EpicGames/lore · error · anyhow::Error

[environment.endpoint] auth_url is set but [server.auth] is…

Error message

[environment.endpoint] auth_url is set but [server.auth] is not: without [server.auth] tokens are not verified. Add [server.auth] (jwt_issuer, jwt_audience) to enable verification, or remove auth_url.

What it means

select_repository_authorizer refuses to start when [environment.endpoint] auth_url is configured but [server.auth] is absent. Without [server.auth] (jwt_issuer, jwt_audience), incoming tokens would not be verified at all, so pointing at an external auth service alone is treated as a dangerous misconfiguration and startup bails.

Solutions

Add a [server.auth] section with jwt_issuer and jwt_audience to enable token verification.
Remove the auth_url setting if you intend to authorize purely from token claims or not at all.
Re-run startup validation (validate_auth_config) after editing to confirm the selection succeeds.

Example fix

// before (config)
[environment.endpoint]
auth_url = "https://auth.example.com"
// after (config)
[server.auth]
jwt_issuer = "https://auth.example.com"
jwt_audience = "my-audience"
[environment.endpoint]
auth_url = "https://auth.example.com"

Defensive patterns

Strategy: validation

Validate before calling

// config-load validation
if config.environment.endpoint.auth_url.is_some() && config.server.auth.is_none() {
    return Err(anyhow!("auth_url requires [server.auth] (jwt_issuer, jwt_audience)"));
}

Try / catch

match select_repository_authorizer(&auth_opt, &auth_url_opt) {
    Ok(sel) => start_server(sel),
    Err(e) => { eprintln!("invalid auth config: {e:#}"); std::process::exit(2); }
}

Prevention

Treat [server.auth] as mandatory whenever auth_url is set.
Validate auth config in CI with a startup dry-run.
When removing local JWT verification, remove auth_url at the same time.
Document the auth_url <-> [server.auth] dependency.

When it happens

Trigger: Setting environment.endpoint.auth_url in config while omitting the entire [server.auth] section; then calling select_repository_authorizer (via repository_authorizer startup validation).

Common situations: Operators migrating from an external auth endpoint to local JWT verification and deleting [server.auth] prematurely; copy-pasted endpoint config without the auth section; docs examples showing auth_url alone.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

AI-assisted analysis of EpicGames/lore@074eb0b0d1 (2026-09-13). Data as JSON: /api/errors/c2d3c8ecf161e553. Report an issue: GitHub.

Appendix: source

Thrown at lore-server/src/authnz/repository_authorizer.rs:210

            Self::GlobalGrants => "GlobalGrantsAuthorizer",
            Self::ResourceGrants => "ResourceGrantsAuthorizer",
        })
    }
}

/// The four-way selection:
/// - neither `[server.auth]` nor `auth_url` → allow-all
/// - `auth_url` set → the gRPC online auth check
/// - `resource_claim` set → `ResourceGrants`
/// - otherwise → `GlobalGrants`
pub fn select_repository_authorizer(
    auth: Option<&AuthSettings>,
    auth_url: Option<&str>,
) -> anyhow::Result<AuthorizerSelection> {
    let Some(auth) = auth else {
        return match auth_url {
            None => Ok(AuthorizerSelection::AllowAll),
            Some(_) => bail!(
                "[environment.endpoint] auth_url is set but [server.auth] is not: without \
                 [server.auth] tokens are not verified. Add [server.auth] (jwt_issuer, jwt_audience) \
                 to enable verification, or remove auth_url."
            ),
        };
    };
    match (auth_url, auth.resource_claim.as_deref()) {
        (Some(_), Some(_)) => bail!(
            "[environment.endpoint] auth_url and [server.auth] resource_claim are both set: \
             with auth_url configured, every check calls the auth service and resource_claim \
             does nothing. Remove auth_url to authorize from the token's resource claim, or \
             remove resource_claim to stay on the gRPC auth service."
        ),
        (Some(_), None) => Ok(AuthorizerSelection::AuthClient),
        (None, Some(_)) => Ok(AuthorizerSelection::ResourceGrants),
        (None, None) => Ok(AuthorizerSelection::GlobalGrants),
    }
}

View on GitHub (pinned to 074eb0b0d1)