{"record":{"id":"286623c94e17b64d","repo":"rancher/rancher","slug":"creating-oidc-login-url-w","errorCode":null,"errorMessage":"creating OIDC login URL: %w","messagePattern":"creating OIDC login URL: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/providers/oidc/oidc_provider.go","lineNumber":342,"sourceCode":"\t\tp = apiv3.Principal{\n\t\t\tObjectMeta:    metav1.ObjectMeta{Name: principalType + \"://\" + externalID},\n\t\t\tDisplayName:   externalID,\n\t\t\tLoginName:     externalID,\n\t\t\tPrincipalType: UserType,\n\t\t\tProvider:      o.Name,\n\t\t}\n\t} else {\n\t\tp = o.groupToPrincipal(externalID)\n\t}\n\tp = o.toPrincipalFromToken(principalType, p, token)\n\treturn p, nil\n}\n\nfunc (o *OpenIDCProvider) TransformToAuthProvider(authConfig map[string]any) (map[string]any, error) {\n\tp := common.TransformToAuthProvider(authConfig)\n\tredirectPath, err := o.getRedirectURL(authConfig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating OIDC login URL: %w\", err)\n\t}\n\n\tp[publicclient.OIDCProviderFieldRedirectURL] = redirectPath\n\n\treturn p, nil\n}\n\ntype urlValues interface {\n\tAdd(_, _ string)\n\tEncode() string\n}\n\n// GetOIDCRedirectionURL generates the URL to redirect to the provider.\n//\n// the Values can either be an `orderedValues` value or a url.Values.\nfunc GetOIDCRedirectionURL(config map[string]any, pkceVerifier string, values urlValues) string {\n\tauthURL, _ := FetchAuthURL(config)\n","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/oidc/oidc_provider.go#L324-L360","documentation":"TransformToAuthProvider builds the provider descriptor shown to clients and computes the login redirect URL via getRedirectURL. Any failure there (in practice, url.JoinPath failing on a malformed rancherAPIHost value, since the no-API-host path ignores discovery errors) is wrapped as 'creating OIDC login URL'.","triggerScenarios":"The authConfig contains a rancherAPIHost that is not a parseable URL base (bad scheme, control chars), so url.JoinPath(rancherAPIHost, \"v1-oidc\", name) errors. Additionally, getRedirectURL type-asserts authConfig[\"metadata\"][\"name\"] without ok-checks, so a missing metadata.name panics nearby.","commonSituations":"Setting the server's API host/AppliedEndpointRef-driven field to a malformed value; proxies rewriting the API host; a hand-edited authconfig missing metadata.name.","solutions":["Set a valid absolute rancherAPIHost (scheme + host, e.g. https://rancher.example.com) and re-test","Verify the authconfig object still carries metadata.name","If rancherAPIHost is intentionally unset, remove the key entirely rather than leaving a malformed value"],"exampleFix":"# before\nrancherAPIHost: \"rancher.example.com\"   # no scheme, JoinPath fails\n\n# after\nrancherAPIHost: \"https://rancher.example.com\"","handlingStrategy":"validation","validationCode":"func validateAuthProviderConfig(authConfig map[string]any) error {\n    meta, ok := authConfig[\"metadata\"].(map[string]any)\n    if !ok || meta[\"name\"] == nil {\n        return errors.New(\"authConfig requires metadata.name (getRedirectURL asserts it)\")\n    }\n    if host, ok := authConfig[\"rancherAPIHost\"].(string); ok && host != \"\" {\n        u, err := url.Parse(host)\n        if err != nil || !u.IsAbs() || u.Host == \"\" {\n            return fmt.Errorf(\"rancherAPIHost must be an absolute URL, got %q\", host)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"providerConfig, err := provider.TransformToAuthProvider(authConfig)\nif err != nil && strings.Contains(err.Error(), \"creating OIDC login URL\") {\n    // inspect rancherAPIHost in authConfig; JoinPath rejected it\n    return err\n}","preventionTips":["Validate rancherAPIHost as an absolute URL before it is stored or used","Always keep metadata.name on authconfig objects","Prefer setting the server URL through the supported setting rather than raw field edits"],"tags":["oidc","configuration","url","login"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}