alibaba/nacos · error · IOException

Failed to parse OIDC configuration

Error message

Failed to parse OIDC configuration

What it means

A catch-all wrapping any RuntimeException raised during discovery parsing — e.g. a JSON deserialization error from JsonUtils, a ClassCastException, or an NPE while reading fields. The original exception is attached as the cause.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/config/OidcProviderMetadataProvider.java:116

            Map<String, Object> values = JsonUtils.toObj(response.body(), Map.class);
            if (values == null) {
                throw new IOException("OIDC discovery response is empty");
            }
            OidcProviderMetadata result = new OidcProviderMetadata(
                stringValue(values, OidcProtocolConstants.DISCOVERY_AUTHORIZATION_ENDPOINT),
                stringValue(values, OidcProtocolConstants.DISCOVERY_TOKEN_ENDPOINT),
                stringValue(values, OidcProtocolConstants.DISCOVERY_USERINFO_ENDPOINT),
                stringValue(values, OidcProtocolConstants.DISCOVERY_END_SESSION_ENDPOINT),
                stringValue(values, OidcProtocolConstants.DISCOVERY_JWKS_URI));
            LOGGER.info("OIDC configuration discovered: jwksUri={}", result.getJwksUri());
            return result;
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            throw new IOException("OIDC discovery interrupted", e);
        } catch (IOException e) {
            throw e;
        } catch (RuntimeException e) {
            throw new IOException("Failed to parse OIDC configuration", e);
        }
    }
    
    private String stringValue(Map<String, Object> values, String key) {
        Object value = values.get(key);
        return value == null ? null : value.toString();
    }
    
    private String trimTrailingSlash(String value) {
        int end = value.length();
        while (end > 0 && value.charAt(end - 1) == '/') {
            end--;
        }
        return value.substring(0, end);
    }
}

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Inspect the wrapped cause exception for the exact parse failure.
2. curl the discovery URL and verify the body is valid JSON with the OIDC endpoint fields.
3. Ensure no proxy/CDN injects HTML error pages with a 200 status.
4. Confirm issuer-uri points to the real OIDC discovery endpoint, not a web UI.

// Pre-flight: confirm the discovery body is valid JSON before trusting it
// (parse the curl'd body with a JSON parser and assert it is an object with endpoint fields)

try {
    metadataProvider.getMetadata();
} catch (IOException e) {
    if ("Failed to parse OIDC configuration".equals(e.getMessage())) {
        Throwable cause = e.getCause();
        log.error("Discovery body unparseable: {}", cause == null ? "?" : cause.toString());
    }
    throw e;
}

When it happens

Trigger: Discovery returned 200 and a non-null body, but the body is malformed JSON or has unexpected types, so JsonUtils.toObj throws a runtime exception while building the Map.

Common situations: Discovery endpoint returns HTML/text instead of JSON (e.g. an error page); JSON contains nested structures incompatible with Map<String,Object>; partial/garbled response from a proxy.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• OIDC discovery response is empty
• Failed to discover OIDC configuration, status:
• OIDC discovery interrupted
• Failed to parse JWKS
• Authorization endpoint not configured

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/3cd40513cbbbb382. Report an issue: GitHub.