{"record":{"id":"45502836e5cf7f37","repo":"alibaba/nacos","slug":"oidc-discovery-response-is-empty","errorCode":null,"errorMessage":"OIDC discovery response is empty","messagePattern":"OIDC discovery response is empty","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/config/OidcProviderMetadataProvider.java","lineNumber":100,"sourceCode":"        String issuerUri = config.getIssuerUri();\n        if (StringUtils.isBlank(issuerUri)) {\n            throw new IOException(\"Issuer URI is not configured\");\n        }\n        String discoveryUrl = trimTrailingSlash(issuerUri)\n            + OidcProtocolConstants.WELL_KNOWN_PATH;\n        LOGGER.info(\"Discovering OIDC configuration from: {}\", discoveryUrl);\n        try {\n            HttpRequest request = HttpRequest.newBuilder().uri(URI.create(discoveryUrl))\n                .header(\"Accept\", \"application/json\").timeout(DISCOVERY_TIMEOUT).GET().build();\n            HttpResponse<String> response =\n                httpClient.send(request, HttpResponse.BodyHandlers.ofString());\n            if (response.statusCode() != OidcProtocolConstants.HTTP_STATUS_OK) {\n                throw new IOException(\"Failed to discover OIDC configuration, status: \"\n                    + response.statusCode());\n            }\n            Map<String, Object> values = JsonUtils.toObj(response.body(), Map.class);\n            if (values == null) {\n                throw new IOException(\"OIDC discovery response is empty\");\n            }\n            OidcProviderMetadata result = new OidcProviderMetadata(\n                stringValue(values, OidcProtocolConstants.DISCOVERY_AUTHORIZATION_ENDPOINT),\n                stringValue(values, OidcProtocolConstants.DISCOVERY_TOKEN_ENDPOINT),\n                stringValue(values, OidcProtocolConstants.DISCOVERY_USERINFO_ENDPOINT),\n                stringValue(values, OidcProtocolConstants.DISCOVERY_END_SESSION_ENDPOINT),\n                stringValue(values, OidcProtocolConstants.DISCOVERY_JWKS_URI));\n            LOGGER.info(\"OIDC configuration discovered: jwksUri={}\", result.getJwksUri());\n            return result;\n        } catch (InterruptedException e) {\n            Thread.currentThread().interrupt();\n            throw new IOException(\"OIDC discovery interrupted\", e);\n        } catch (IOException e) {\n            throw e;\n        } catch (RuntimeException e) {\n            throw new IOException(\"Failed to parse OIDC configuration\", e);\n        }\n    }","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/config/OidcProviderMetadataProvider.java#L82-L118","documentation":"Thrown when the discovery HTTP response parsed to null — i.e. JsonUtils.toObj(body, Map.class) returned null. This means the body was empty, the literal 'null', or could not deserialize into a Map (yielding null).","triggerScenarios":"Discovery endpoint returned HTTP 200 but with an empty body, the literal string 'null', or a JSON scalar (not an object) that deserializes to null when a Map is expected.","commonSituations":"IdP misconfiguration returning 200 with empty content; a proxy returning an empty 200 on a cached failure; a non-OIDC endpoint that returns a non-object JSON body.","solutions":["curl the discovery URL and confirm the body is a non-empty JSON object containing the OIDC endpoint fields.","If the body is empty, investigate the IdP/proxy returning an empty 200.","Ensure issuer-uri points to a genuine OIDC discovery endpoint."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Probe discovery body is a non-empty JSON object before accepting it\n// (curl <issuer>/.well-known/openid-configuration and assert body starts with '{')","typeGuard":null,"tryCatchPattern":"try {\n    metadataProvider.getMetadata();\n} catch (IOException e) {\n    if (\"OIDC discovery response is empty\".equals(e.getMessage())) {\n        log.error(\"IdP returned empty discovery body; verify issuer-uri and IdP health\");\n    }\n    throw e;\n}","preventionTips":["Confirm the discovery endpoint returns a populated JSON object.","Investigate proxies that may return empty 200 responses.","Do not enable OIDC until discovery returns a valid body."],"tags":["oidc","network","discovery","parsing"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}