{"record":{"id":"7745aca751e23b61","repo":"netbirdio/netbird","slug":"identity-provider-issuer-is-required","errorCode":null,"errorMessage":"identity provider issuer is required","messagePattern":"identity provider issuer is required","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"management/server/types/identity_provider.go","lineNumber":13,"sourceCode":"package types\n\nimport (\n\t\"errors\"\n\t\"net/url\"\n)\n\n// Identity provider validation errors\nvar (\n\tErrIdentityProviderNameRequired      = errors.New(\"identity provider name is required\")\n\tErrIdentityProviderTypeRequired      = errors.New(\"identity provider type is required\")\n\tErrIdentityProviderTypeUnsupported   = errors.New(\"unsupported identity provider type\")\n\tErrIdentityProviderIssuerRequired    = errors.New(\"identity provider issuer is required\")\n\tErrIdentityProviderIssuerInvalid     = errors.New(\"identity provider issuer must be a valid URL\")\n\tErrIdentityProviderIssuerUnreachable = errors.New(\"identity provider issuer is unreachable\")\n\tErrIdentityProviderIssuerMismatch    = errors.New(\"identity provider issuer does not match the issuer returned by the provider\")\n\tErrIdentityProviderClientIDRequired  = errors.New(\"identity provider client ID is required\")\n)\n\n// IdentityProviderType is the type of identity provider\ntype IdentityProviderType string\n\nconst (\n\t// IdentityProviderTypeOIDC is a generic OIDC identity provider\n\tIdentityProviderTypeOIDC IdentityProviderType = \"oidc\"\n\t// IdentityProviderTypeZitadel is the Zitadel identity provider\n\tIdentityProviderTypeZitadel IdentityProviderType = \"zitadel\"\n\t// IdentityProviderTypeEntra is the Microsoft Entra (Azure AD) identity provider\n\tIdentityProviderTypeEntra IdentityProviderType = \"entra\"\n\t// IdentityProviderTypeGoogle is the Google identity provider\n\tIdentityProviderTypeGoogle IdentityProviderType = \"google\"","sourceCodeStart":1,"sourceCodeEnd":31,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/management/server/types/identity_provider.go#L1-L31","documentation":"Sentinel error types.ErrIdentityProviderIssuerRequired (management/server/types/identity_provider.go:13), returned by IdentityProvider.Validate when the provider type has no built-in issuer (anything other than google and microsoft, per HasBuiltInIssuer) and the Issuer URL is empty. The issuer is the base URL NetBird uses to discover the OIDC endpoints.","triggerScenarios":"Saving an IdP of type oidc/zitadel/okta/keycloak/etc. with an empty issuer field; only google and microsoft types may omit it.","commonSituations":"Copying a Google-style payload and switching the type to oidc without adding the issuer; setup docs where the issuer line was skipped because it looked optional.","solutions":["Set Issuer to your OIDC issuer base URL, e.g. https://auth.example.com/realms/netbird","For Google or Microsoft types you may leave it empty; otherwise it is mandatory"],"exampleFix":"// before\nidp := &types.IdentityProvider{Name: \"KC\", Type: types.IdentityProviderTypeKeycloak, ClientID: \"netbird\"}\n\n// after\nidp := &types.IdentityProvider{Name: \"KC\", Type: types.IdentityProviderTypeKeycloak, Issuer: \"https://kc.example.com/realms/netbird\", ClientID: \"netbird\"}","handlingStrategy":"validation","validationCode":"if !idp.Type.HasBuiltInIssuer() && idp.Issuer == \"\" {\n    return types.ErrIdentityProviderIssuerRequired\n}","typeGuard":null,"tryCatchPattern":"if err := idp.Validate(); err != nil {\n    if errors.Is(err, types.ErrIdentityProviderIssuerRequired) {\n        // collect the issuer URL (only google/microsoft may omit it)\n    }\n    return err\n}","preventionTips":["Include the issuer URL as a mandatory field in IdP setup forms for every type except google and microsoft","Use HasBuiltInIssuer() logic client-side to decide whether the field is required","Document the issuer location for common providers (Keycloak realm URL, Authentik application issuer, etc.)"],"tags":["management","identity-provider","oidc","validation"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}