{"record":{"id":"43848354cf0303ae","repo":"alibaba/nacos","slug":"failed-to-initiate-login-errormessage","errorCode":null,"errorMessage":"Failed to initiate login: {errorMessage}","messagePattern":"Failed to initiate login: (.+?)","errorType":"exception","errorClass":"AccessException","httpStatus":401,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/AuthorizationCodeHandler.java","lineNumber":141,"sourceCode":"            AuthenticationRequest authRequest = new AuthenticationRequest.Builder(\n                new ResponseType(\"code\"),\n                new Scope(config.getScope().split(\" \")),\n                new ClientID(config.getClientId()),\n                URI.create(redirectUri))\n                .endpointURI(URI.create(authEndpoint))\n                .state(new State(state))\n                .nonce(new Nonce(nonce))\n                .build();\n            \n            String authUrl = authRequest.toURI().toString();\n            LOGGER.debug(\"Built authorization URL: {}\", authUrl);\n            return authUrl;\n            \n        } catch (AccessException e) {\n            throw e;\n        } catch (Exception e) {\n            LOGGER.error(\"Failed to build authorization URL\", e);\n            throw new AccessException(\"Failed to initiate login: \" + e.getMessage());\n        }\n    }\n    \n    /**\n     * Exchange authorization code for tokens and authenticate user.\n     *\n     * @param code        authorization code from IdP\n     * @param state       state parameter for CSRF verification\n     * @param redirectUri the redirect URI used in the authorization request\n     * @return authenticated OidcUser\n     * @throws AccessException if authentication fails\n     */\n    public OidcUser exchangeCodeForUser(String code, String state, String redirectUri)\n        throws AccessException {\n        try {\n            // Verify and decode state (self-contained, no cache lookup needed)\n            StateData stateData = verifyAndDecodeState(state);\n            if (stateData == null) {","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/AuthorizationCodeHandler.java#L123-L159","documentation":"Thrown by AuthorizationCodeHandler.buildAuthorizationUrl as the catch-all for any non-AccessException during authorization URL construction. The handler wraps the original exception message into AccessException(\"Failed to initiate login: \" + e.getMessage()) and logs the full stack trace at ERROR. This covers failures in building the OIDC AuthenticationRequest (e.g. invalid redirect URI, scope parsing, client ID).","triggerScenarios":"Any Exception (other than AccessException, which is rethrown as-is) thrown while constructing the AuthenticationRequest: URI.create fails on a malformed redirectUri, scope.split produces invalid Scope objects, or ClientID/endpoint URI construction fails.","commonSituations":"The redirectUri passed in is malformed or not a valid absolute URI; the configured scope string contains invalid characters; a config value (clientId) is null causing NPE in the OIDC builder.","solutions":["Check the server log for 'Failed to build authorization URL' — it logs the full underlying exception with the real root cause.","Validate that redirectUri is a well-formed absolute URI before calling buildAuthorizationUrl.","Ensure the OIDC clientId and scope config values are set and valid.","Fix the specific underlying error identified in the logged stack trace."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate redirectUri before calling buildAuthorizationUrl\ntry {\n    URI uri = URI.create(redirectUri);\n    if (uri.getScheme() == null || uri.getHost() == null) {\n        throw new IllegalArgumentException(\"redirectUri must be absolute\");\n    }\n} catch (Exception e) {\n    // reject malformed redirectUri before login\n}","typeGuard":"static boolean isAbsoluteUri(String uri) {\n    try {\n        URI u = URI.create(uri);\n        return u.getScheme() != null && u.getHost() != null;\n    } catch (Exception e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    String authUrl = handler.buildAuthorizationUrl(redirectUri);\n} catch (AccessException e) {\n    // check server log 'Failed to build authorization URL' for root cause\n}","preventionTips":["Validate redirectUri is a well-formed absolute URI before calling buildAuthorizationUrl.","Ensure OIDC clientId, clientSecret, and scope are configured.","Always check the logged underlying exception for the real cause."],"tags":["auth","oidc","generic-catch","login","uri","access-denied","java"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}