{"record":{"id":"0170e253ff88b6c6","repo":"alibaba/nacos","slug":"failed-to-initialize-jwt-processor","errorCode":null,"errorMessage":"Failed to initialize JWT processor: ","messagePattern":"Failed to initialize JWT processor: ","errorType":"exception","errorClass":"AccessException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java","lineNumber":135,"sourceCode":"            throw e;\n        } catch (IllegalArgumentException | NullPointerException e) {\n            LOGGER.error(\"Invalid token data: {}\", e.getMessage(), e);\n            throw new AccessException(\"Invalid token format: \" + e.getMessage());\n        } catch (Exception e) {\n            LOGGER.error(\"Unexpected error during token validation: {} - {}\",\n                e.getClass().getSimpleName(), e.getMessage(), e);\n            throw new AccessException(\"Token validation failed: \" + e.getClass().getSimpleName());\n        }\n    }\n    \n    private ConfigurableJWTProcessor<SecurityContext> getJwtProcessor() throws AccessException {\n        if (jwtProcessor == null) {\n            synchronized (this) {\n                if (jwtProcessor == null) {\n                    try {\n                        jwtProcessor = createJwtProcessor(jwksProvider.getJwkSet());\n                    } catch (IOException e) {\n                        throw new AccessException(\n                            \"Failed to initialize JWT processor: \" + e.getMessage());\n                    }\n                }\n            }\n        }\n        return jwtProcessor;\n    }\n    \n    private ConfigurableJWTProcessor<SecurityContext> createJwtProcessor(JWKSet jwkSet) {\n        ConfigurableJWTProcessor<SecurityContext> processor = new DefaultJWTProcessor<>();\n        \n        JWSKeySelector<SecurityContext> keySelector = new JWSVerificationKeySelector<>(\n            SUPPORTED_ALGORITHMS,\n            new ImmutableJWKSet<>(jwkSet));\n        processor.setJWSKeySelector(keySelector);\n        \n        // Configure claims verifier\n        processor.setJWTClaimsSetVerifier(new DefaultJWTClaimsVerifier<>(","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwtTokenValidator.java#L117-L153","documentation":"Thrown during lazy initialization of the JWT processor (getJwtProcessor) when jwksProvider.getJwkSet() raises IOException — the validator could not fetch the signing key set from the IdP's JWKS endpoint, so no signature can be verified.","triggerScenarios":"First (or post-cache-expiry) call to validate() triggers a JWKS fetch that fails: network unreachable, JWKS URI misconfigured/undiscovered, HTTP non-200, or the JWKS body cannot be parsed. JwksProvider wraps these into IOException.","commonSituations":"issuer-uri wrong so OIDC discovery did not yield a jwks_uri; firewall blocks outbound HTTPS to the IdP; IdP JWKS endpoint down or returning HTML; TLS certificate untrusted by the JVM; DNS resolution failure for the IdP host.","solutions":["Verify issuer-uri is correct and that /.well-known/openid-configuration returns a valid jwks_uri.","From the Nacos host, curl the JWKS URI and confirm HTTP 200 with JSON keys.","Check outbound network/firewall/TLS trust to the IdP.","Inspect the appended IOException message ('JWKS URI is not configured', 'status: 503', 'Failed to parse JWKS', etc.).","Ensure the JVM truststore contains the IdP's CA certificate."],"exampleFix":"# before\nnacos.plugin.auth.oidc.issuer-uri=https://idp.example.com\n# discovery returns jwks_uri the server cannot reach\n\n# after: confirm and fix reachability\n# curl -v https://idp.example.com/.well-known/openid-configuration\n# curl -v <jwks_uri from discovery>  -> must return {\"keys\":[...]}\n# import IdP CA into JVM truststore if TLS fails","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    validator.validate(token);\n} catch (AccessException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Failed to initialize JWT processor\")) {\n        // JWKS unreachable; surface 503 or retry after network restored\n    }\n    throw e;\n}","preventionTips":["Verify issuer-uri and that discovery returns a reachable jwks_uri before going live.","Ensure outbound HTTPS to the IdP and its CA in the JVM truststore.","Pre-warm the JWKS cache at startup to fail fast on connectivity issues."],"tags":["oidc","jwt","network","jwks","initialization"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}