diff --git a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/auth/SMAuthProviderExternal.java b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/auth/SMAuthProviderExternal.java
index d0d79f415f..4425395ad9 100644
--- a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/auth/SMAuthProviderExternal.java
+++ b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/auth/SMAuthProviderExternal.java
@@ -74,4 +74,8 @@ public interface SMAuthProviderExternal<AUTH_SESSION extends SMSession> extends
      */
     default void postAuthentication() {}
 
+    @Override
+    default boolean supportsOpeningSessionAsChild() {
+        return true;
+    }
 }
diff --git a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java
index 60cf8809cc..57514451c6 100644
--- a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java
+++ b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/local/LocalAuthProvider.java
@@ -101,6 +101,11 @@ public class LocalAuthProvider implements SMAuthProvider<LocalAuthSession>, SMBr
 
     }
 
+    @Override
+    public boolean supportsOpeningSessionAsChild() {
+        return false;
+    }
+
     public static boolean changeUserPassword(@NotNull WebSession webSession, @NotNull String oldPassword, @NotNull String newPassword) throws DBException {
         String userName = webSession.getUser().getUserId();
 
diff --git a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
index 8b11c7e1ac..a0a34fcee1 100644
--- a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
+++ b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
@@ -2472,6 +2472,13 @@ public class CBEmbeddedSecurityController<T extends ServletAuthApplication>
                 if (autoAssign != null && CommonUtils.isNotEmpty(autoAssign.getAuthRoleAssignReason())) {
                     log.info(activeUserId + " authenticated with role " + autoAssign.getAuthRole() + ", reason: " + autoAssign.getAuthRoleAssignReason());
                 }
+            } else {
+                SMAuthProvider<?> authProviderInstance = authProvider.getInstance();
+                if (!authProviderInstance.supportsOpeningSessionAsChild()) {
+                    var error = "Auth provider '" + authProviderId + "' doesn't support opening as a child session";
+                    updateAuthStatus(authId, SMAuthStatus.ERROR, dbStoredUserData, error, null);
+                    return SMAuthInfo.error(authId, error, isMainAuthSession, null, authInfo.getAppSessionId());
+                }
             }
             dbStoredUserData.put(
                 authConfiguration,