{"record":{"id":"57d09b9247eb036b","repo":"googleapis/mcp-toolbox","slug":"no-field-named-s-in-claims","errorCode":null,"errorMessage":"no field named %s in claims","messagePattern":"no field named (.+?) in claims","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/util/parameters/parameters.go","lineNumber":118,"sourceCode":"\t\t\tkey = \"$\" + key\n\t\t}\n\t\tparams[key] = param.Value\n\t}\n\treturn params\n}\n\nfunc parseFromAuthService(paramAuthServices []ParamAuthService, claimsMap map[string]map[string]any) (any, error) {\n\t// parse a parameter from claims using its specified auth services\n\tfor _, a := range paramAuthServices {\n\t\tclaims, ok := claimsMap[a.Name]\n\t\tif !ok {\n\t\t\t// not validated for this authservice, skip to the next one\n\t\t\tcontinue\n\t\t}\n\t\tv, ok := claims[a.Field]\n\t\tif !ok {\n\t\t\t// claims do not contain specified field\n\t\t\treturn nil, fmt.Errorf(\"no field named %s in claims\", a.Field)\n\t\t}\n\t\treturn v, nil\n\t}\n\treturn nil, util.NewClientServerError(\"missing or invalid authentication header\", http.StatusUnauthorized, nil)\n}\n\n// CheckParamRequired checks if a parameter is required based on the required and default field.\nfunc CheckParamRequired(required bool, defaultV any) bool {\n\treturn required && defaultV == nil\n}\n\n// ParseParams is a helper function for parsing Parameters from an arbitraryJSON object.\nfunc ParseParams(ps Parameters, data map[string]any, claimsMap map[string]map[string]any) (ParamValues, error) {\n\tparams := make([]ParamValue, 0, len(ps))\n\tfor _, p := range ps {\n\t\tvar v, newV any\n\t\tvar err error\n\t\tparamAuthServices := p.GetAuthServices()","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/util/parameters/parameters.go#L100-L136","documentation":"When a tool parameter is sourced from auth service claims (myAuthFieldName/field), parseFromAuthService looks up the configured field in the verified JWT claims map. If the claims token does not contain that field, it returns this error; if no auth service matches at all, a 401 client error is returned instead.","triggerScenarios":"A request presents a valid authenticated token, but the JWT lacks the claim field configured for a parameter (e.g. parameter uses field \"email\" but the token's payload has no `email` claim).","commonSituations":"IdP misconfiguration where optional claims (email, sub) aren't issued; switching auth providers whose token payloads differ; tool config referencing a custom claim the client's token never includes.","solutions":["Update the tool's auth parameter `field` to a claim that exists in the token (e.g. `sub`)","Fix the IdP/client so the token includes the required claim","Add/enable the missing claim scope in the auth service configuration","Check the decoded JWT payload to confirm the exact field name and casing"],"exampleFix":"// before\nauthServices:\n  - name: my-auth\n    jwt:\n      claim: \"user_email\" # token has no such field\n// after\nauthServices:\n  - name: my-auth\n    jwt:\n      claim: \"sub\"","handlingStrategy":"validation","validationCode":"func claimExists(claims map[string]any, field string) bool {\n    _, ok := claims[field]\n    return ok\n}\n// verify the configured field is present in a sample decoded token","typeGuard":"func claimString(claims map[string]any, field string) (string, bool) {\n    v, ok := claims[field].(string)\n    return v, ok\n}","tryCatchPattern":"params, err := ParseParams(...)\nif err != nil {\n    if strings.Contains(err.Error(), \"no field named\") {\n        return nil, fmt.Errorf(\"token missing required claim: %w\", err)\n    }\n    return nil, err\n}","preventionTips":["Decode a sample token and confirm the claim field name/casing matches config","Prefer stable claims like `sub` over provider-specific optional claims","Enable the IdP scopes that emit required claims"],"tags":["auth","jwt","claims"],"backgroundTag":"jwt-missing-claim","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}