apache/dolphinscheduler · error · ServiceException

Failed to construct OIDC redirect URI

Error message

Failed to construct OIDC redirect URI

What it means

When building the OIDC redirect URI, a java.net.URISyntaxException is caught and rethrown as ServiceException("Failed to construct OIDC redirect URI"). This means the configured redirect/provider URI is syntactically invalid, so the authorization URL cannot be constructed at all.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/oidc/OidcAuthenticator.java:265

                    codeGrant);

            TokenResponse tokenResponse;
            try {
                tokenResponse = OIDCTokenResponseParser.parse(tokenRequest.toHTTPRequest().send());
            } catch (Exception e) {
                log.error("Failed to send token request", e);
                throw new ServiceException(Status.OIDC_TOKEN_EXCHANGE_FAILED);
            }

            if (!tokenResponse.indicatesSuccess()) {
                log.error("Token request failed: {}", tokenResponse.toErrorResponse().getErrorObject());
                throw new ServiceException(Status.OIDC_TOKEN_EXCHANGE_FAILED);
            }

            return ((OIDCTokenResponse) tokenResponse).getOIDCTokens();
        } catch (java.net.URISyntaxException e) {
            log.error("Invalid redirect URI configured for OIDC provider: {}", providerId, e);
            throw new ServiceException("Failed to construct OIDC redirect URI", e);
        }
    }

    /**
     * Validate ID token and extract claims
     */
    private IDTokenClaimsSet validateIdToken(OIDCProviderMetadata providerMetadata,
                                             OidcProviderConfig providerConfig, JWT idToken) {
        JWTClaimsSet claimsSet;
        try {
            claimsSet = idToken.getJWTClaimsSet();
        } catch (java.text.ParseException e) {
            throw new ServiceException("Error parsing ID token claims", e);
        }

        String issuer = claimsSet.getIssuer();
        if (issuer == null || !issuer.equals(providerMetadata.getIssuer().getValue())) {
            throw new ServiceException(Status.OIDC_ID_TOKEN_ISSUER_INVALID);

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Check the log line 'Invalid redirect URI configured for OIDC provider' for the exact URISyntaxException and offending value
2. Fix the configured redirect URI / provider endpoint to a valid absolute URI (scheme://host[:port]/path, URL-encoded characters)
3. Remove placeholder or whitespace characters from OIDC config in application.yaml / env vars
4. Restart the api-server and retry the login flow

Example fix

// before (application.yaml)
dolphinscheduler:
  security:
    oidc:
      redirect-uri: https://<your-domain>/login
// after
dolphinscheduler:
  security:
    oidc:
      redirect-uri: https://ds.example.com/login

try {
    new URI(configuredRedirectUri);
} catch (URISyntaxException e) {
    throw new IllegalStateException("Invalid configured OIDC redirect URI: " + configuredRedirectUri, e);
}

try {
    loginViaOidc(authorizationCode);
} catch (ServiceException e) {
    if ("Failed to construct OIDC redirect URI".equals(e.getMessage())) {
        log.error("Fix OIDC redirect URI configuration; current value is not a valid URI");
    }
}

When it happens

Trigger: API startup or login flow calls exchangeCodeForTokens where a URI (redirect URI, provider endpoint) built from configuration fails java.net.URI validation — e.g. missing scheme, illegal characters, spaces, or unencoded special characters in configured values.

Common situations: Redirect URI configured with a trailing space or newline in YAML/env config; missing https:// scheme; unencoded characters (Chinese/unicode or spaces) in the domain; placeholder values like '<your-domain>' left in config after a template copy.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

• OIDC_ID_TOKEN_ISSUER_INVALID
• OIDC_ID_TOKEN_AUDIENCE_INVALID
• receivers must not be null
• url can not be null
• headerParams is not a valid json

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/677e6f4a5fee2451. Report an issue: GitHub.