alibaba/nacos · error · IOException

OIDC discovery response is empty

Error message

OIDC discovery response is empty

What it means

Thrown when the discovery HTTP response parsed to null — i.e. JsonUtils.toObj(body, Map.class) returned null. This means the body was empty, the literal 'null', or could not deserialize into a Map (yielding null).

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/config/OidcProviderMetadataProvider.java:100

        String issuerUri = config.getIssuerUri();
        if (StringUtils.isBlank(issuerUri)) {
            throw new IOException("Issuer URI is not configured");
        }
        String discoveryUrl = trimTrailingSlash(issuerUri)
            + OidcProtocolConstants.WELL_KNOWN_PATH;
        LOGGER.info("Discovering OIDC configuration from: {}", discoveryUrl);
        try {
            HttpRequest request = HttpRequest.newBuilder().uri(URI.create(discoveryUrl))
                .header("Accept", "application/json").timeout(DISCOVERY_TIMEOUT).GET().build();
            HttpResponse<String> response =
                httpClient.send(request, HttpResponse.BodyHandlers.ofString());
            if (response.statusCode() != OidcProtocolConstants.HTTP_STATUS_OK) {
                throw new IOException("Failed to discover OIDC configuration, status: "
                    + response.statusCode());
            }
            Map<String, Object> values = JsonUtils.toObj(response.body(), Map.class);
            if (values == null) {
                throw new IOException("OIDC discovery response is empty");
            }
            OidcProviderMetadata result = new OidcProviderMetadata(
                stringValue(values, OidcProtocolConstants.DISCOVERY_AUTHORIZATION_ENDPOINT),
                stringValue(values, OidcProtocolConstants.DISCOVERY_TOKEN_ENDPOINT),
                stringValue(values, OidcProtocolConstants.DISCOVERY_USERINFO_ENDPOINT),
                stringValue(values, OidcProtocolConstants.DISCOVERY_END_SESSION_ENDPOINT),
                stringValue(values, OidcProtocolConstants.DISCOVERY_JWKS_URI));
            LOGGER.info("OIDC configuration discovered: jwksUri={}", result.getJwksUri());
            return result;
        } catch (InterruptedException e) {
            Thread.currentThread().interrupt();
            throw new IOException("OIDC discovery interrupted", e);
        } catch (IOException e) {
            throw e;
        } catch (RuntimeException e) {
            throw new IOException("Failed to parse OIDC configuration", e);
        }
    }

View on GitHub (pinned to 9b989acdf1)

Solutions

1. curl the discovery URL and confirm the body is a non-empty JSON object containing the OIDC endpoint fields.
2. If the body is empty, investigate the IdP/proxy returning an empty 200.
3. Ensure issuer-uri points to a genuine OIDC discovery endpoint.

// Probe discovery body is a non-empty JSON object before accepting it
// (curl <issuer>/.well-known/openid-configuration and assert body starts with '{')

try {
    metadataProvider.getMetadata();
} catch (IOException e) {
    if ("OIDC discovery response is empty".equals(e.getMessage())) {
        log.error("IdP returned empty discovery body; verify issuer-uri and IdP health");
    }
    throw e;
}

When it happens

Trigger: Discovery endpoint returned HTTP 200 but with an empty body, the literal string 'null', or a JSON scalar (not an object) that deserializes to null when a Map is expected.

Common situations: IdP misconfiguration returning 200 with empty content; a proxy returning an empty 200 on a cached failure; a non-OIDC endpoint that returns a non-object JSON body.

Related errors

• Failed to parse OIDC configuration
• Failed to discover OIDC configuration, status:
• OIDC discovery interrupted
• Failed to parse JWKS
• Authorization endpoint not configured

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/45502836e5cf7f37. Report an issue: GitHub.