BookStackApp/BookStack · error · OidcException

OIDC Discovery Error:

Error message

OIDC Discovery Error: 

What it means

OidcService::getProviderSettings() catches OidcIssuerDiscoveryException from discoverFromIssuer() and rethrows it as a generic OidcException prefixed 'OIDC Discovery Error: '. This is the user-facing wrapper for any discovery failure: transport errors, non-JSON discovery documents, issuer mismatch, or unusable JWKS (the appended message carries the underlying cause).

Source

Thrown at app/Access/Oidc/OidcService.php:117

            'clientId'              => $config['client_id'],
            'clientSecret'          => $config['client_secret'],
            'authorizationEndpoint' => $config['authorization_endpoint'],
            'tokenEndpoint'         => $config['token_endpoint'],
            'endSessionEndpoint'    => is_string($config['end_session_endpoint']) ? $config['end_session_endpoint'] : null,
            'userinfoEndpoint'      => $config['userinfo_endpoint'],
        ]);

        // Use keys if configured
        if (!empty($config['jwt_public_key'])) {
            $settings->keys = [$config['jwt_public_key']];
        }

        // Run discovery
        if ($config['discover'] ?? false) {
            try {
                $settings->discoverFromIssuer($this->http->buildClient(5), Cache::store(null), 15);
            } catch (OidcIssuerDiscoveryException $exception) {
                throw new OidcException('OIDC Discovery Error: ' . $exception->getMessage());
            }
        }

        // Prevent use of RP-initiated logout if specifically disabled
        // Or force use of a URL if specifically set.
        if ($config['end_session_endpoint'] === false) {
            $settings->endSessionEndpoint = null;
        } else if (is_string($config['end_session_endpoint'])) {
            $settings->endSessionEndpoint = $config['end_session_endpoint'];
        }

        $settings->validate();

        return $settings;
    }

    /**
     * Load the underlying OpenID Connect Provider.

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Read the text after 'OIDC Discovery Error: ' — it contains the underlying OidcIssuerDiscoveryException cause; apply the matching fix (network, issuer mismatch, JSON, JWKS).
2. Verify OIDC_ISSUER matches the IdP's advertised issuer exactly and the discovery URL returns valid JSON from the BookStack host.
3. Clear the 'oidc-discovery::<issuer>' cache entry (php artisan cache:clear or targeted delete) and retry.
4. If the IdP is temporarily down, wait for recovery or temporarily disable OIDC login and use another auth method.
5. Confirm HTTPS reachability and CA trust from the server (curl the discovery URL).

// Pre-flight: issuer must be https and discovery doc fetchable
$issuer = config('oidc.issuer');
if (!str_starts_with($issuer ?? '', 'https://')) throw new RuntimeException('bad issuer');
$resp = (new \GuzzleHttp\Client(['timeout' => 5]))->get(rtrim($issuer, '/') . '/.well-known/openid-configuration');
json_decode($resp->getBody()->getContents(), true, 512, JSON_THROW_ON_ERROR);

try {
    // login / processAuthorizeResponse / logout
} catch (OidcException $e) {
    if (str_starts_with($e->getMessage(), 'OIDC Discovery Error:')) {
        Log::error($e->getMessage()); // suffix names the root cause: network, JSON, issuer mismatch or JWKS
        abort(503, 'Identity provider discovery is currently unavailable.');
    }
    throw $e;
}

When it happens

Trigger: Thrown during login, processAuthorizeResponse or logout whenever config 'discover' is true and discoverFromIssuer() throws — i.e., the IdP's /.well-known/openid-configuration or jwks could not be fetched, parsed, or did not match the configured issuer.

Common situations: IdP outage or maintenance window; network/DNS/TLS issues from the BookStack host; wrong OIDC_ISSUER; stale cached bad discovery data; Keycloak realm renamed so the issuer no longer matches.

Related errors

• HTTP request failed during discovery with error: {$exception
• Error discovering provider settings from issuer at URL {$iss
• Unexpected issuer value found on discovery response
• Error reading keys from issuer jwks_uri
• Failed to read signing key with error:

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/e484a8b239bc08f7. Report an issue: GitHub.