{"record":{"id":"677e6f4a5fee2451","repo":"apache/dolphinscheduler","slug":"failed-to-construct-oidc-redirect-uri","errorCode":null,"errorMessage":"Failed to construct OIDC redirect URI","messagePattern":"Failed to construct OIDC redirect URI","errorType":"exception","errorClass":"ServiceException","httpStatus":null,"severity":"error","filePath":"dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/oidc/OidcAuthenticator.java","lineNumber":265,"sourceCode":"                    codeGrant);\n\n            TokenResponse tokenResponse;\n            try {\n                tokenResponse = OIDCTokenResponseParser.parse(tokenRequest.toHTTPRequest().send());\n            } catch (Exception e) {\n                log.error(\"Failed to send token request\", e);\n                throw new ServiceException(Status.OIDC_TOKEN_EXCHANGE_FAILED);\n            }\n\n            if (!tokenResponse.indicatesSuccess()) {\n                log.error(\"Token request failed: {}\", tokenResponse.toErrorResponse().getErrorObject());\n                throw new ServiceException(Status.OIDC_TOKEN_EXCHANGE_FAILED);\n            }\n\n            return ((OIDCTokenResponse) tokenResponse).getOIDCTokens();\n        } catch (java.net.URISyntaxException e) {\n            log.error(\"Invalid redirect URI configured for OIDC provider: {}\", providerId, e);\n            throw new ServiceException(\"Failed to construct OIDC redirect URI\", e);\n        }\n    }\n\n    /**\n     * Validate ID token and extract claims\n     */\n    private IDTokenClaimsSet validateIdToken(OIDCProviderMetadata providerMetadata,\n                                             OidcProviderConfig providerConfig, JWT idToken) {\n        JWTClaimsSet claimsSet;\n        try {\n            claimsSet = idToken.getJWTClaimsSet();\n        } catch (java.text.ParseException e) {\n            throw new ServiceException(\"Error parsing ID token claims\", e);\n        }\n\n        String issuer = claimsSet.getIssuer();\n        if (issuer == null || !issuer.equals(providerMetadata.getIssuer().getValue())) {\n            throw new ServiceException(Status.OIDC_ID_TOKEN_ISSUER_INVALID);","sourceCodeStart":247,"sourceCodeEnd":283,"githubUrl":"https://github.com/apache/dolphinscheduler/blob/02eac45a1b6676e639fcbfb4be2243de5771b05d/dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/security/impl/oidc/OidcAuthenticator.java#L247-L283","documentation":"When building the OIDC redirect URI, a java.net.URISyntaxException is caught and rethrown as ServiceException(\"Failed to construct OIDC redirect URI\"). This means the configured redirect/provider URI is syntactically invalid, so the authorization URL cannot be constructed at all.","triggerScenarios":"API startup or login flow calls exchangeCodeForTokens where a URI (redirect URI, provider endpoint) built from configuration fails java.net.URI validation — e.g. missing scheme, illegal characters, spaces, or unencoded special characters in configured values.","commonSituations":"Redirect URI configured with a trailing space or newline in YAML/env config; missing https:// scheme; unencoded characters (Chinese/unicode or spaces) in the domain; placeholder values like '<your-domain>' left in config after a template copy.","solutions":["Check the log line 'Invalid redirect URI configured for OIDC provider' for the exact URISyntaxException and offending value","Fix the configured redirect URI / provider endpoint to a valid absolute URI (scheme://host[:port]/path, URL-encoded characters)","Remove placeholder or whitespace characters from OIDC config in application.yaml / env vars","Restart the api-server and retry the login flow"],"exampleFix":"// before (application.yaml)\ndolphinscheduler:\n  security:\n    oidc:\n      redirect-uri: https://<your-domain>/login\n// after\ndolphinscheduler:\n  security:\n    oidc:\n      redirect-uri: https://ds.example.com/login","handlingStrategy":"validation","validationCode":"try {\n    new URI(configuredRedirectUri);\n} catch (URISyntaxException e) {\n    throw new IllegalStateException(\"Invalid configured OIDC redirect URI: \" + configuredRedirectUri, e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    loginViaOidc(authorizationCode);\n} catch (ServiceException e) {\n    if (\"Failed to construct OIDC redirect URI\".equals(e.getMessage())) {\n        log.error(\"Fix OIDC redirect URI configuration; current value is not a valid URI\");\n    }\n}","preventionTips":["Validate OIDC URIs at startup with new URI(...) fail-fast checks","Reject placeholder/unencoded values in configuration templates","Keep redirect URIs as simple absolute https URLs without spaces or special characters"],"tags":["oidc","configuration","url"],"backgroundTag":"invalid-url","analyzedSha":"02eac45a1b6676e639fcbfb4be2243de5771b05d","analyzedAt":"2026-09-06T17:43:00.555Z","contentChangedAt":"2026-09-06T17:43:00.555Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}