What causes "JWKS URI is not configured or discovered" in alibaba/nacos?

Verify the discovery document contains a non-empty jwks_uri field (curl and inspect JSON).

alibaba/nacos · error · IOException

JWKS URI is not configured or discovered

Error message

JWKS URI is not configured or discovered

What it means

Thrown by JwksProvider.fetchJwkSet() when the discovered provider metadata's jwks_uri is blank. JWT validation requires the JWKS endpoint to fetch signing keys; without it tokens cannot be signature-verified.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwksProvider.java:105

            return cached;
        }
    }
    
    /**
     * Force a JWKS refresh for key rotation recovery.
     *
     * @return refreshed JWK set
     * @throws IOException if fetching fails
     */
    public JWKSet refreshJwkSet() throws IOException {
        jwksCache.invalidateAll();
        return getJwkSet();
    }
    
    private JWKSet fetchJwkSet() throws IOException {
        String jwksUri = metadataProvider.getMetadata().getJwksUri();
        if (StringUtils.isBlank(jwksUri)) {
            throw new IOException("JWKS URI is not configured or discovered");
        }
        LOGGER.info("Fetching JWKS from: {}", jwksUri);
        HttpRequest request = HttpRequest.newBuilder().uri(URI.create(jwksUri))
            .header("Accept", "application/json").GET().build();
        try {
            HttpResponse<String> response =
                httpClient.send(request, HttpResponse.BodyHandlers.ofString());
            if (response.statusCode() != OidcProtocolConstants.HTTP_STATUS_OK) {
                throw new IOException("Failed to fetch JWKS, status: " + response.statusCode());
            }
            JWKSet result = JWKSet.parse(response.body());
            LOGGER.info("Successfully fetched JWKS with {} keys", result.getKeys().size());
            return result;
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            throw new IOException("JWKS fetch interrupted", e);
        } catch (ParseException e) {
            throw new IOException("Failed to parse JWKS", e);

View on GitHub (pinned to 9b989acdf1)

Solutions

Verify the discovery document contains a non-empty jwks_uri field (curl and inspect JSON).
If the IdP genuinely lacks discovery-hosted JWKS, switch token-validation-method to 'introspection' (nacos.plugin.auth.oidc.token-validation-method=introspection) so JWKS is not required.
Confirm discovery succeeded (log line 'OIDC configuration discovered: jwksUri=...'); a null jwksUri in the log indicates the field was missing.

Example fix

// before: IdP has no jwks_uri but default jwt validation is used
nacos.plugin.auth.oidc.token-validation-method=jwt
// after: switch to introspection if no JWKS endpoint exists
nacos.plugin.auth.oidc.token-validation-method=introspection

Defensive patterns

Strategy: validation

Validate before calling

// Before JWT validation, confirm jwks_uri is available; else switch validation mode
OidcProviderMetadata meta = metadataProvider.getMetadata();
if (config.isJwtValidation() && StringUtils.isBlank(meta.getJwksUri())) {
    throw new IllegalStateException(
        "token-validation-method=jwt requires jwks_uri in discovery; "
        + "set token-validation-method=introspection if absent");
}

Try / catch

try {
    jwksProvider.getJwkSet();
} catch (IOException e) {
    if ("JWKS URI is not configured or discovered".equals(e.getMessage())) {
        // either fix discovery to include jwks_uri or switch to introspection mode
        log.error("No jwks_uri discovered; consider token-validation-method=introspection");
    }
    throw e;
}

Prevention

Confirm the discovery doc publishes jwks_uri before using jwt validation.
Switch to token-validation-method=introspection if the IdP has no JWKS endpoint.
Log discovered metadata at startup to catch a null jwks_uri early.

When it happens

Trigger: JWT token validation is active (token-validation-method=jwt, the default) and the IdP discovery document omitted jwks_uri, or discovery hasn't populated it. Triggered on the first token validation that needs to fetch keys.

Common situations: IdP discovery doc lacks jwks_uri (non-compliant); discovery partially failed leaving jwks_uri null; using an IdP that exposes keys under a non-standard field; switching to introspection-only but the default jwt mode is still active.

Related errors

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/cf0f971579f2e5c3. Report an issue: GitHub.