{"record":{"id":"62a5a86293ca6396","repo":"alibaba/nacos","slug":"authorization-endpoint-not-configured","errorCode":null,"errorMessage":"Authorization endpoint not configured","messagePattern":"Authorization endpoint not configured","errorType":"exception","errorClass":"AccessException","httpStatus":401,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/AuthorizationCodeHandler.java","lineNumber":111,"sourceCode":"        this.config = config;\n        this.metadataProvider = metadataProvider;\n        this.tokenValidator = tokenValidator;\n        this.userMapper = userMapper;\n        this.secureRandom = secureRandom;\n    }\n    \n    /**\n     * Build the authorization URL for redirecting user to IdP.\n     *\n     * @param redirectUri callback URI after authentication\n     * @return authorization URL\n     * @throws AccessException if configuration is invalid\n     */\n    public String buildAuthorizationUrl(String redirectUri) throws AccessException {\n        try {\n            String authEndpoint = metadataProvider.getMetadata().getAuthorizationEndpoint();\n            if (StringUtils.isBlank(authEndpoint)) {\n                throw new AccessException(\"Authorization endpoint not configured\");\n            }\n            \n            // Generate nonce for security\n            String nonce = generateSecureToken();\n            long expirationTime = System.currentTimeMillis() + STATE_EXPIRATION_MS;\n            \n            // Build self-contained signed state: base64(nonce.expTime.signature)\n            // This eliminates the need for server-side state storage (cluster-friendly)\n            String state = buildSignedState(nonce, expirationTime);\n            \n            // Build OIDC authentication request\n            AuthenticationRequest authRequest = new AuthenticationRequest.Builder(\n                new ResponseType(\"code\"),\n                new Scope(config.getScope().split(\" \")),\n                new ClientID(config.getClientId()),\n                URI.create(redirectUri))\n                .endpointURI(URI.create(authEndpoint))\n                .state(new State(state))","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/AuthorizationCodeHandler.java#L93-L129","documentation":"Thrown by AuthorizationCodeHandler.buildAuthorizationUrl when the OIDC provider metadata's authorization_endpoint is blank. The handler fetches metadata via metadataProvider.getMetadata() and checks the authorization endpoint URL; without it, it cannot construct the redirect URL to the identity provider, so it throws AccessException(\"Authorization endpoint not configured\").","triggerScenarios":"buildAuthorizationUrl(redirectUri) is called; metadataProvider.getMetadata().getAuthorizationEndpoint() returns null or empty. The OIDC discovery document was unreachable, malformed, or did not advertise an authorization_endpoint.","commonSituations":"The issuer URL is wrong so OIDC discovery returns no/partial metadata; the IdP's well-known endpoint is down; a custom metadata config omitted the authorization endpoint; network/firewall blocks the discovery call.","solutions":["Verify the configured OIDC issuer URL is correct and reachable.","Confirm the IdP's /.well-known/openid-configuration returns a JSON with a non-empty authorization_endpoint.","If using static metadata (no discovery), explicitly set the authorization endpoint in the OIDC plugin config.","Check network/firewall rules allow the Nacos server to reach the IdP discovery URL."],"exampleFix":"# before: issuer URL wrong or unreachable, discovery returns no auth endpoint\nnacos.plugin.auth.oidc.issuer=https://idp.example.com/wrong\n\n# after: correct issuer, discovery returns authorization_endpoint\nnacos.plugin.auth.oidc.issuer=https://idp.example.com/realms/myrealm","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    String authUrl = handler.buildAuthorizationUrl(redirectUri);\n} catch (AccessException e) {\n    if (\"Authorization endpoint not configured\".equals(e.getMessage())) {\n        // fix OIDC issuer/discovery, then retry\n    }\n}","preventionTips":["Verify the OIDC issuer URL and that /.well-known/openid-configuration returns authorization_endpoint.","Ensure network access from Nacos to the IdP discovery endpoint.","If using static metadata, explicitly configure the authorization endpoint."],"tags":["auth","oidc","config","discovery","metadata","access-denied","java"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}