alibaba/nacos · error · IOException

Issuer URI is not configured

Error message

Issuer URI is not configured

What it means

Thrown by OidcProviderMetadataProvider.discover() when the configured issuer-uri is blank. Discovery needs the issuer root to build the .well-known/openid-configuration URL; without it the URL cannot be constructed.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/config/OidcProviderMetadataProvider.java:84

    public OidcProviderMetadata getMetadata() throws IOException {
        OidcProviderMetadata result = metadata;
        if (result == null) {
            synchronized (this) {
                result = metadata;
                if (result == null) {
                    result = discover();
                    metadata = result;
                }
            }
        }
        return result;
    }
    
    @SuppressWarnings("unchecked")
    private OidcProviderMetadata discover() throws IOException {
        String issuerUri = config.getIssuerUri();
        if (StringUtils.isBlank(issuerUri)) {
            throw new IOException("Issuer URI is not configured");
        }
        String discoveryUrl = trimTrailingSlash(issuerUri)
            + OidcProtocolConstants.WELL_KNOWN_PATH;
        LOGGER.info("Discovering OIDC configuration from: {}", discoveryUrl);
        try {
            HttpRequest request = HttpRequest.newBuilder().uri(URI.create(discoveryUrl))
                .header("Accept", "application/json").timeout(DISCOVERY_TIMEOUT).GET().build();
            HttpResponse<String> response =
                httpClient.send(request, HttpResponse.BodyHandlers.ofString());
            if (response.statusCode() != OidcProtocolConstants.HTTP_STATUS_OK) {
                throw new IOException("Failed to discover OIDC configuration, status: "
                    + response.statusCode());
            }
            Map<String, Object> values = JsonUtils.toObj(response.body(), Map.class);
            if (values == null) {
                throw new IOException("OIDC discovery response is empty");
            }
            OidcProviderMetadata result = new OidcProviderMetadata(

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Set nacos.plugin.auth.oidc.issuer-uri to the OIDC issuer root (e.g. https://keycloak.example.com/realms/myrealm).
2. Confirm OidcAuthPluginConfig.isValid() returns true (requires non-blank issuer-uri and client-id) before enabling OIDC.
3. Verify the config key is spelled exactly 'issuer-uri'.

Example fix

// before: OIDC enabled but issuer-uri missing
nacos.plugin.auth.oidc.client-id=myclient
// after
nacos.plugin.auth.oidc.issuer-uri=https://idp.example.com/realms/myrealm
nacos.plugin.auth.oidc.client-id=myclient

// Fail fast at startup if issuer-uri is missing when OIDC is enabled
if (!config.isValid()) {
    throw new IllegalStateException(
        "OIDC enabled but issuer-uri and/or client-id not configured");
}

try {
    metadataProvider.getMetadata();
} catch (IOException e) {
    if ("Issuer URI is not configured".equals(e.getMessage())) {
        log.error("Set nacos.plugin.auth.oidc.issuer-uri before enabling OIDC");
    }
    throw e;
}

When it happens

Trigger: Any call to getMetadata() (which triggers discover lazily) while config.getIssuerUri() is blank. This happens during the first authorization URL build, token exchange, JWKS fetch, or logout URL build.

Common situations: OIDC auth type selected but issuer-uri never set; issuer-uri key mistyped in config; config source not loaded so the value defaults to empty.

Related errors

• Authorization endpoint not configured
• Token endpoint not configured
• JWKS URI is not configured or discovered
• Nonce not present in ID token. Set 'nacos.plugin.auth.oidc.s
• Failed to sign payload

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/63e0cb7f990e962e. Report an issue: GitHub.