Budibase/budibase · error

Configuration invalid. Must contain clientID, clientSecret,

Error message

Configuration invalid. Must contain clientID, clientSecret, callbackUrl and configUrl

What it means

fetchStrategyConfig validates that the OIDC provider config contains clientID, clientSecret, callbackUrl and configUrl before fetching the remote openid-configuration document. If any of these is falsy the config is considered invalid and this error is thrown instead of issuing a doomed fetch.

Source

Thrown at packages/backend-core/src/middleware/passport/sso/oidc.ts:228

  return normalized !== "" && normalized !== "false" && normalized !== "0"
}

export async function fetchStrategyConfig(
  oidcConfig: OIDCInnerConfig,
  callbackUrl?: string
): Promise<OIDCStrategyConfiguration> {
  try {
    const {
      clientID,
      clientSecret,
      configUrl,
      pkce,
      allowUnverifiedEmailLinking,
    } = oidcConfig

    if (!clientID || !clientSecret || !callbackUrl || !configUrl) {
      // check for remote config and all required elements
      throw new Error(
        "Configuration invalid. Must contain clientID, clientSecret, callbackUrl and configUrl"
      )
    }

    const response = await fetch(configUrl)

    if (!response.ok) {
      throw new Error(
        `Unexpected response when fetching openid-configuration: ${response.statusText}`
      )
    }

    const body = await response.json()

    return {
      issuer: body.issuer,
      authorizationURL: body.authorization_endpoint,
      tokenURL: body.token_endpoint,

View on GitHub (pinned to a81a902e9a)

Solutions

1. Open the SSO/OIDC provider configuration and fill in all four required fields: clientID, clientSecret, callbackUrl and configUrl
2. If updating via API/DB, verify the saved config document includes every required field before calling refresh/enrich
3. Re-create the OIDC provider config from scratch if the stored doc is malformed
4. Ensure the discovery/configUrl points to the IdP's .well-known/openid-configuration endpoint

Example fix

// before
{ clientID: "abc", callbackUrl: "https://x/cb" } // missing clientSecret & configUrl
// after
{ clientID: "abc", clientSecret: "secret", callbackUrl: "https://x/cb", configUrl: "https://idp.example.com/.well-known/openid-configuration" }

function assertOidcFields(cfg) {
  const required = ["clientID", "clientSecret", "callbackUrl", "configUrl"]
  const missing = required.filter(k => !cfg?.[k])
  if (missing.length) throw new Error(`OIDC config missing: ${missing.join(", ")}`)
}

function hasRequiredOidcFields(cfg): cfg is { clientID: string; clientSecret: string; callbackUrl: string; configUrl: string } {
  return Boolean(cfg?.clientID && cfg?.clientSecret && cfg?.callbackUrl && cfg?.configUrl)
}

try {
  const enriched = await enrichedConfig(provider)
} catch (err) {
  if (String(err.message).includes("Configuration invalid. Must contain")) {
    // re-open provider settings and fill the missing required fields
  }
}

When it happens

Trigger: enrichedConfig or refreshOIDCAccessToken invoked with a saved provider whose clientID, clientSecret, callbackUrl or configUrl is empty/undefined — e.g. a partially saved provider config or missing configUrl field.

Common situations: SSO provider created through an API/script that skipped required fields; configUrl never set because the discovery URL step was skipped in admin setup; DB doc partially migrated leaving fields undefined; copy/paste dropping the secret.

Related errors

• Error constructing OIDC authentication strategy - ${err}
• Cannot enforce SSO without an activated configuration
• Configuration cannot be deactivated while SSO is enforced
• Configuration invalid. Must contain google clientID and clie
• Error constructing google authentication strategy: ${err}

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/17eba9b5f2cb92d2. Report an issue: GitHub.