apache/dolphinscheduler · error · ServiceException

ID token is missing required claims

Error message

ID token is missing required claims

What it means

After issuer/audience/expiry pass, validateIdToken constructs an IDTokenClaimsSet from the raw claims; if that constructor throws ParseException, the token lacks required claims (per the OIDC spec: iss, sub, aud, exp, iat). The method logs "Failed to parse ID token claims, required claims may be missing." and throws ServiceException("ID token is missing required claims", e).

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/oidc/OidcAuthenticator.java:300

        if (issuer == null || !issuer.equals(providerMetadata.getIssuer().getValue())) {
            throw new ServiceException(Status.OIDC_ID_TOKEN_ISSUER_INVALID);
        }

        List<String> audiences = claimsSet.getAudience();
        if (audiences == null || !audiences.contains(providerConfig.getClientId())) {
            throw new ServiceException(Status.OIDC_ID_TOKEN_AUDIENCE_INVALID);
        }

        Date expirationTime = claimsSet.getExpirationTime();
        if (expirationTime == null || expirationTime.before(new Date())) {
            throw new ServiceException(Status.OIDC_ID_TOKEN_EXPIRED);
        }

        try {
            return new IDTokenClaimsSet(claimsSet);
        } catch (ParseException e) {
            log.error("Failed to parse ID token claims, required claims may be missing.", e);
            throw new ServiceException("ID token is missing required claims", e);
        }
    }

    /**
     * Get user info from UserInfo endpoint
     */
    private UserInfo getUserInfo(OIDCProviderMetadata providerMetadata, AccessToken accessToken) throws Exception {
        UserInfoRequest userInfoRequest = new UserInfoRequest(
                providerMetadata.getUserInfoEndpointURI(),
                accessToken);

        HTTPResponse httpResponse = userInfoRequest.toHTTPRequest().send();
        UserInfoResponse userInfoResponse = UserInfoResponse.parse(httpResponse);

        if (!userInfoResponse.indicatesSuccess()) {
            log.error("User info request failed: {}", userInfoResponse.toErrorResponse().getErrorObject());
            return null;
        }

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Decode the ID token and verify all required claims (iss, sub, aud, exp, iat) are present; fix the IdP's token/claims configuration to include them.
2. Check whether any intermediate proxy or claims-mapping layer is stripping claims from the token.
3. Confirm the IdP product/version actually conforms to the OIDC Core spec for the id_token claim set.
4. If you control the token mapper (e.g. Keycloak protocol mappers), re-add the missing standard claims.

Example fix

// before: IdP token payload missing required claims
{ "iss": "https://idp", "custom_user": "alice" }

// after: conforming id_token payload
{ "iss": "https://idp", "sub": "alice", "aud": "ds-client", "exp": 1700000000, "iat": 1699999700 }

// verify required OIDC claims exist before constructing IDTokenClaimsSet
List<String> required = List.of("iss", "sub", "aud", "exp", "iat");
for (String claim : required) {
    if (claimsSet.getClaim(claim) == null) {
        throw new IllegalStateException("ID token missing required claim: " + claim);
    }
}

boolean hasRequiredClaims(JWTClaimsSet c) {
    return c.getIssuer() != null && c.getSubject() != null
        && c.getAudience() != null && c.getExpirationTime() != null
        && c.getIssueTime() != null;
}

try {
    return new IDTokenClaimsSet(claimsSet);
} catch (ParseException e) {
    log.error("ID token missing required claims; check IdP claim/protocol-mapper config", e);
    throw new ServiceException("ID token is missing required claims", e);
}

When it happens

Trigger: idTokenClaims -> validateIdToken with an ID token whose claims set is structurally valid JSON but omits mandatory claims (sub, iat, exp, aud, or iss) so new IDTokenClaimsSet(claimsSet) throws ParseException.

Common situations: Non-standard or homegrown identity providers that omit required claims; IdP configured with minimal claim sets; a proxy or token-mapping middleware stripping claims; provider firmware/version that changed its default claim set.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Error parsing ID token claims
• OIDC_ID_TOKEN_ISSUER_INVALID
• OIDC_ID_TOKEN_AUDIENCE_INVALID
• OIDC_ID_TOKEN_EXPIRED
• url can not be null

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/31d517286e011432. Report an issue: GitHub.