diff --git a/frontend/src/api/subsystem.ts b/frontend/src/api/subsystem.ts
index 2aac311..a6d5866 100644
--- a/frontend/src/api/subsystem.ts
+++ b/frontend/src/api/subsystem.ts
@@ -112,7 +112,15 @@ export const subsystemApi = {
     const data = await response.json().catch(() => ({}))
     if (response.status === 401) {
       removeToken()
-      redirectToSSO(openApp)
+      const configResponse = await fetch('/auth/api/v1/config', {
+        headers: { Accept: 'application/json' },
+      }).catch(() => null)
+      const config = await configResponse?.json().catch(() => ({}))
+      if (config?.sso_enabled === false) {
+        window.location.assign(`/login?redirect=${encodeURIComponent(`/subsystem?open_app=${openApp}`)}`)
+      } else {
+        redirectToSSO(openApp)
+      }
       throw new Error('unauthorized')
     }
     if (!response.ok) {
diff --git a/frontend/src/views/auth/Login.vue b/frontend/src/views/auth/Login.vue
index bc08c66..e0b0e17 100644
--- a/frontend/src/views/auth/Login.vue
+++ b/frontend/src/views/auth/Login.vue
@@ -81,6 +81,10 @@ const handleLocalLogin = async () => {
   try {
     await login(value, '')
     const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : '/'
+    if (redirect.startsWith('/auth/')) {
+      window.location.assign(redirect)
+      return
+    }
     router.replace(redirect)
   } finally {
     loading.value = false
diff --git a/server/internal/handler/oauth.go b/server/internal/handler/oauth.go
index 403b283..f5c98d3 100644
--- a/server/internal/handler/oauth.go
+++ b/server/internal/handler/oauth.go
@@ -56,6 +56,9 @@ func (h *OAuthHandler) Authorize(c *gin.Context) {
 	user, ok := h.sessionUser(c)
 	if !ok {
 		loginURL := "/auth/api/v1/login/internal-sso?relay_state=" + url.QueryEscape(c.Request.URL.RequestURI())
+		if !h.cfg.SSOEnabled {
+			loginURL = "/login?redirect=" + url.QueryEscape(c.Request.URL.RequestURI())
+		}
 		c.Redirect(http.StatusFound, loginURL)
 		return
 	}