{"record":{"id":"63e0cb7f990e962e","repo":"alibaba/nacos","slug":"issuer-uri-is-not-configured","errorCode":null,"errorMessage":"Issuer URI is not configured","messagePattern":"Issuer URI is not configured","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/config/OidcProviderMetadataProvider.java","lineNumber":84,"sourceCode":"    public OidcProviderMetadata getMetadata() throws IOException {\n        OidcProviderMetadata result = metadata;\n        if (result == null) {\n            synchronized (this) {\n                result = metadata;\n                if (result == null) {\n                    result = discover();\n                    metadata = result;\n                }\n            }\n        }\n        return result;\n    }\n    \n    @SuppressWarnings(\"unchecked\")\n    private OidcProviderMetadata discover() throws IOException {\n        String issuerUri = config.getIssuerUri();\n        if (StringUtils.isBlank(issuerUri)) {\n            throw new IOException(\"Issuer URI is not configured\");\n        }\n        String discoveryUrl = trimTrailingSlash(issuerUri)\n            + OidcProtocolConstants.WELL_KNOWN_PATH;\n        LOGGER.info(\"Discovering OIDC configuration from: {}\", discoveryUrl);\n        try {\n            HttpRequest request = HttpRequest.newBuilder().uri(URI.create(discoveryUrl))\n                .header(\"Accept\", \"application/json\").timeout(DISCOVERY_TIMEOUT).GET().build();\n            HttpResponse<String> response =\n                httpClient.send(request, HttpResponse.BodyHandlers.ofString());\n            if (response.statusCode() != OidcProtocolConstants.HTTP_STATUS_OK) {\n                throw new IOException(\"Failed to discover OIDC configuration, status: \"\n                    + response.statusCode());\n            }\n            Map<String, Object> values = JsonUtils.toObj(response.body(), Map.class);\n            if (values == null) {\n                throw new IOException(\"OIDC discovery response is empty\");\n            }\n            OidcProviderMetadata result = new OidcProviderMetadata(","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/config/OidcProviderMetadataProvider.java#L66-L102","documentation":"Thrown by OidcProviderMetadataProvider.discover() when the configured issuer-uri is blank. Discovery needs the issuer root to build the .well-known/openid-configuration URL; without it the URL cannot be constructed.","triggerScenarios":"Any call to getMetadata() (which triggers discover lazily) while config.getIssuerUri() is blank. This happens during the first authorization URL build, token exchange, JWKS fetch, or logout URL build.","commonSituations":"OIDC auth type selected but issuer-uri never set; issuer-uri key mistyped in config; config source not loaded so the value defaults to empty.","solutions":["Set nacos.plugin.auth.oidc.issuer-uri to the OIDC issuer root (e.g. https://keycloak.example.com/realms/myrealm).","Confirm OidcAuthPluginConfig.isValid() returns true (requires non-blank issuer-uri and client-id) before enabling OIDC.","Verify the config key is spelled exactly 'issuer-uri'."],"exampleFix":"// before: OIDC enabled but issuer-uri missing\nnacos.plugin.auth.oidc.client-id=myclient\n// after\nnacos.plugin.auth.oidc.issuer-uri=https://idp.example.com/realms/myrealm\nnacos.plugin.auth.oidc.client-id=myclient","handlingStrategy":"validation","validationCode":"// Fail fast at startup if issuer-uri is missing when OIDC is enabled\nif (!config.isValid()) {\n    throw new IllegalStateException(\n        \"OIDC enabled but issuer-uri and/or client-id not configured\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    metadataProvider.getMetadata();\n} catch (IOException e) {\n    if (\"Issuer URI is not configured\".equals(e.getMessage())) {\n        log.error(\"Set nacos.plugin.auth.oidc.issuer-uri before enabling OIDC\");\n    }\n    throw e;\n}","preventionTips":["Always set issuer-uri when OIDC auth is the active type.","Call OidcAuthPluginConfig.isValid() at startup and refuse to start if it returns false.","Spell the config key exactly 'issuer-uri'."],"tags":["oidc","config","discovery"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}