Tencent/WeKnora · error

OIDC discovery_url or explicit endpoints are required

Error message

OIDC discovery_url or explicit endpoints are required

What it means

Raised in populateOIDCEndpoints when discovery is needed (any of authorization/token/jwks/issuer endpoints blank) but DiscoveryURL is also empty — and explicit endpoints are incomplete too, so there is no way to obtain the missing endpoints. Configuration completeness guard.

Source

Thrown at internal/application/service/user.go:1485

	}
	if err := s.populateOIDCEndpoints(ctx, &cfg); err != nil {
		return nil, err
	}
	return &cfg, nil
}

func oidcNeedsDiscovery(cfg *config.OIDCAuthConfig) bool {
	return strings.TrimSpace(cfg.AuthorizationEndpoint) == "" ||
		strings.TrimSpace(cfg.TokenEndpoint) == "" ||
		strings.TrimSpace(cfg.JwksURI) == "" ||
		strings.TrimSpace(cfg.IssuerURL) == ""
}

func (s *userService) populateOIDCEndpoints(ctx context.Context, cfg *config.OIDCAuthConfig) error {
	if oidcNeedsDiscovery(cfg) {
		if strings.TrimSpace(cfg.DiscoveryURL) == "" {
			if strings.TrimSpace(cfg.AuthorizationEndpoint) == "" || strings.TrimSpace(cfg.TokenEndpoint) == "" {
				return errors.New("OIDC discovery_url or explicit endpoints are required")
			}
		} else if err := s.applyOIDCDiscoveryDocument(ctx, cfg); err != nil {
			return err
		}
	}
	if strings.TrimSpace(cfg.AuthorizationEndpoint) == "" || strings.TrimSpace(cfg.TokenEndpoint) == "" {
		return errors.New("OIDC discovery document missing required endpoints")
	}
	return validateOIDCEndpoints(cfg)
}

func (s *userService) applyOIDCDiscoveryDocument(ctx context.Context, cfg *config.OIDCAuthConfig) error {
	if err := validateOIDCEndpoint("discovery", cfg.DiscoveryURL, true); err != nil {
		return err
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, cfg.DiscoveryURL, nil)
	if err != nil {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Set OIDC discovery_url in config, or provide all explicit endpoints (authorization, token, jwks, issuer)
2. Fix the deployment's OIDC settings and restart

When it happens

Trigger: Thrown at internal/application/service/user.go:1485 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/ebd200323cdc2b37. Report an issue: GitHub.