{"record":{"id":"4ab7103f558cb83e","repo":"xai-org/grok-build","slug":"missingidtoken","errorCode":"MissingIdToken","errorMessage":"OidcError::MissingIdToken","messagePattern":"OidcError::MissingIdToken","errorType":"error_code","errorClass":"OidcError","httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/oidc/protocol.rs","lineNumber":747,"sourceCode":"            user_id: team_user_id,\n            email: None,\n            first_name: None,\n            last_name: None,\n            profile_image_asset_id: None,\n            principal_type: Some(crate::auth::model::TEAM_PRINCIPAL_TYPE.to_string()),\n            principal_id: principal_id.map(ToOwned::to_owned),\n            team_id: principal_id.map(ToOwned::to_owned).or(fallback_team_id),\n            team_name: None,\n            team_role: None,\n            organization_id: None,\n            organization_name: None,\n            organization_role: None,\n            user_blocked_reason: None,\n            team_blocked_reasons: vec![],\n            coding_data_retention_opt_out: crate::auth::default_coding_data_retention_opt_out(),\n        });\n    }\n    let token = id_token.ok_or_else(|| anyhow::Error::new(OidcError::MissingIdToken))?;\n    validate_and_extract_user_info(\n        token,\n        discovery,\n        expected_issuer,\n        expected_client_id,\n        expected_nonce,\n    )\n    .await\n    .map(|mut user_info| {\n        user_info.principal_type = principal_type.map(ToOwned::to_owned);\n        user_info.principal_id = principal_id.map(ToOwned::to_owned);\n        if user_info.team_id.is_none() {\n            user_info.team_id = fallback_team_id;\n        }\n        user_info\n    })\n    .map_err(|e| anyhow::Error::new(OidcError::IdTokenValidationFailed(e.to_string())))\n}","sourceCodeStart":729,"sourceCodeEnd":765,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/oidc/protocol.rs#L729-L765","documentation":"OidcError::MissingIdToken is thrown by extract_user_info when no `principal_type == team` shortcut applies and the optional id_token parameter is None (protocol.rs:747). Without an ID token there is nothing to validate or extract user claims from, so the login flow cannot proceed.","triggerScenarios":"The token endpoint response (or device/callback flow result) contained no id_token, and extract_user_info was called with id_token=None for a non-team principal.","commonSituations":"The IdP is configured to not return id_token for the requested flow/scopes; the token response JSON was parsed with a wrong field name; `openid` scope missing from the authorization request so no id_token is issued; partial response from a race fallback path (full_login_flow_via_race).","solutions":["Ensure the `openid` scope is included in the authorization request so the provider issues an id_token.","Log the token endpoint response and confirm an id_token field is present; fix scope/flow parameters if not.","Use the team-principal path (principal_type=team) only when intentionally skipping ID token validation; otherwise supply the token."],"exampleFix":"// before: request without openid scope\nlet auth_url = format!(\"{auth}?client_id={id}&redirect_uri={uri}&response_type=code\");\n// after: request openid scope so an id_token is returned\nlet auth_url = format!(\"{auth}?client_id={id}&redirect_uri={uri}&response_type=code&scope=openid%20profile%20email\");","handlingStrategy":"validation","validationCode":"// verify the token response carries an id_token before calling extract_user_info\nlet id_token = token_response.get(\"id_token\").and_then(|v| v.as_str());\nif id_token.is_none() {\n    eprintln!(\"provider returned no id_token; ensure 'openid' scope requested\");\n}","typeGuard":"fn has_id_token(resp: &serde_json::Value) -> bool { resp.get(\"id_token\").map_or(false, |v| v.as_str().map_or(false, |s| !s.is_empty())) }","tryCatchPattern":"match result {\n    Err(e) if e.to_string().contains(\"MissingIdToken\") => eprintln!(\"no id_token in response; check scopes/flow\"),\n    other => other,\n}","preventionTips":["Always request the `openid` scope in the authorization request.","Assert id_token presence in token-endpoint responses during integration tests.","Use the team-principal path only deliberately."],"tags":["oidc","id-token","login-flow","auth"],"backgroundTag":"missing-id-token","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}