{"record":{"id":"70fd656eaf6a6b86","repo":"xai-org/grok-build","slug":"oidcerror-discoveryhttp","errorCode":null,"errorMessage":"OidcError::DiscoveryHttp","messagePattern":"OidcError::DiscoveryHttp","errorType":"http","errorClass":"OidcError","httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/oidc/protocol.rs","lineNumber":317,"sourceCode":"    backon::ExponentialBuilder::default()\n        .with_max_times(2)\n        .with_min_delay(StdDuration::from_millis(500))\n        .with_max_delay(StdDuration::from_secs(2))\n        .with_jitter()\n}\nasync fn discover_once(issuer_key: &str) -> anyhow::Result<Discovery> {\n    let url = format!(\"{issuer_key}/.well-known/openid-configuration\");\n    tracing::debug!(url = %url, \"OIDC: fetching discovery document\");\n    let resp = with_alpha_test_key(\n        crate::http::shared_client()\n            .get(&url)\n            .timeout(StdDuration::from_secs(10)),\n        &url,\n    )\n    .send()\n    .await?;\n    if !resp.status().is_success() {\n        return Err(anyhow::Error::new(OidcError::DiscoveryHttp {\n            status: resp.status().as_u16(),\n            url,\n        }));\n    }\n    let doc: Discovery = resp.json().await?;\n    tracing::debug!(\n        authorization_endpoint = %doc.authorization_endpoint,\n        token_endpoint = %doc.token_endpoint,\n        jwks_uri = ?doc.jwks_uri,\n        id_token_algs = ?doc.id_token_signing_alg_values_supported,\n        \"OIDC: discovery complete\"\n    );\n    Ok(doc)\n}\n#[cfg(test)]\npub(super) fn clear_discovery_cache() {\n    DISCOVERY_CACHE.write().clear();\n}","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/oidc/protocol.rs#L299-L335","documentation":"OidcError::DiscoveryHttp is raised during OIDC discovery when the issuer's well-known document endpoint returns a non-success HTTP status. It carries the numeric status and the discovery URL that was requested. This means the IdP metadata could not be fetched, so no OIDC flow can proceed.","triggerScenarios":"discover() issues a GET (10s timeout) to `<issuer>/.well-known/openid-configuration`; resp.status().is_success() is false, producing DiscoveryHttp { status, url }.","commonSituations":"Wrong issuer URL in config (typo or trailing wrong path), IdP temporarily down, corporate proxy/gateway returning 403/502, discovery path not exposed by a non-standard provider.","solutions":["Check the status and URL in the error: open the URL in a browser/curl and confirm it returns JSON","Fix the issuer URL in your OIDC config (must be the base issuer, not the full well-known path)","Verify network/proxy access from the machine running the shell; retry if the IdP is temporarily down"],"exampleFix":"// before\nissuer = \"https://idp.example.com/.well-known/openid-configuration\"\n// after\nissuer = \"https://idp.example.com\"  // discovery path is appended automatically","handlingStrategy":"retry","validationCode":"// preflight: verify discovery is reachable before the flow\nasync fn discovery_ok(issuer: &str) -> bool {\n    let url = format!(\"{}/.well-known/openid-configuration\", issuer.trim_end_matches('/'));\n    reqwest::get(&url).await.map(|r| r.status().is_success()).unwrap_or(false)\n}","typeGuard":null,"tryCatchPattern":"match discover(&cfg).await {\n    Err(e) if matches!(e.downcast_ref::<OidcError>(), Some(OidcError::DiscoveryHttp { status, .. })) => {\n        eprintln!(\"Discovery HTTP failure, retrying once...\");\n        tokio::time::sleep(Duration::from_secs(2)).await;\n        discover(&cfg).await\n    }\n    other => other,\n}","preventionTips":["Preflight-check the well-known URL with curl before configuring the issuer","Verify the issuer is the base URL, not the full well-known path","Confirm proxy/firewall allows egress to the IdP from the shell host"],"tags":["oidc","http","discovery","network"],"backgroundTag":"discovery-endpoint-http-error","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}