{"record":{"id":"778ff7aa728611f8","repo":"Budibase/budibase","slug":"error-constructing-oidc-authentication-configurati","errorCode":null,"errorMessage":"Error constructing OIDC authentication configuration - ${err}","messagePattern":"Error constructing OIDC authentication configuration - (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/backend-core/src/middleware/passport/sso/oidc.ts","lineNumber":257,"sourceCode":"    }\n\n    const body = await response.json()\n\n    return {\n      issuer: body.issuer,\n      authorizationURL: body.authorization_endpoint,\n      tokenURL: body.token_endpoint,\n      userInfoURL: body.userinfo_endpoint,\n      clientID: clientID,\n      clientSecret: clientSecret,\n      callbackURL: callbackUrl,\n      pkce: pkce,\n      allowUnverifiedEmailLinking: resolveAllowUnverifiedEmailLinking(\n        allowUnverifiedEmailLinking\n      ),\n    }\n  } catch (err) {\n    throw new Error(\n      `Error constructing OIDC authentication configuration - ${err}`\n    )\n  }\n}\n\nexport async function getCallbackUrl() {\n  return ssoCallbackUrl(ConfigType.OIDC)\n}\n","sourceCodeStart":239,"sourceCodeEnd":266,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/backend-core/src/middleware/passport/sso/oidc.ts#L239-L266","documentation":"This is the outer catch of fetchStrategyConfig: any error thrown while building the enriched OIDC configuration (required-field validation, the discovery fetch, JSON parsing of the response, or downstream enrichment like resolving allowUnverifiedEmailLinking) is rewrapped with this prefix. The original error text is appended after the dash.","triggerScenarios":"Anything inside the try block throwing: the field validation error (43), the non-ok fetch error (44), response.json() failing on non-JSON body (e.g. an HTML error page or WAF block page), or unexpected undefined fields in the discovery body.","commonSituations":"IdP behind a proxy returning HTML instead of JSON; intermittent network failure during discovery; discovery document missing expected endpoints; concurrent refresh of a half-updated provider config.","solutions":["Inspect the text after the dash in the message — it contains the original error (e.g. 'Unexpected response...' or a JSON parse error)","curl configUrl from the server and confirm the body is valid JSON openid-configuration metadata","Check for proxies/WAFs that may intercept the server's outbound request and return HTML","Fix the underlying cause (URL, network, IdP health) and retry the SSO login or token refresh"],"exampleFix":"// before\nconfigUrl: \"https://idp.example.com/login\" // returns HTML login page -> json() throws\n// after\nconfigUrl: \"https://idp.example.com/.well-known/openid-configuration\" // returns JSON","handlingStrategy":"try-catch","validationCode":"async function discoveryIsValid(configUrl) {\n  const res = await fetch(configUrl)\n  if (!res.ok) throw new Error(`discovery HTTP ${res.status}`)\n  const body = await res.json() // throws early on non-JSON bodies\n  return Boolean(body.authorization_endpoint && body.token_endpoint)\n}","typeGuard":null,"tryCatchPattern":"try {\n  const config = await enrichedConfig(provider)\n} catch (err) {\n  if (String(err.message).startsWith(\"Error constructing OIDC authentication configuration\")) {\n    // the text after '-' names the inner cause: validation, fetch, or JSON parse\n  }\n}","preventionTips":["Always point configUrl at the JSON discovery endpoint, never an HTML page","Check for intercepting proxies/WAFs returning HTML to server-side requests","Log response bodies (truncated) on discovery failure for faster diagnosis","Retry transient network failures with backoff in any custom refresh logic"],"tags":["oidc","configuration","network","json"],"backgroundTag":"http-request-failed","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}