{"record":{"id":"1e6c40d0b3bbce94","repo":"Hmbown/CodeWhale","slug":"name-oidc-discovery-failed-with-http-status","errorCode":null,"errorMessage":"{name} OIDC discovery failed with HTTP {status}","messagePattern":"(.+?) OIDC discovery failed with HTTP (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/oauth.rs","lineNumber":638,"sourceCode":"\nfn discover_oauth_endpoints(params: &OAuthProviderParams, issuer: &str) -> Result<OAuthEndpoints> {\n    let name = params.display_name;\n    let discovery_url = oauth_endpoint_url(&format!(\n        \"{}/.well-known/openid-configuration\",\n        issuer.trim_end_matches('/')\n    ))?;\n    let client = oauth_http_client(\"OIDC discovery\")?;\n    #[cfg(test)]\n    crate::external_credentials::record_oauth_network();\n    let response = client\n        .get(discovery_url)\n        .header(reqwest::header::ACCEPT, \"application/json\")\n        .send()\n        .with_context(|| format!(\"{name} OIDC discovery request failed\"))?;\n    let (status, discovery): (_, OidcDiscoveryDocument) =\n        parse_oauth_json(response, &format!(\"{name} OIDC discovery\"))?;\n    if !status.is_success() {\n        bail!(\"{name} OIDC discovery failed with HTTP {status}\");\n    }\n    validate_discovered_issuer(discovery.issuer, issuer)\n        .with_context(|| format!(\"{name} OIDC discovery\"))?;\n    Ok(OAuthEndpoints {\n        device_authorization_endpoint: params\n            .device_code_path\n            .map(|_| {\n                validate_discovered_oauth_endpoint(\n                    discovery.device_authorization_endpoint,\n                    \"device_authorization_endpoint\",\n                    issuer,\n                )\n            })\n            .transpose()?,\n        token_endpoint: validate_discovered_oauth_endpoint(\n            discovery.token_endpoint,\n            \"token_endpoint\",\n            issuer,","sourceCodeStart":620,"sourceCodeEnd":656,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/oauth.rs#L620-L656","documentation":"The OAuth/OIDC discovery document was fetched from the provider, but the HTTP response status was not a success. The discovery request itself completed (parse succeeded context-wise), yet the server rejected the request with a non-2xx status, so no endpoints can be resolved.","triggerScenarios":"discover_oauth_endpoints performing the OIDC well-known discovery GET and receiving a non-success HTTP status (e.g. 404 for a wrong issuer URL, 403, 5xx).","commonSituations":"Misconfigured issuer base URL in provider config; provider behind a proxy that returns errors; provider outage; wrong tenant/realm in the issuer path (e.g. wrong Keycloak realm).","solutions":["Verify the issuer URL is correct, including tenant/realm path and scheme.","Curl the provider's well-known discovery URL and inspect the returned status/body.","Check provider status/outage pages or proxy logs if the URL looks right.","Fall back to documented-path endpoints (no discovery) if the provider config supports them."],"exampleFix":"// before\nissuer = \"https://auth.example.com/wrong-realm\" // discovery failed with HTTP 404\n// after\nissuer = \"https://auth.example.com/realms/correct\" // discovery succeeds","handlingStrategy":"retry","validationCode":"let status = reqwest::get(format!(\"{issuer}/.well-known/openid-configuration\")).await?.status();\nif !status.is_success() { eprintln!(\"issuer discovery endpoint returned {status}\"); }","typeGuard":null,"tryCatchPattern":"match discover_oauth_endpoints(...).await {\n    Ok(endpoints) => endpoints,\n    Err(e) if e.to_string().contains(\"discovery failed with HTTP\") => {\n        tokio::time::sleep(Duration::from_secs(2)).await; // retry transient 5xx\n        discover_oauth_endpoints(...).await?\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Verify the issuer URL (scheme, host, tenant/realm path) with curl before wiring it into config.","Retry with backoff only for 5xx; 4xx means fix the URL.","Monitor provider status pages for outages.","Validate provider config at startup, not mid-flow."],"tags":["oauth","oidc","http","discovery","network"],"backgroundTag":"http-error-response","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}