Tencent/WeKnora · error

cannot verify OIDC id_token: no jwks_uri configured

Error message

cannot verify OIDC id_token: no jwks_uri configured

What it means

Raised in resolveOIDCUserInfo when an id_token is present but no jwks_uri is configured, so its signature cannot be verified. For security the unsigned id_token is never trusted (userinfo also failed or is unavailable), so login is aborted rather than falling back to unverified claims.

Source

Thrown at internal/application/service/user.go:1585

	var tokenResp oidcTokenResponse
	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
		return nil, fmt.Errorf("failed to decode OIDC token response: %w", err)
	}
	if strings.TrimSpace(tokenResp.AccessToken) == "" && strings.TrimSpace(tokenResp.IDToken) == "" {
		return nil, errors.New("OIDC token response missing access_token and id_token")
	}
	return &tokenResp, nil
}

func (s *userService) resolveOIDCUserInfo(ctx context.Context, cfg *config.OIDCAuthConfig, tokenResp *oidcTokenResponse) (*types.OIDCUserInfo, error) {
	claims := map[string]interface{}{}
	verifiedFromIDToken := false

	if idToken := strings.TrimSpace(tokenResp.IDToken); idToken != "" {
		if strings.TrimSpace(cfg.JwksURI) == "" {
			if strings.TrimSpace(cfg.UserInfoEndpoint) == "" || strings.TrimSpace(tokenResp.AccessToken) == "" {
				return nil, errors.New("cannot verify OIDC id_token: no jwks_uri configured")
			}
			logger.Warnf(ctx, "OIDC id_token ignored: no jwks_uri configured; relying on userinfo endpoint")
		} else {
			idTokenClaims, err := s.verifyOIDCIDToken(ctx, cfg, idToken)
			if err != nil {
				return nil, fmt.Errorf("OIDC id_token verification failed: %w", err)
			}
			for k, v := range idTokenClaims {
				claims[k] = v
			}
			verifiedFromIDToken = true
		}
	}

	if strings.TrimSpace(cfg.UserInfoEndpoint) != "" && strings.TrimSpace(tokenResp.AccessToken) != "" {
		userInfoClaims, err := s.fetchOIDCUserInfo(ctx, cfg.UserInfoEndpoint, tokenResp.AccessToken)
		if err != nil {
			if !verifiedFromIDToken {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Configure jwks_uri (or discovery_url that yields it) so id_token signatures can be verified
2. Ensure the userinfo endpoint is reachable so claims come from a trusted source

When it happens

Trigger: Thrown at internal/application/service/user.go:1585 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/5981dcd4cda3020b. Report an issue: GitHub.