Error constructing OIDC authentication configuration - ${err

Error message

Error constructing OIDC authentication configuration - ${err}

What it means

This is the outer catch of fetchStrategyConfig: any error thrown while building the enriched OIDC configuration (required-field validation, the discovery fetch, JSON parsing of the response, or downstream enrichment like resolving allowUnverifiedEmailLinking) is rewrapped with this prefix. The original error text is appended after the dash.

Source

Thrown at packages/backend-core/src/middleware/passport/sso/oidc.ts:257

    }

    const body = await response.json()

    return {
      issuer: body.issuer,
      authorizationURL: body.authorization_endpoint,
      tokenURL: body.token_endpoint,
      userInfoURL: body.userinfo_endpoint,
      clientID: clientID,
      clientSecret: clientSecret,
      callbackURL: callbackUrl,
      pkce: pkce,
      allowUnverifiedEmailLinking: resolveAllowUnverifiedEmailLinking(
        allowUnverifiedEmailLinking
      ),
    }
  } catch (err) {
    throw new Error(
      `Error constructing OIDC authentication configuration - ${err}`
    )
  }
}

export async function getCallbackUrl() {
  return ssoCallbackUrl(ConfigType.OIDC)
}

View on GitHub (pinned to a81a902e9a)

Solutions

Inspect the text after the dash in the message — it contains the original error (e.g. 'Unexpected response...' or a JSON parse error)
curl configUrl from the server and confirm the body is valid JSON openid-configuration metadata
Check for proxies/WAFs that may intercept the server's outbound request and return HTML
Fix the underlying cause (URL, network, IdP health) and retry the SSO login or token refresh

Example fix

// before
configUrl: "https://idp.example.com/login" // returns HTML login page -> json() throws
// after
configUrl: "https://idp.example.com/.well-known/openid-configuration" // returns JSON

Defensive patterns

Strategy: try-catch

Validate before calling

async function discoveryIsValid(configUrl) {
  const res = await fetch(configUrl)
  if (!res.ok) throw new Error(`discovery HTTP ${res.status}`)
  const body = await res.json() // throws early on non-JSON bodies
  return Boolean(body.authorization_endpoint && body.token_endpoint)
}

Try / catch

try {
  const config = await enrichedConfig(provider)
} catch (err) {
  if (String(err.message).startsWith("Error constructing OIDC authentication configuration")) {
    // the text after '-' names the inner cause: validation, fetch, or JSON parse
  }
}

Prevention

Always point configUrl at the JSON discovery endpoint, never an HTML page
Check for intercepting proxies/WAFs returning HTML to server-side requests
Log response bodies (truncated) on discovery failure for faster diagnosis
Retry transient network failures with backoff in any custom refresh logic

When it happens

Trigger: Anything inside the try block throwing: the field validation error (43), the non-ok fetch error (44), response.json() failing on non-JSON body (e.g. an HTML error page or WAF block page), or unexpected undefined fields in the discovery body.

Common situations: IdP behind a proxy returning HTML instead of JSON; intermittent network failure during discovery; discovery document missing expected endpoints; concurrent refresh of a half-updated provider config.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/778ff7aa728611f8. Report an issue: GitHub.