SigNoz/signoz · error · errors SigNozError

CodeInvalidInput

CodeInvalidInput

Error message

issuer is required

What it means

Thrown during SamlConfig/OidcConfig UnmarshalJSON (oidc.go) when the issuer field is empty. The issuer URL identifies the OIDC provider and is required to discover endpoints and validate ID tokens.

Source

Thrown at pkg/types/authtypes/oidc.go:43

	ClaimMapping AttributeMapping `json:"claimMapping"`

	// Whether to skip email verification. Defaults to "false"
	InsecureSkipEmailVerified bool `json:"insecureSkipEmailVerified"`

	// Uses the userinfo endpoint to get additional claims for the token. This is especially useful where upstreams return "thin" id tokens
	GetUserInfo bool `json:"getUserInfo"`
}

func (config *OIDCConfig) UnmarshalJSON(data []byte) error {
	type Alias OIDCConfig

	var temp Alias
	if err := json.Unmarshal(data, &temp); err != nil {
		return err
	}

	if temp.Issuer == "" {
		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "issuer is required")
	}

	if temp.ClientID == "" {
		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "clientId is required")
	}

	if temp.ClientSecret == "" {
		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "clientSecret is required")
	}

	if temp.ClaimMapping == (AttributeMapping{}) {
		if err := json.Unmarshal([]byte("{}"), &temp.ClaimMapping); err != nil {
			return err
		}
	}

	*config = OIDCConfig(temp)
	return nil

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Set issuer to your provider's issuer URL, e.g. https://accounts.google.com or https://your-tenant.okta.com/oauth2/default
2. Confirm the issuer matches exactly what the provider advertises in its discovery document

Example fix

// before
{"clientId": "abc", "clientSecret": "xyz"}
// after
{"issuer": "https://keycloak.example.com/realms/myrealm", "clientId": "abc", "clientSecret": "xyz"}

if cfg.Issuer == "" { return errors.New("issuer is required") }
if _, err := url.ParseRequestURI(cfg.Issuer); err != nil { return errors.New("issuer must be a valid URL") }

When it happens

Trigger: POST/PUT an OIDC SSO config JSON without an "issuer" field or with an empty string.

Common situations: Setting up OIDC (Okta, Keycloak, Auth0, Azure AD) and pasting only clientId/clientSecret, or omitting the issuer by mistake.

Related errors

• CodeInvalidInput
• CodeInvalidInput
• ErrCodeRoleHasAuthDomainMappings
• ErrCodeInvalidSQLMigratorConfig
• CodeInvalidInput

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/57aece320cbd911e. Report an issue: GitHub.