{"record":{"id":"778c0bd9d10016c7","repo":"prestodb/presto","slug":"invalid-response-from-openid-metadata-endpoint","errorCode":null,"errorMessage":"Invalid response from OpenID Metadata endpoint: ","messagePattern":"Invalid response from OpenID Metadata endpoint: ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OidcDiscovery.java","lineNumber":100,"sourceCode":"    public OAuth2ServerConfig get()\n    {\n        return Failsafe.with(new RetryPolicy<>()\n                        .withMaxAttempts(-1)\n                        .withMaxDuration(discoveryTimeout)\n                        .withDelay(Duration.ofSeconds(1))\n                        .abortOn(IllegalStateException.class)\n                        .onFailedAttempt(attempt -> LOG.debug(\"OpenID Connect Metadata read failed: %s\", attempt.getLastFailure())))\n                .get(() -> httpClient.execute(new OIDCProviderConfigurationRequest(issuer), this::parseConfigurationResponse));\n    }\n\n    private OAuth2ServerConfig parseConfigurationResponse(HTTPResponse response)\n            throws ParseException\n    {\n        int statusCode = response.getStatusCode();\n        if (statusCode != OK.code()) {\n            // stop on any client errors other than REQUEST_TIMEOUT and TOO_MANY_REQUESTS\n            if (statusCode < 400 || statusCode >= 500 || statusCode == REQUEST_TIMEOUT.code() || statusCode == TOO_MANY_REQUESTS.code()) {\n                throw new RuntimeException(\"Invalid response from OpenID Metadata endpoint: \" + statusCode);\n            }\n            else {\n                throw new IllegalStateException(format(\"Invalid response from OpenID Metadata endpoint. Expected response code to be %s, but was %s\", OK.code(), statusCode));\n            }\n        }\n        return readConfiguration(response.getContent());\n    }\n\n    private OAuth2ServerConfig readConfiguration(String body)\n            throws ParseException\n    {\n        OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(body);\n        checkMetadataState(issuer.equals(metadata.getIssuer()), \"The value of the \\\"issuer\\\" claim in Metadata document different than the Issuer URL used for the Configuration Request.\");\n        try {\n            JsonNode metadataJson = OBJECT_MAPPER.readTree(body);\n            Optional<String> userinfoEndpoint;\n            if (userinfoEndpointEnabled) {\n                userinfoEndpoint = getOptionalField(\"userinfo_endpoint\", Optional.ofNullable(metadata.getUserInfoEndpointURI()).map(URI::toString), USERINFO_URL, userinfoUrl);","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OidcDiscovery.java#L82-L118","documentation":"OidcDiscovery.parseConfigurationResponse could not parse the OpenID Provider Metadata document (JSON parse failure or missing/invalid required fields); the parse error details are appended. Discovery via the issuer's well-known endpoint did not yield a usable configuration.","triggerScenarios":"Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OidcDiscovery.java:100 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the oauth issuer URL points at a compliant OIDC provider","Fetch the .well-known/openid-configuration URL manually and validate the JSON"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}