Tencent/WeKnora · error

OIDC discovery document missing required endpoints

Error message

OIDC discovery document missing required endpoints

What it means

Raised in populateOIDCEndpoints when the discovery document fetched from discovery_url lacks the endpoints required to fill oidcNeedsDiscovery's gaps — the IdP's .well-known/openid-configuration is incomplete or malformed. Remote-metadata validation failure.

Source

Thrown at internal/application/service/user.go:1492

func oidcNeedsDiscovery(cfg *config.OIDCAuthConfig) bool {
	return strings.TrimSpace(cfg.AuthorizationEndpoint) == "" ||
		strings.TrimSpace(cfg.TokenEndpoint) == "" ||
		strings.TrimSpace(cfg.JwksURI) == "" ||
		strings.TrimSpace(cfg.IssuerURL) == ""
}

func (s *userService) populateOIDCEndpoints(ctx context.Context, cfg *config.OIDCAuthConfig) error {
	if oidcNeedsDiscovery(cfg) {
		if strings.TrimSpace(cfg.DiscoveryURL) == "" {
			if strings.TrimSpace(cfg.AuthorizationEndpoint) == "" || strings.TrimSpace(cfg.TokenEndpoint) == "" {
				return errors.New("OIDC discovery_url or explicit endpoints are required")
			}
		} else if err := s.applyOIDCDiscoveryDocument(ctx, cfg); err != nil {
			return err
		}
	}
	if strings.TrimSpace(cfg.AuthorizationEndpoint) == "" || strings.TrimSpace(cfg.TokenEndpoint) == "" {
		return errors.New("OIDC discovery document missing required endpoints")
	}
	return validateOIDCEndpoints(cfg)
}

func (s *userService) applyOIDCDiscoveryDocument(ctx context.Context, cfg *config.OIDCAuthConfig) error {
	if err := validateOIDCEndpoint("discovery", cfg.DiscoveryURL, true); err != nil {
		return err
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, cfg.DiscoveryURL, nil)
	if err != nil {
		return fmt.Errorf("failed to create OIDC discovery request: %w", err)
	}

	resp, err := newOIDCHTTPClient().Do(req)
	if err != nil {
		return fmt.Errorf("failed to load OIDC discovery document: %w", err)
	}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Verify the IdP publishes a complete discovery document with authorization_endpoint, token_endpoint and jwks_uri
2. Supply the missing endpoints explicitly in config instead of relying on discovery

When it happens

Trigger: Thrown at internal/application/service/user.go:1492 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/89878bdd952f3ec4. Report an issue: GitHub.