Dokploy/dokploy · error · TRPCError

INTERNAL_SERVER_ERROR

INTERNAL_SERVER_ERROR

Error message

Failed to parse the SSO provider OIDC configuration

What it means

resolveOidcConfig stores the provider's OIDC settings as a JSON string in the oidcConfig column. When JSON.parse of that stored string throws, the service responds with INTERNAL_SERVER_ERROR because the persisted configuration is corrupt. This is a server-side data integrity issue, not a caller error.

Source

Thrown at packages/server/src/services/proprietary/forward-auth.ts:45

import { findDomainById, updateDomainById } from "../domain";

const resolveOidcConfig = (provider: {
	issuer: string;
	oidcConfig: string | null;
}): ForwardAuthOidcConfig => {
	if (!provider.oidcConfig) {
		throw new TRPCError({
			code: "BAD_REQUEST",
			message:
				"Forward-auth requires an OIDC provider — SAML is not supported.",
		});
	}

	let parsed: any;
	try {
		parsed = JSON.parse(provider.oidcConfig);
	} catch {
		throw new TRPCError({
			code: "INTERNAL_SERVER_ERROR",
			message: "Failed to parse the SSO provider OIDC configuration",
		});
	}

	if (!parsed?.clientId || !parsed?.clientSecret) {
		throw new TRPCError({
			code: "BAD_REQUEST",
			message: "SSO provider OIDC config is missing clientId/clientSecret",
		});
	}

	return {
		clientId: parsed.clientId,
		clientSecret: parsed.clientSecret,
		issuer: provider.issuer,
		scopes: parsed.scopes,
		skipDiscovery: parsed.skipDiscovery,

View on GitHub (pinned to 546686ea35)

Solutions

1. Re-save the OIDC provider configuration through the SSO settings UI to rewrite valid JSON
2. If editing the DB directly, validate the oidc_config value with a JSON linter before saving
3. Inspect the column (SELECT oidc_config FROM sso_provider ...) and run it through JSON.parse to confirm

try { JSON.parse(provider.oidcConfig ?? '') } catch { /* re-save provider config before using forward-auth */ }

try { await oidc(provider) } catch (e) { if (e instanceof TRPCError && e.code === 'INTERNAL_SERVER_ERROR') { /* flag provider config as corrupt, force re-setup */ } }

When it happens

Trigger: The ssoProvider.oidcConfig column contains invalid JSON (truncated during save, manually edited, encoding issue), and any forward-auth oidc call attempts to parse it.

Common situations: OIDC config was saved incompletely (request aborted mid-write); manual DB edit broke the JSON; character encoding/escaping issue when the clientId or clientSecret contained quotes or unicode characters.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• BAD_REQUEST
• NOT_FOUND
• PRECONDITION_FAILED

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/f59b25d73f5f713f. Report an issue: GitHub.