Tencent/WeKnora · error

OIDC token response missing access_token and id_token

Error message

OIDC token response missing access_token and id_token

What it means

Raised in exchangeOIDCCode when the IdP's token response decodes successfully but contains neither an access_token nor an id_token — the exchange produced no usable credential. Response-shape validation on the OIDC token endpoint output.

Source

Thrown at internal/application/service/user.go:1573

	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Accept", "application/json")

	resp, err := newOIDCHTTPClient().Do(req)
	if err != nil {
		return nil, fmt.Errorf("failed to exchange OIDC code: %w", err)
	}
	defer resp.Body.Close()
	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
		_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 2048))
		return nil, fmt.Errorf("OIDC token exchange failed: status=%d", resp.StatusCode)
	}

	var tokenResp oidcTokenResponse
	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
		return nil, fmt.Errorf("failed to decode OIDC token response: %w", err)
	}
	if strings.TrimSpace(tokenResp.AccessToken) == "" && strings.TrimSpace(tokenResp.IDToken) == "" {
		return nil, errors.New("OIDC token response missing access_token and id_token")
	}
	return &tokenResp, nil
}

func (s *userService) resolveOIDCUserInfo(ctx context.Context, cfg *config.OIDCAuthConfig, tokenResp *oidcTokenResponse) (*types.OIDCUserInfo, error) {
	claims := map[string]interface{}{}
	verifiedFromIDToken := false

	if idToken := strings.TrimSpace(tokenResp.IDToken); idToken != "" {
		if strings.TrimSpace(cfg.JwksURI) == "" {
			if strings.TrimSpace(cfg.UserInfoEndpoint) == "" || strings.TrimSpace(tokenResp.AccessToken) == "" {
				return nil, errors.New("cannot verify OIDC id_token: no jwks_uri configured")
			}
			logger.Warnf(ctx, "OIDC id_token ignored: no jwks_uri configured; relying on userinfo endpoint")
		} else {
			idTokenClaims, err := s.verifyOIDCIDToken(ctx, cfg, idToken)
			if err != nil {
				return nil, fmt.Errorf("OIDC id_token verification failed: %w", err)

View on GitHub (pinned to 988cbb0330)

Solutions

1. Verify the IdP's token endpoint behavior and the client_id/client_secret/redirect_uri configuration
2. Check the error field of the token response — the IdP may be returning an error-shaped body with 2xx

When it happens

Trigger: Thrown at internal/application/service/user.go:1573 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/3c52e926733e76d6. Report an issue: GitHub.