{"record":{"id":"62254be169d1bd8f","repo":"ory/kratos","slug":"failed-to-initialize-provider","errorCode":null,"errorMessage":"failed to initialize provider","messagePattern":"failed to initialize provider","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"selfservice/strategy/oidc/pkce.go","lineNumber":71,"sourceCode":"\t\t\treturn \"\"\n\t\t}\n\t\tif !pkceSupported {\n\t\t\td.Logger().Infof(\"Provider %q does not advertise support for PKCE. Continuing without PKCE.\", p.Config().ID)\n\t\t\treturn \"\"\n\t\t}\n\t}\n\treturn oauth2.GenerateVerifier()\n}\n\nfunc discoverPKCE(ctx context.Context, d pkceDependencies, p OAuth2Provider) (pkceSupported bool, err error) {\n\tif p.Config().IssuerURL == \"\" {\n\t\treturn false, errors.New(\"Issuer URL must be set to autodiscover PKCE support\")\n\t}\n\n\tctx = gooidc.ClientContext(ctx, d.HTTPClient(ctx).HTTPClient)\n\tgp, err := gooidc.NewProvider(ctx, p.Config().IssuerURL)\n\tif err != nil {\n\t\treturn false, errors.Wrap(err, \"failed to initialize provider\")\n\t}\n\tvar claims struct {\n\t\tCodeChallengeMethodsSupported []string `json:\"code_challenge_methods_supported\"`\n\t}\n\tif err := gp.Claims(&claims); err != nil {\n\t\treturn false, errors.Wrap(err, \"failed to deserialize provider claims\")\n\t}\n\treturn slices.Contains(claims.CodeChallengeMethodsSupported, \"S256\"), nil\n}\n","sourceCodeStart":53,"sourceCodeEnd":81,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/selfservice/strategy/oidc/pkce.go#L53-L81","documentation":"discoverPKCE calls gooidc.NewProvider against the OIDC provider's Issuer URL to fetch its discovery document and check PKCE support. This error wraps any failure of that OIDC discovery request (DNS failure, TLS error, non-200 discovery response, malformed discovery JSON). It means the issuer could not be reached or did not return a valid OpenID Connect discovery document.","triggerScenarios":"Calling maybePKCE/discoverPKCE when the provider has an IssuerURL set but gooidc.NewProvider(ctx, issuerURL) fails: issuer URL unreachable, wrong issuer path, discovery document returning HTTP error, or discovery JSON not matching the well-known schema.","commonSituations":"Misconfigured issuer URL (e.g. missing https://, wrong path, includes the well-known suffix), OP temporarily down or behind a firewall, self-signed certificates without proper CA trust, or the issuer metadata not matching the URL exactly (strict issuer validation in go-oidc).","solutions":["Verify the provider's issuer_url in the OIDC config matches exactly what the OP advertises (scheme, host, path) and is reachable via GET <issuer>/.well-known/openid-configuration.","Test with curl from the same host to rule out network/DNS/proxy issues.","If using self-signed TLS, ensure the HTTP client used (d.HTTPClient(ctx)) trusts the OP's CA.","Inspect the wrapped cause (errors.Cause / %v of err) for the specific discovery failure."],"exampleFix":"// before: issuer_url: \"https://op.example.com/.well-known/openid-configuration\"\n// after:  issuer_url: \"https://op.example.com\" (bare issuer, library appends the well-known path)","handlingStrategy":"try-catch","validationCode":"resp, err := http.Get(issuerURL + \"/.well-known/openid-configuration\")\nif err != nil || resp.StatusCode != 200 { /* fail fast before PKCE discovery */ }","typeGuard":null,"tryCatchPattern":"if _, err := discoverPKCE(ctx, p); err != nil {\n  if cause := errors.Cause(err); cause != nil {\n    log.WithError(cause).Error(\"OIDC discovery failed\")\n  }\n  return fallbackPKCE // e.g. treat as no PKCE support or fail startup with clear config error\n}","preventionTips":["Configure the bare issuer URL (no /.well-known path).","Verify issuer reachability from the deployment environment at startup.","Trust the OP's TLS CA in the HTTP client used for discovery."],"tags":["oidc","discovery","network","configuration"],"backgroundTag":"http-request-failed","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}