler.java",
483
],
[
"metabase.server.instance.proxy$org.eclipse.jetty.ee9.servlet.ServletHandler$ff19274a",
"doScope",
null,
-1
],
[
"org.eclipse.jetty.ee9.nested.ScopedHandler",
"nextScope",
"ScopedHandler.java",
160
],
[
"org.eclipse.jetty.ee9.nested.ContextHandler",
"doScope",
"ContextHandler.java",
962
],
[
"org.eclipse.jetty.ee9.nested.ScopedHandler",
"handle",
"ScopedHandler.java",
123
],
[
"org.eclipse.jetty.ee9.nested.ContextHandler",
"handle",
"ContextHandler.java",
1738
],
[
"org.eclipse.jetty.ee9.nested.HttpChannel$RequestDispatchable",
"dispatch",
"HttpChannel.java",
1586
],
[
"org.eclipse.jetty.ee9.nested.HttpChannel",
"dispatch",
"HttpChannel.java",
737
],
[
"org.eclipse.jetty.ee9.nested.HttpChannel",
"handle",
"HttpChannel.java",
520
],
[
"org.eclipse.jetty.ee9.nested.ContextHandler$CoreContextHandler$CoreToNestedHandler",
"handle",
"ContextHandler.java",
3098
],
[
"org.eclipse.jetty.server.handler.ContextHandler",
"handle",
"ContextHandler.java",
1253
],
[
"org.eclipse.jetty.server.Server",
"handle",
"Server.java",
197
],
[
"org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker",
"run",
"HttpChannelState.java",
804
],
[
"org.eclipse.jetty.server.internal.HttpConnection",
"onFillable",
"HttpConnection.java",
420
],
[
"org.eclipse.jetty.server.internal.HttpConnection$FillableCallback",
"succeeded",
"HttpConnection.java",
1790
],
[
"org.eclipse.jetty.io.FillInterest",
"fillable",
"FillInterest.java",
105
],
[
"org.eclipse.jetty.io.SelectableChannelEndPoint$1",
"run",
"SelectableChannelEndPoint.java",
54
],
[
"org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy",
"runTask",
"AdaptiveExecutionStrategy.java",
492
],
[
"org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy",
"epcRunTask",
"AdaptiveExecutionStrategy.java",
428
],
[
"org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy",
"consumeTask",
"AdaptiveExecutionStrategy.java",
401
],
[
"org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy",
"tryProduce",
"AdaptiveExecutionStrategy.java",
255
],
[
"org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy",
"run",
"AdaptiveExecutionStrategy.java",
204
],
[
"org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread",
"run",
"ReservedThreadExecutor.java",
317
],
[
"org.eclipse.jetty.util.thread.QueuedThreadPool",
"runJob",
"QueuedThreadPool.java",
1009
],
[
"org.eclipse.jetty.util.thread.QueuedThreadPool$Runner",
"doRunJob",
"QueuedThreadPool.java",
1240
],
[
"org.eclipse.jetty.util.thread.QueuedThreadPool$Runner",
"run",
"QueuedThreadPool.java",
1194
],
[
"java.lang.Thread",
"run",
null,
-1
]
],
"cause": "class metabase.util.i18n.UserLocalizedString cannot be cast to class java.lang.String (metabase.util.i18n.UserLocalizedString is in unnamed module of loader 'app'; java.lang.String is in module java.base of loader 'bootstrap')",
"message": "class metabase.util.i18n.UserLocalizedString cannot be cast to class java.lang.String (metabase.util.i18n.UserLocalizedString is in unnamed module of loader 'app'; java.lang.String is in module java.base of loader 'bootstrap')"
}
```

### Information about your Metabase installation

```JSON
{
"browser-info": {
"language": "en-US",
"platform": "MacIntel",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0",
"vendor": ""
},
"metabase-info": {
"valid-thru": "2026-08-05T12:00:00Z",
"current-user-count": 6,
"application-database": "postgres",
"settings": {
"report-timezone": "America/Argentina/Buenos_Aires"
},
"application-database-details": {
"database": {
"name": "PostgreSQL",
"version": "17.5 (Debian 17.5-1.pgdg120+1)"
},
"jdbc-driver": {
"name": "PostgreSQL JDBC Driver",
"version": "42.7.12"
}
},
"databases": [
"postgres",
"sqlite"
],
"max-users": 999,
"plan-alias": "enterprise-airgap",
"hosting-env": "unknown",
"run-mode": "prod",
"version": {
"date": "2026-08-04",
"tag": "v1.63.3",
"hash": "f0c5d38"
},
"airgap-token": "enabled"
},
"system-info": {
"file.encoding": "UTF-8",
"java.runtime.name": "OpenJDK Runtime Environment",
"java.runtime.version": "25.0.3+9-LTS",
"java.vendor": "Eclipse Adoptium",
"java.vendor.url": "https://adoptium.net/",
"java.version": "25.0.3",
"java.vm.name": "OpenJDK 64-Bit Server VM",
"java.vm.version": "25.0.3+9-LTS",
"jvm.available-processors": 14,
"jvm.max-memory": "3.9 GB",
"os.name": "Linux",
"os.version": "7.0.14-orbstack-00374-gbbca68e8d741",
"system.total-memory": "15.7 GB",
"user.language": "en",
"user.timezone": "America/Argentina/Buenos_Aires"
}
}
```

### Severity

P2

### Additional context

_No response_

Start in metabase_enterprise/sso/integrations/oidc.clj at the sso_callback entry point and line 97 shown in the trace; inspect how disabled users and provisioning are handled. Reproduce the OIDC login with a disabled account, then verify that provisioning reactivates it and that the customer receives no raw stacktrace.

Written by the indexing model from the issue text.