{"record":{"id":"3a167b88c775fc4d","repo":"Kareadita/Kavita","slug":"oidc-invalid-authority","errorCode":"oidc-invalid-authority","errorMessage":"oidc-invalid-authority","messagePattern":"oidc-invalid-authority","errorType":"exception","errorClass":"KavitaException","httpStatus":400,"severity":"error","filePath":"Kavita.Services/SettingsService.cs","lineNumber":634,"sourceCode":"\n        var currentConfig = JsonSerializer.Deserialize<OidcConfigDto>(setting.Value)!;\n\n        // Patch Oidc Secret back in if not changed\n        if (\"*\".Repeat(currentConfig.Secret.Length) == updateSettingsDto.OidcConfig.Secret)\n        {\n            updateSettingsDto.OidcConfig.Secret = currentConfig.Secret;\n        }\n\n        var newValue = JsonSerializer.Serialize(updateSettingsDto.OidcConfig);\n        if (setting.Value == newValue) return false;\n\n        if (currentConfig.Authority != updateSettingsDto.OidcConfig.Authority)\n        {\n            // Only check validity if we're changing into a value that would be used\n            if (!string.IsNullOrEmpty(updateSettingsDto.OidcConfig.Authority)\n                && await IsValidAuthority(updateSettingsDto.OidcConfig.Authority + string.Empty) != AuthorityValidationResult.Success)\n            {\n                throw new KavitaException(\"oidc-invalid-authority\");\n            }\n\n            logger.LogWarning(\"OIDC Authority is changing, clearing all external ids\");\n            await oidcService.ClearOidcIds();\n        }\n\n        setting.Value = newValue;\n        unitOfWork.SettingsRepository.Update(setting);\n\n        return true;\n    }\n\n    private void UpdateEmailSettings(ServerSetting setting, ServerSettingDto updateSettingsDto)\n    {\n        if (setting.Key == ServerSettingKey.EmailHost &&\n            updateSettingsDto.SmtpConfig.Host + string.Empty != setting.Value)\n        {\n            setting.Value = updateSettingsDto.SmtpConfig.Host + string.Empty;","sourceCodeStart":616,"sourceCodeEnd":652,"githubUrl":"https://github.com/Kareadita/Kavita/blob/9c3e5400007f8a0282f7d883f2ad5e71716e514d/Kavita.Services/SettingsService.cs#L616-L652","documentation":"Thrown while applying a change to the OIDC Authority. When the authority is changing to a non-empty value, UpdateOidcSettings calls IsValidAuthority, which (in non-dev) requires https, fetches '<authority>/.well-known/openid-configuration', and requires the returned issuer to exactly equal the authority. Any result other than Success (MissingHttps, Failure, InvalidAuthority) causes KavitaException('oidc-invalid-authority'). SettingsController returns HTTP 400 'OIDC authority is invalid'.","triggerScenarios":"POST /api/settings changing oidcConfig.authority to an http URL (production build), an unreachable URL, a URL whose openid-configuration issuer does not match the authority exactly, a URL with a trailing-slash mismatch, or a provider behind a reverse proxy that blocks the server-side fetch (SSRF filter, self-signed cert, network egress restriction).","commonSituations":"Keycloak/Authelia/Authentik where the configured 'issuer' base URL differs from the authority typed; authority with/without trailing slash not matching issuer; corporate proxy blocking outbound fetch; provider temporarily down during save; using http in a production (non-Development) build.","solutions":["Use the exact issuer URL reported by the provider's well-known endpoint (match trailing slash precisely).","Ensure the authority uses https (required outside Development).","Confirm the server can reach '<authority>/.well-known/openid-configuration' (egress/firewall/proxy/SSRF rules, valid TLS certs).","Pre-validate with POST /api/settings/is-valid-authority and only submit the change when it returns Success.","If developing locally, run in Development to relax the https requirement, but switch to https before production."],"exampleFix":"// before\noidcConfig: { authority: 'http://idp.example.com' } // http in prod\n\n// after\noidcConfig: { authority: 'https://idp.example.com/' } // matches issuer exactly","handlingStrategy":"validation","validationCode":"// Pre-validate the authority before including it in the settings save.\nconst result = await api.post<AuthorityValidationResult>(\n  '/api/settings/is-valid-authority',\n  { authority: dto.oidcConfig.authority }\n);\n// AuthorityValidationResult: 0 Success, 1 InvalidAuthority, 2 Failure, 3 NotApplicable, 4 MissingHttps\nif (result !== 0 /* Success */) {\n  showError('OIDC authority is invalid (check https, issuer match, reachability)');\n  return;\n}\nawait api.post('/api/settings', dto);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pre-validate with /api/settings/is-valid-authority and only persist when it returns Success.","Use https in production; reserve http for Development only.","Match the authority to the provider's issuer exactly, including trailing slash.","Confirm the Kavita server can reach the provider's .well-known/openid-configuration endpoint."],"tags":["oidc","authentication","network","settings","validation","admin"],"backgroundTag":null,"analyzedSha":"9c3e5400007f8a0282f7d883f2ad5e71716e514d","analyzedAt":"2026-08-13T19:06:05.897Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}