{"record":{"id":"0a216cdf2ba57bd6","repo":"googleapis/mcp-toolbox","slug":"issuer-not-found-in-config","errorCode":null,"errorMessage":"issuer not found in config","messagePattern":"issuer not found in config","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":163,"sourceCode":"\t}\n\n\t// Limit read size to 1MB to prevent memory exhaustion\n\tbody, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tvar config struct {\n\t\tIssuer                string `json:\"issuer\"`\n\t\tJwksUri               string `json:\"jwks_uri\"`\n\t\tIntrospectionEndpoint string `json:\"introspection_endpoint\"`\n\t}\n\tif err := json.Unmarshal(body, &config); err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tif config.Issuer == \"\" {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"issuer not found in config\")\n\t}\n\n\tif config.JwksUri == \"\" {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"jwks_uri not found in config\")\n\t}\n\n\t// Sanitize the resulting JWKS URI before returning it\n\tparsedJWKS, err := url.Parse(config.JwksUri)\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"invalid jwks_uri detected\")\n\t}\n\tif parsedJWKS.Scheme != \"https\" {\n\t\tlog.Printf(\"WARNING: HTTP instead of HTTPS is being used for JWKS URI: %s\", config.JwksUri)\n\t}\n\n\treturn config.JwksUri, config.IntrospectionEndpoint, config.Issuer, nil\n}\n","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L145-L181","documentation":"The discovery document was fetched and parsed as JSON, but the required 'issuer' field was empty or absent. OIDC discovery mandates an issuer claim; without it the library cannot later validate token iss values, so initialization fails.","triggerScenarios":"The response body from .well-known/openid-configuration unmarshals successfully but config.Issuer == \"\" — the endpoint returned JSON without an issuer key, or returned valid JSON that is not an OIDC discovery document (e.g. an HTML-to-JSON error page would actually fail earlier at json.Unmarshal).","commonSituations":"Pointing authorizationServer at a URL that serves some other JSON (API root, error JSON); a non-standard auth server that omits issuer; a proxy serving a cached/empty document.","solutions":["curl the discovery URL and confirm the JSON contains a non-empty \"issuer\" field","Point authorizationServer at the actual OIDC provider root, not an API base path","Fix or replace the non-compliant auth server configuration","Verify no proxy is rewriting/stripping the response body"],"exampleFix":"// before (endpoint serves non-OIDC JSON)\nauthorizationServer: \"https://api.example.com\"\n// after\nauthorizationServer: \"https://auth.example.com\"","handlingStrategy":"validation","validationCode":"body, err := http.Get(cfg.AuthorizationServer + \"/.well-known/openid-configuration\")\n// then decode and check:\nvar doc struct{ Issuer string `json:\"issuer\"` }\njson.NewDecoder(body.Body).Decode(&doc)\nif doc.Issuer == \"\" {\n    return fmt.Errorf(\"discovery doc from %s has no issuer; not a valid OIDC provider\", cfg.AuthorizationServer)\n}","typeGuard":null,"tryCatchPattern":"_, err := cfg.Initialize()\nif err != nil && strings.Contains(err.Error(), \"issuer not found in config\") {\n    log.Fatalf(\"authorizationServer is not serving a compliant OIDC discovery doc: %v\", err)\n}","preventionTips":["Point authorizationServer at the real OIDC provider root, not an API or landing URL","Curl the discovery endpoint and eyeball the JSON before wiring it into config","Prefer well-known spec-compliant providers"],"tags":["go","oidc","discovery","config"],"backgroundTag":"oidc-discovery-invalid","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}