Budibase/budibase · error

Error constructing OIDC authentication strategy - ${err}

Error message

Error constructing OIDC authentication strategy - ${err}

What it means

strategyFactory wraps OIDCStrategy construction in try/catch and rethrows any failure with this prefix. It means the openid-client backed passport OIDC strategy constructor rejected the supplied issuer/client configuration. The original error is appended to the message.

Source

Thrown at packages/backend-core/src/middleware/passport/sso/oidc.ts:193

  return false
}

/**
 * Create an instance of the oidc passport strategy. This wrapper fetches the configuration
 * from couchDB rather than environment variables, using this factory is necessary for dynamically configuring passport.
 * @returns Dynamically configured Passport OIDC Strategy
 */
export async function strategyFactory(
  config: OIDCStrategyConfiguration,
  saveUserFn: SaveSSOUserFunction
) {
  try {
    const verify = buildVerifyFn(saveUserFn, config.allowUnverifiedEmailLinking)
    const strategy = new OIDCStrategy(config, verify)
    strategy.name = "oidc"
    return strategy
  } catch (err: any) {
    throw new Error(`Error constructing OIDC authentication strategy - ${err}`)
  }
}

/**
 * Resolves the effective allowUnverifiedEmailLinking value. A boot-time
 * environment override wins over the per-provider database value when set,
 * otherwise the database value is used.
 */
function resolveAllowUnverifiedEmailLinking(
  configValue?: boolean
): boolean | undefined {
  const override = env.OIDC_ALLOW_UNVERIFIED_EMAIL_LINKING
  if (override === undefined) {
    return configValue
  }
  const normalized = `${override}`.toLowerCase()
  return normalized !== "" && normalized !== "false" && normalized !== "0"
}

View on GitHub (pinned to a81a902e9a)

Solutions

1. Read the appended original error text for the root cause
2. Validate the OIDC issuer URL is reachable and serves /.well-known/openid-configuration
3. Re-enter clientId/clientSecret/issuer/callback URL in the SSO provider config, checking for whitespace and truncation
4. Confirm openid-client / passport dependency versions are consistent after upgrades

async function validateOidcIssuer(issuerUrl) {
  const res = await fetch(new URL(".well-known/openid-configuration", issuerUrl).toString())
  if (!res.ok) throw new Error(`issuer discovery returned ${res.status}`)
  const body = await res.json()
  return Boolean(body.issuer && body.authorization_endpoint && body.token_endpoint)
}

function isOidcStrategyConfig(config): config is Required<OidcConfig> {
  return Boolean(config && typeof config.issuer === "string" && typeof config.clientID === "string" && typeof config.clientSecret === "string")
}

try {
  const strategy = await strategyFactory(config)
} catch (err) {
  if (String(err.message).startsWith("Error constructing OIDC authentication strategy")) {
    // inspect text after '-' for the underlying openid-client error
  }
}

When it happens

Trigger: new OIDCStrategy(config, verify) throwing due to an invalid issuer, malformed clientID/secret, bad config shape, or an openid-client initialization failure (e.g. unreachable issuer metadata when the strategy validates it).

Common situations: OIDC provider saved with a typo in issuer or client secret; issuer URL unreachable at construction time; mismatch between saved config schema and the strategy version; allowUnverifiedEmailLinking passed with a wrong type.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Error constructing google authentication strategy: ${err}
• Configuration invalid. Must contain clientID, clientSecret,
• Configuration cannot be deactivated while SSO is enforced
• Could not determine user email from profile ${JSON.stringify
• Error constructing OIDC authentication configuration - ${err

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/90d72c8509ec4ebe. Report an issue: GitHub.