{"record":{"id":"37a24abf30ba69cb","repo":"juanfont/headscale","slug":"failed-to-verify-id-token","errorCode":null,"errorMessage":"failed to verify id_token","messagePattern":"failed to verify id_token","errorType":"http","errorClass":"HTTPError","httpStatus":403,"severity":"error","filePath":"hscontrol/oidc.go","lineNumber":505,"sourceCode":"\n\treturn oauth2Token, nil\n}\n\n// extractIDToken extracts the ID token from the oauth2 token.\nfunc (a *AuthProviderOIDC) extractIDToken(\n\tctx context.Context,\n\toauth2Token *oauth2.Token,\n) (*oidc.IDToken, error) {\n\trawIDToken, ok := oauth2Token.Extra(\"id_token\").(string)\n\tif !ok {\n\t\treturn nil, NewHTTPError(http.StatusBadRequest, \"no id_token\", errNoOIDCIDToken)\n\t}\n\n\tverifier := a.oidcProvider.Verifier(&oidc.Config{ClientID: a.cfg.ClientID})\n\n\tidToken, err := verifier.Verify(ctx, rawIDToken)\n\tif err != nil {\n\t\treturn nil, NewHTTPError(http.StatusForbidden, \"failed to verify id_token\", fmt.Errorf(\"verifying ID token: %w\", err))\n\t}\n\n\treturn idToken, nil\n}\n\n// validateOIDCAllowedDomains checks that if AllowedDomains is provided,\n// that the authenticated principal ends with @<alloweddomain>.\nfunc validateOIDCAllowedDomains(\n\tallowedDomains []string,\n\tclaims *types.OIDCClaims,\n) error {\n\tif len(allowedDomains) > 0 {\n\t\tif at := strings.LastIndex(claims.Email, \"@\"); at < 0 ||\n\t\t\t!slices.Contains(allowedDomains, claims.Email[at+1:]) {\n\t\t\treturn NewHTTPError(http.StatusUnauthorized, \"unauthorised domain\", errOIDCAllowedDomains)\n\t\t}\n\t}\n","sourceCodeStart":487,"sourceCodeEnd":523,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/oidc.go#L487-L523","documentation":"Error \"failed to verify id_token\" thrown in juanfont/headscale.","triggerScenarios":"Thrown at hscontrol/oidc.go:505 when the library encounters an invalid state.","commonSituations":"ID token signature or claim verification failed. Check that oidc.issuer matches the provider, clock skew is small, and the provider's signing keys are reachable.","solutions":["Inspect the wrapped error for the underlying cause and correct the failing condition (failed to verify id_token); retry the operation after fixing the input, configuration, or environment."],"exampleFix":"Inspect the wrapped error for the underlying cause and correct the failing condition (failed to verify id_token); retry the operation after fixing the input, configuration, or environment.","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}