Budibase/budibase · error

Unexpected response when fetching openid-configuration

Error message

Unexpected response when fetching openid-configuration: ${response.statusText}

What it means

After fetching the OIDC discovery document (openid-configuration) from configUrl, fetchStrategyConfig checks response.ok. Any non-2xx HTTP status causes this error with the statusText embedded. It indicates the IdP's discovery endpoint refused the request rather than returning metadata.

Solutions

1. Verify configUrl returns 200 when curled from the Budibase server host (network/DNS/firewall can differ from your laptop)
2. Check the statusText in the message: 404 → fix the discovery URL/realm name; 401/403 → remove auth requirements or allowlist the server IP
3. Confirm the IdP service is up and serving /.well-known/openid-configuration
4. Retry after transient IdP downtime, especially if this surfaced during refreshOIDCAccessToken

Example fix

// before
configUrl: "https://keycloak.example.com/realms/wrong/.well-known/openid-configuration" // 404
// after
configUrl: "https://keycloak.example.com/realms/master/.well-known/openid-configuration"

async function discoveryReachable(configUrl) {
  try {
    const res = await fetch(configUrl)
    return res.ok
  } catch {
    return false
  }
}

try {
  await enrichedConfig(provider)
} catch (err) {
  if (String(err.message).startsWith("Unexpected response when fetching openid-configuration")) {
    // exponential backoff retry for transient 5xx; alert on persistent 401/403/404
  }
}

When it happens

Trigger: fetch(configUrl) returns 401/403/404/500 — e.g. wrong discovery URL, IdP requiring auth or IP allowlisting, or the IdP being down.

Common situations: configUrl typo (404); self-hosted Keycloak realm name wrong in the URL; corporate firewall blocking the server's outbound request; IdP temporarily unavailable during login or token refresh.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• Error constructing OIDC authentication configuration
• Error
• Error fetching agent log detail
• Error fetching agent session detail
• Error fetching oauth2 token

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/88a834a59216f540. Report an issue: GitHub.

Appendix: source

Thrown at packages/backend-core/src/middleware/passport/sso/oidc.ts:236

    const {
      clientID,
      clientSecret,
      configUrl,
      pkce,
      allowUnverifiedEmailLinking,
    } = oidcConfig

    if (!clientID || !clientSecret || !callbackUrl || !configUrl) {
      // check for remote config and all required elements
      throw new Error(
        "Configuration invalid. Must contain clientID, clientSecret, callbackUrl and configUrl"
      )
    }

    const response = await fetch(configUrl)

    if (!response.ok) {
      throw new Error(
        `Unexpected response when fetching openid-configuration: ${response.statusText}`
      )
    }

    const body = await response.json()

    return {
      issuer: body.issuer,
      authorizationURL: body.authorization_endpoint,
      tokenURL: body.token_endpoint,
      userInfoURL: body.userinfo_endpoint,
      clientID: clientID,
      clientSecret: clientSecret,
      callbackURL: callbackUrl,
      pkce: pkce,
      allowUnverifiedEmailLinking: resolveAllowUnverifiedEmailLinking(
        allowUnverifiedEmailLinking
      ),

View on GitHub (pinned to a81a902e9a)