{"record":{"id":"5981dcd4cda3020b","repo":"Tencent/WeKnora","slug":"cannot-verify-oidc-id-token-no-jwks-uri-configure","errorCode":null,"errorMessage":"cannot verify OIDC id_token: no jwks_uri configured","messagePattern":"cannot verify OIDC id_token: no jwks_uri configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/user.go","lineNumber":1585,"sourceCode":"\n\tvar tokenResp oidcTokenResponse\n\tif err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to decode OIDC token response: %w\", err)\n\t}\n\tif strings.TrimSpace(tokenResp.AccessToken) == \"\" && strings.TrimSpace(tokenResp.IDToken) == \"\" {\n\t\treturn nil, errors.New(\"OIDC token response missing access_token and id_token\")\n\t}\n\treturn &tokenResp, nil\n}\n\nfunc (s *userService) resolveOIDCUserInfo(ctx context.Context, cfg *config.OIDCAuthConfig, tokenResp *oidcTokenResponse) (*types.OIDCUserInfo, error) {\n\tclaims := map[string]interface{}{}\n\tverifiedFromIDToken := false\n\n\tif idToken := strings.TrimSpace(tokenResp.IDToken); idToken != \"\" {\n\t\tif strings.TrimSpace(cfg.JwksURI) == \"\" {\n\t\t\tif strings.TrimSpace(cfg.UserInfoEndpoint) == \"\" || strings.TrimSpace(tokenResp.AccessToken) == \"\" {\n\t\t\t\treturn nil, errors.New(\"cannot verify OIDC id_token: no jwks_uri configured\")\n\t\t\t}\n\t\t\tlogger.Warnf(ctx, \"OIDC id_token ignored: no jwks_uri configured; relying on userinfo endpoint\")\n\t\t} else {\n\t\t\tidTokenClaims, err := s.verifyOIDCIDToken(ctx, cfg, idToken)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"OIDC id_token verification failed: %w\", err)\n\t\t\t}\n\t\t\tfor k, v := range idTokenClaims {\n\t\t\t\tclaims[k] = v\n\t\t\t}\n\t\t\tverifiedFromIDToken = true\n\t\t}\n\t}\n\n\tif strings.TrimSpace(cfg.UserInfoEndpoint) != \"\" && strings.TrimSpace(tokenResp.AccessToken) != \"\" {\n\t\tuserInfoClaims, err := s.fetchOIDCUserInfo(ctx, cfg.UserInfoEndpoint, tokenResp.AccessToken)\n\t\tif err != nil {\n\t\t\tif !verifiedFromIDToken {","sourceCodeStart":1567,"sourceCodeEnd":1603,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/user.go#L1567-L1603","documentation":"Raised in resolveOIDCUserInfo when an id_token is present but no jwks_uri is configured, so its signature cannot be verified. For security the unsigned id_token is never trusted (userinfo also failed or is unavailable), so login is aborted rather than falling back to unverified claims.","triggerScenarios":"Thrown at internal/application/service/user.go:1585 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure jwks_uri (or discovery_url that yields it) so id_token signatures can be verified","Ensure the userinfo endpoint is reachable so claims come from a trusted source"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}