PrefectHQ/fastmcp · error · ValueError

Missing required configuration metadata: {attr}

Error message

Missing required configuration metadata: {attr}

What it means

In strict mode, the OIDC proxy validates that all required provider metadata fields were discovered/populated, raising ValueError for the first missing attribute. The message names the missing attribute (issuer, authorization_endpoint, token_endpoint, jwks_uri, or response_types_supported). It guards against running with an incomplete discovery document.

Source

Thrown at fastmcp_slim/fastmcp/server/auth/oidc_proxy.py:128

        None
    )

    code_challenge_methods_supported: Sequence[str] | None = None

    signed_metadata: str | None = None

    @model_validator(mode="after")
    def _enforce_strict(self) -> Self:
        """Enforce strict rules."""
        if not self.strict:
            return self

        def enforce(attr: str, is_url: bool = False) -> None:
            value = getattr(self, attr, None)
            if not value:
                message = f"Missing required configuration metadata: {attr}"
                logger.error(message)
                raise ValueError(message)

            if not is_url or isinstance(value, AnyHttpUrl):
                return

            try:
                AnyHttpUrl(value)
            except Exception as e:
                message = f"Invalid URL for configuration metadata: {attr}"
                logger.error(message)
                raise ValueError(message) from e

        enforce("issuer", True)
        enforce("authorization_endpoint", True)
        enforce("token_endpoint", True)
        enforce("jwks_uri", True)
        enforce("response_types_supported")
        enforce("subject_types_supported")
        enforce("id_token_signing_alg_values_supported")

View on GitHub (pinned to 1f02114297)

Solutions

1. Verify the issuer's discovery URL returns a complete OpenID Connect discovery document (curl it and check for the named field)
2. If the provider is non-compliant, supply the missing metadata explicitly instead of relying on discovery, or disable strict validation if you accept the risk
3. Ensure discovery actually succeeded — check logs for earlier fetch errors

Example fix

// before: strict proxy with non-compliant provider
proxy = OIDCProxy(config_url=..., strict=True)
// after: provide endpoints explicitly or relax strict
proxy = OIDCProxy(config_url=..., strict=False)  # after verifying endpoints manually

required = ["issuer", "authorization_endpoint", "token_endpoint", "jwks_uri", "response_types_supported"]
meta = httpx.get(config_url).json()
missing = [k for k in required if not meta.get(k)]
if missing:
    raise ValueError(f"provider discovery document missing: {missing}")

def is_complete_discovery(meta: dict) -> bool:
    return all(meta.get(k) for k in
        ("issuer", "authorization_endpoint", "token_endpoint", "jwks_uri", "response_types_supported"))

try:
    proxy = OIDCProxy(config_url=..., strict=True)
except ValueError as e:
    logger.error("OIDC metadata incomplete: %s", e)
    raise SystemExit(1)

When it happens

Trigger: Constructing OIDCProxy with strict validation while the fetched/discovered metadata dict lacks a required key — e.g. a non-compliant provider or a failed/partial discovery fetch that fell back to empty values.

Common situations: Provider's /.well-known/openid-configuration omits fields (some UMA/token-only issuers); discovery URL points to the wrong path; network/proxy truncating the discovery response.

Related errors

• OIDC discovery document for issuer {issuer!r} has no jwks_ur
• mode must be 'legacy', 'auto', or one of {list(MODERN_PROTOC
• a custom cache store requires CacheConfig.target_id for Fast
• ClientGroup requires at least one client
• Protocol mode for server {name!r} must be a string

AI-assisted analysis of PrefectHQ/fastmcp@1f02114297 (2026-08-29). Data as JSON: /api/errors/92a32a542a1cb6dd. Report an issue: GitHub.