{"record":{"id":"17eba9b5f2cb92d2","repo":"Budibase/budibase","slug":"configuration-invalid-must-contain-clientid-clie","errorCode":null,"errorMessage":"Configuration invalid. Must contain clientID, clientSecret, callbackUrl and configUrl","messagePattern":"Configuration invalid\\. Must contain clientID, clientSecret, callbackUrl and configUrl","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/backend-core/src/middleware/passport/sso/oidc.ts","lineNumber":228,"sourceCode":"  return normalized !== \"\" && normalized !== \"false\" && normalized !== \"0\"\n}\n\nexport async function fetchStrategyConfig(\n  oidcConfig: OIDCInnerConfig,\n  callbackUrl?: string\n): Promise<OIDCStrategyConfiguration> {\n  try {\n    const {\n      clientID,\n      clientSecret,\n      configUrl,\n      pkce,\n      allowUnverifiedEmailLinking,\n    } = oidcConfig\n\n    if (!clientID || !clientSecret || !callbackUrl || !configUrl) {\n      // check for remote config and all required elements\n      throw new Error(\n        \"Configuration invalid. Must contain clientID, clientSecret, callbackUrl and configUrl\"\n      )\n    }\n\n    const response = await fetch(configUrl)\n\n    if (!response.ok) {\n      throw new Error(\n        `Unexpected response when fetching openid-configuration: ${response.statusText}`\n      )\n    }\n\n    const body = await response.json()\n\n    return {\n      issuer: body.issuer,\n      authorizationURL: body.authorization_endpoint,\n      tokenURL: body.token_endpoint,","sourceCodeStart":210,"sourceCodeEnd":246,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/backend-core/src/middleware/passport/sso/oidc.ts#L210-L246","documentation":"fetchStrategyConfig validates that the OIDC provider config contains clientID, clientSecret, callbackUrl and configUrl before fetching the remote openid-configuration document. If any of these is falsy the config is considered invalid and this error is thrown instead of issuing a doomed fetch.","triggerScenarios":"enrichedConfig or refreshOIDCAccessToken invoked with a saved provider whose clientID, clientSecret, callbackUrl or configUrl is empty/undefined — e.g. a partially saved provider config or missing configUrl field.","commonSituations":"SSO provider created through an API/script that skipped required fields; configUrl never set because the discovery URL step was skipped in admin setup; DB doc partially migrated leaving fields undefined; copy/paste dropping the secret.","solutions":["Open the SSO/OIDC provider configuration and fill in all four required fields: clientID, clientSecret, callbackUrl and configUrl","If updating via API/DB, verify the saved config document includes every required field before calling refresh/enrich","Re-create the OIDC provider config from scratch if the stored doc is malformed","Ensure the discovery/configUrl points to the IdP's .well-known/openid-configuration endpoint"],"exampleFix":"// before\n{ clientID: \"abc\", callbackUrl: \"https://x/cb\" } // missing clientSecret & configUrl\n// after\n{ clientID: \"abc\", clientSecret: \"secret\", callbackUrl: \"https://x/cb\", configUrl: \"https://idp.example.com/.well-known/openid-configuration\" }","handlingStrategy":"validation","validationCode":"function assertOidcFields(cfg) {\n  const required = [\"clientID\", \"clientSecret\", \"callbackUrl\", \"configUrl\"]\n  const missing = required.filter(k => !cfg?.[k])\n  if (missing.length) throw new Error(`OIDC config missing: ${missing.join(\", \")}`)\n}","typeGuard":"function hasRequiredOidcFields(cfg): cfg is { clientID: string; clientSecret: string; callbackUrl: string; configUrl: string } {\n  return Boolean(cfg?.clientID && cfg?.clientSecret && cfg?.callbackUrl && cfg?.configUrl)\n}","tryCatchPattern":"try {\n  const enriched = await enrichedConfig(provider)\n} catch (err) {\n  if (String(err.message).includes(\"Configuration invalid. Must contain\")) {\n    // re-open provider settings and fill the missing required fields\n  }\n}","preventionTips":["Never save an OIDC provider doc without all four required fields","Add a pre-save validation step for provider configs created via API/scripts","Check the stored config document after any DB migration or manual edit","Keep the discovery configUrl alongside credentials in one save operation"],"tags":["sso","oidc","configuration","validation"],"backgroundTag":"sso-provider-configuration-invalid","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}