Budibase/budibase · error

Error constructing OIDC authentication strategy

Error message

Error constructing OIDC authentication strategy - ${err}

What it means

strategyFactory wraps OIDCStrategy construction in try/catch and rethrows any failure with this prefix. It means the openid-client backed passport OIDC strategy constructor rejected the supplied issuer/client configuration. The original error is appended to the message.

Solutions

1. Read the appended original error text for the root cause
2. Validate the OIDC issuer URL is reachable and serves /.well-known/openid-configuration
3. Re-enter clientId/clientSecret/issuer/callback URL in the SSO provider config, checking for whitespace and truncation
4. Confirm openid-client / passport dependency versions are consistent after upgrades

async function validateOidcIssuer(issuerUrl) {
  const res = await fetch(new URL(".well-known/openid-configuration", issuerUrl).toString())
  if (!res.ok) throw new Error(`issuer discovery returned ${res.status}`)
  const body = await res.json()
  return Boolean(body.issuer && body.authorization_endpoint && body.token_endpoint)
}

function isOidcStrategyConfig(config): config is Required<OidcConfig> {
  return Boolean(config && typeof config.issuer === "string" && typeof config.clientID === "string" && typeof config.clientSecret === "string")
}

try {
  const strategy = await strategyFactory(config)
} catch (err) {
  if (String(err.message).startsWith("Error constructing OIDC authentication strategy")) {
    // inspect text after '-' for the underlying openid-client error
  }
}

When it happens

Trigger: new OIDCStrategy(config, verify) throwing due to an invalid issuer, malformed clientID/secret, bad config shape, or an openid-client initialization failure (e.g. unreachable issuer metadata when the strategy validates it).

Common situations: OIDC provider saved with a typo in issuer or client secret; issuer URL unreachable at construction time; mismatch between saved config schema and the strategy version; allowUnverifiedEmailLinking passed with a wrong type.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Configuration cannot be deactivated while SSO is enforced
• Configuration invalid. Must contain clientID, clientSecret…
• Error constructing google authentication strategy
• Cannot enforce SSO without an activated configuration
• Could not determine user email from profile

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/90d72c8509ec4ebe. Report an issue: GitHub.

Appendix: source

Thrown at packages/backend-core/src/middleware/passport/sso/oidc.ts:193

  return false
}

/**
 * Create an instance of the oidc passport strategy. This wrapper fetches the configuration
 * from couchDB rather than environment variables, using this factory is necessary for dynamically configuring passport.
 * @returns Dynamically configured Passport OIDC Strategy
 */
export async function strategyFactory(
  config: OIDCStrategyConfiguration,
  saveUserFn: SaveSSOUserFunction
) {
  try {
    const verify = buildVerifyFn(saveUserFn, config.allowUnverifiedEmailLinking)
    const strategy = new OIDCStrategy(config, verify)
    strategy.name = "oidc"
    return strategy
  } catch (err: any) {
    throw new Error(`Error constructing OIDC authentication strategy - ${err}`)
  }
}

/**
 * Resolves the effective allowUnverifiedEmailLinking value. A boot-time
 * environment override wins over the per-provider database value when set,
 * otherwise the database value is used.
 */
function resolveAllowUnverifiedEmailLinking(
  configValue?: boolean
): boolean | undefined {
  const override = env.OIDC_ALLOW_UNVERIFIED_EMAIL_LINKING
  if (override === undefined) {
    return configValue
  }
  const normalized = `${override}`.toLowerCase()
  return normalized !== "" && normalized !== "false" && normalized !== "0"
}

View on GitHub (pinned to a81a902e9a)