alibaba/nacos · error · AccessException

Authorization endpoint not configured

Error message

Authorization endpoint not configured

What it means

Thrown by AuthorizationCodeHandler.buildAuthorizationUrl when the OIDC provider metadata's authorization_endpoint is blank. The handler fetches metadata via metadataProvider.getMetadata() and checks the authorization endpoint URL; without it, it cannot construct the redirect URL to the identity provider, so it throws AccessException("Authorization endpoint not configured").

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/AuthorizationCodeHandler.java:111

        this.config = config;
        this.metadataProvider = metadataProvider;
        this.tokenValidator = tokenValidator;
        this.userMapper = userMapper;
        this.secureRandom = secureRandom;
    }
    
    /**
     * Build the authorization URL for redirecting user to IdP.
     *
     * @param redirectUri callback URI after authentication
     * @return authorization URL
     * @throws AccessException if configuration is invalid
     */
    public String buildAuthorizationUrl(String redirectUri) throws AccessException {
        try {
            String authEndpoint = metadataProvider.getMetadata().getAuthorizationEndpoint();
            if (StringUtils.isBlank(authEndpoint)) {
                throw new AccessException("Authorization endpoint not configured");
            }
            
            // Generate nonce for security
            String nonce = generateSecureToken();
            long expirationTime = System.currentTimeMillis() + STATE_EXPIRATION_MS;
            
            // Build self-contained signed state: base64(nonce.expTime.signature)
            // This eliminates the need for server-side state storage (cluster-friendly)
            String state = buildSignedState(nonce, expirationTime);
            
            // Build OIDC authentication request
            AuthenticationRequest authRequest = new AuthenticationRequest.Builder(
                new ResponseType("code"),
                new Scope(config.getScope().split(" ")),
                new ClientID(config.getClientId()),
                URI.create(redirectUri))
                .endpointURI(URI.create(authEndpoint))
                .state(new State(state))

View on GitHub (pinned to 9b989acdf1)

Solutions

  1. Verify the configured OIDC issuer URL is correct and reachable.
  2. Confirm the IdP's /.well-known/openid-configuration returns a JSON with a non-empty authorization_endpoint.
  3. If using static metadata (no discovery), explicitly set the authorization endpoint in the OIDC plugin config.
  4. Check network/firewall rules allow the Nacos server to reach the IdP discovery URL.

Example fix

# before: issuer URL wrong or unreachable, discovery returns no auth endpoint
nacos.plugin.auth.oidc.issuer=https://idp.example.com/wrong

# after: correct issuer, discovery returns authorization_endpoint
nacos.plugin.auth.oidc.issuer=https://idp.example.com/realms/myrealm
Defensive patterns

Strategy: try-catch

Try / catch

try {
    String authUrl = handler.buildAuthorizationUrl(redirectUri);
} catch (AccessException e) {
    if ("Authorization endpoint not configured".equals(e.getMessage())) {
        // fix OIDC issuer/discovery, then retry
    }
}

Prevention

When it happens

Trigger: buildAuthorizationUrl(redirectUri) is called; metadataProvider.getMetadata().getAuthorizationEndpoint() returns null or empty. The OIDC discovery document was unreachable, malformed, or did not advertise an authorization_endpoint.

Common situations: The issuer URL is wrong so OIDC discovery returns no/partial metadata; the IdP's well-known endpoint is down; a custom metadata config omitted the authorization endpoint; network/firewall blocks the discovery call.

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/62a5a86293ca6396. Report an issue: GitHub.