BookStackApp/BookStack · error · OidcIssuerDiscoveryException

HTTP request failed during discovery with error: {$exception

Error message

HTTP request failed during discovery with error: {$exception->getMessage()}

What it means

discoverFromIssuer() wraps any PSR-18 ClientExceptionInterface raised while fetching the discovery document or JWKS into an OidcIssuerDiscoveryException with this message. It means the HTTP request itself failed at the transport/client level (connection refused, DNS failure, TLS error, timeout) — not that the document content was invalid.

Source

Thrown at app/Access/Oidc/OidcProviderSettings.php:106

            }
        }
    }

    /**
     * Discover and autoload settings from the configured issuer.
     *
     * @throws OidcIssuerDiscoveryException
     */
    public function discoverFromIssuer(ClientInterface $httpClient, Repository $cache, int $cacheMinutes): void
    {
        try {
            $cacheKey = 'oidc-discovery::' . $this->issuer;
            $discoveredSettings = $cache->remember($cacheKey, $cacheMinutes * 60, function () use ($httpClient) {
                return $this->loadSettingsFromIssuerDiscovery($httpClient);
            });
            $this->applySettingsFromArray($discoveredSettings);
        } catch (ClientExceptionInterface $exception) {
            throw new OidcIssuerDiscoveryException("HTTP request failed during discovery with error: {$exception->getMessage()}");
        }
    }

    /**
     * @throws OidcIssuerDiscoveryException
     * @throws ClientExceptionInterface
     */
    protected function loadSettingsFromIssuerDiscovery(ClientInterface $httpClient): array
    {
        $issuerUrl = rtrim($this->issuer, '/') . '/.well-known/openid-configuration';
        $request = new Request('GET', $issuerUrl);
        $response = $httpClient->sendRequest($request);
        $result = json_decode($response->getBody()->getContents(), true);

        if (empty($result) || !is_array($result)) {
            throw new OidcIssuerDiscoveryException("Error discovering provider settings from issuer at URL {$issuerUrl}");
        }

View on GitHub (pinned to 18f8469a1c)

Solutions

1. From the BookStack host, curl the discovery URL printed in the message to reproduce the network failure.
2. Fix DNS/routing/firewall so the issuer host is reachable; if in Docker, attach the container to the correct network or use a resolvable name.
3. For self-signed/internal CAs, trust the CA in the container's CA bundle (update-ca-certificates) or configure Guzzle cacert options.
4. Check the IdP is up and responding within the timeout; investigate IdP logs if requests hang.
5. Clear the cache entry 'oidc-discovery::<issuer>' and retry after fixing connectivity.

$discoveryUrl = rtrim(config('oidc.issuer'), '/') . '/.well-known/openid-configuration';
$ch = curl_init($discoveryUrl);
curl_setopt($ch, CURLOPT_NOBODY, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
if (curl_exec($ch) === false) {
    Log::error('Cannot reach IdP discovery URL: ' . curl_error($ch));
}
curl_close($ch);

try {
    $settings->discoverFromIssuer($client, $cache, 15);
} catch (OidcIssuerDiscoveryException $e) {
    Log::error('OIDC discovery HTTP failure: ' . $e->getMessage());
    // fall back to manually configured endpoints or abort login with a clear message
}

When it happens

Trigger: GET {issuer}/.well-known/openid-configuration (or the jwks_uri fetch inside it) throws: unresolvable hostname, connection refused/reset, SSL certificate verification failure, or the 5-second HTTP client timeout in OidcService expiring. Also raised when the cache closure rethrows ClientExceptionInterface.

Common situations: BookStack container cannot reach the IdP (firewall, Docker network, internal-only DNS); self-signed certificate not in the CA bundle; IdP briefly down or slow, exceeding the 5s timeout; typo in the issuer host.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• Error discovering provider settings from issuer at URL {$iss
• Error reading keys from issuer jwks_uri
• OIDC Discovery Error:
• Unexpected issuer value found on discovery response
• errors.ldap_cannot_connect

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/29a8bd3ba58a57be. Report an issue: GitHub.