{"record":{"id":"57aece320cbd911e","repo":"SigNoz/signoz","slug":"codeinvalidinput-57aece","errorCode":"CodeInvalidInput","errorMessage":"issuer is required","messagePattern":"issuer is required","errorType":"validation","errorClass":"errors SigNozError","httpStatus":400,"severity":"error","filePath":"pkg/types/authtypes/oidc.go","lineNumber":43,"sourceCode":"\tClaimMapping AttributeMapping `json:\"claimMapping\"`\n\n\t// Whether to skip email verification. Defaults to \"false\"\n\tInsecureSkipEmailVerified bool `json:\"insecureSkipEmailVerified\"`\n\n\t// Uses the userinfo endpoint to get additional claims for the token. This is especially useful where upstreams return \"thin\" id tokens\n\tGetUserInfo bool `json:\"getUserInfo\"`\n}\n\nfunc (config *OIDCConfig) UnmarshalJSON(data []byte) error {\n\ttype Alias OIDCConfig\n\n\tvar temp Alias\n\tif err := json.Unmarshal(data, &temp); err != nil {\n\t\treturn err\n\t}\n\n\tif temp.Issuer == \"\" {\n\t\treturn errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, \"issuer is required\")\n\t}\n\n\tif temp.ClientID == \"\" {\n\t\treturn errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, \"clientId is required\")\n\t}\n\n\tif temp.ClientSecret == \"\" {\n\t\treturn errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, \"clientSecret is required\")\n\t}\n\n\tif temp.ClaimMapping == (AttributeMapping{}) {\n\t\tif err := json.Unmarshal([]byte(\"{}\"), &temp.ClaimMapping); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t*config = OIDCConfig(temp)\n\treturn nil","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/types/authtypes/oidc.go#L25-L61","documentation":"Thrown during SamlConfig/OidcConfig UnmarshalJSON (oidc.go) when the issuer field is empty. The issuer URL identifies the OIDC provider and is required to discover endpoints and validate ID tokens.","triggerScenarios":"POST/PUT an OIDC SSO config JSON without an \"issuer\" field or with an empty string.","commonSituations":"Setting up OIDC (Okta, Keycloak, Auth0, Azure AD) and pasting only clientId/clientSecret, or omitting the issuer by mistake.","solutions":["Set issuer to your provider's issuer URL, e.g. https://accounts.google.com or https://your-tenant.okta.com/oauth2/default","Confirm the issuer matches exactly what the provider advertises in its discovery document"],"exampleFix":"// before\n{\"clientId\": \"abc\", \"clientSecret\": \"xyz\"}\n// after\n{\"issuer\": \"https://keycloak.example.com/realms/myrealm\", \"clientId\": \"abc\", \"clientSecret\": \"xyz\"}","handlingStrategy":"validation","validationCode":"if cfg.Issuer == \"\" { return errors.New(\"issuer is required\") }\nif _, err := url.ParseRequestURI(cfg.Issuer); err != nil { return errors.New(\"issuer must be a valid URL\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fetch the provider's /.well-known/openid-configuration to confirm the issuer before saving"],"tags":["oidc","sso","config-validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}