SigNoz/signoz · error

ErrCodeAuthDomainInvalidConfig

ErrCodeAuthDomainInvalidConfig

Error message

failed to unmarshal auth domain config

What it means

AuthDomainConfig.UnmarshalJSON first unmarshals the JSON payload into a map[string]json.RawMessage. This error fires when the top-level JSON is malformed or not an object (e.g. an array, bare string, trailing commas), before kind/spec dispatch even happens.

Source

Thrown at pkg/types/authtypes/domain_config.go:117

	}

	mapping := make(map[string]string, len(authDomainConfigVariants))
	for _, variant := range authDomainConfigVariants {
		mapping[variant.kind.StringValue()] = variant.schemaRef
	}

	schema.ExtraProperties["x-signoz-discriminator"] = map[string]any{
		"propertyName": "kind",
		"mapping":      mapping,
	}

	return nil
}

func (typ *AuthDomainConfig) UnmarshalJSON(data []byte) error {
	var raw map[string]json.RawMessage
	if err := json.Unmarshal(data, &raw); err != nil {
		return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "failed to unmarshal auth domain config")
	}

	kindData, ok := raw["kind"]
	if !ok {
		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "kind is required")
	}

	var kind AuthNProvider
	if err := json.Unmarshal(kindData, &kind); err != nil {
		return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "failed to unmarshal kind")
	}

	specData, ok := raw["spec"]
	if !ok {
		return errors.Newf(errors.TypeInvalidInput, ErrCodeAuthDomainInvalidConfig, "spec is required")
	}

	for _, variant := range authDomainConfigVariants {

View on GitHub (pinned to 5069bf80b0)

Solutions

1. Validate the payload with a JSON linter / jq before applying
2. Ensure the document is a single JSON object with kind and spec keys
3. If templating, render the template and jq-empty-check the output

Example fix

// before
raw := []byte(`[{"kind":"ldap","spec":{}}]`)

// after
raw := []byte(`{"kind":"ldap","spec":{}}`)

import "encoding/json"

func validDomainConfigJSON(b []byte) bool {
    var m map[string]json.RawMessage
    return json.Unmarshal(b, &m) == nil
}

var cfg AuthDomainConfig
if err := json.Unmarshal(body, &cfg); err != nil {
    return httpError(400, "auth domain config is not a valid JSON object")
}

When it happens

Trigger: Posting or loading an auth domain config whose body is not valid JSON or not a JSON object, e.g. '[{"kind":...}]' or '{"kind": "ldap",}' with a trailing comma.

Common situations: Hand-editing auth domain config files or Helm values with YAML/JSON syntax slips; clients sending the config wrapped in an extra array; secrets templating injecting invalid JSON.

Related errors

• couldn't unmarshal metric labels json: %w
• ErrCodeInvalidResolver
• ErrCodeInvalidGatewayConfig
• invalid_input
• invalid_config

AI-assisted analysis of SigNoz/signoz@5069bf80b0 (2026-08-28). Data as JSON: /api/errors/3285e086893158bf. Report an issue: GitHub.