{"record":{"id":"8069091f16c00fe2","repo":"rancher/rancher","slug":"getting-config-for-oidc-logout-w","errorCode":null,"errorMessage":"getting config for OIDC Logout: %w","messagePattern":"getting config for OIDC Logout: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/providers/cognito/cognito.go","lineNumber":68,"sourceCode":"\n// GetName returns the name of this provider.\nfunc (p *CognitoProvider) GetName() string {\n\treturn Name\n}\n\nfunc (p *CognitoProvider) RefetchGroupPrincipals(principalID string, secret string) ([]v3.Principal, error) {\n\treturn p.OpenIDCProvider.RefetchGroupPrincipals(principalID, secret)\n}\n\nfunc (p *CognitoProvider) UsesUserSecrets() bool      { return true }\nfunc (p *CognitoProvider) CanRefreshPrincipals() bool { return true }\n\nfunc (p *CognitoProvider) Logout(w http.ResponseWriter, r *http.Request, token accessor.TokenAccessor) error {\n\tproviderName := token.GetAuthProvider()\n\tlogrus.Debugf(\"CognitoProvider [logout]: triggered by provider %s\", providerName)\n\toidcConfig, err := p.GetConfig()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting config for OIDC Logout: %w\", err)\n\t}\n\tif oidcConfig.LogoutAllForced {\n\t\treturn fmt.Errorf(\"CognitoProvider [logout]: Rancher provider resource `%v` configured for forced SLO, rejecting regular logout\", providerName)\n\t}\n\n\treturn nil\n}\n\nfunc (p *CognitoProvider) LogoutAll(w http.ResponseWriter, r *http.Request, token accessor.TokenAccessor) error {\n\tlogrus.Debugf(\"CognitoProvider [logout-all]: triggered by provider %s\", token.GetAuthProvider())\n\toidcConfig, err := p.GetConfig()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tproviderName := token.GetAuthProvider()\n\tif !oidcConfig.LogoutAllEnabled {\n\t\treturn fmt.Errorf(\"CognitoProvider [logout-all]: Rancher provider resource `%v` not configured for SLO\", providerName)","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/cognito/cognito.go#L50-L86","documentation":"Raised by CognitoProvider.Logout when GetConfig fails. GetConfig resolves to OpenIDCProvider.GetOIDCConfig, which reads the cognito OIDCConfig authConfig object from the Kubernetes API, decodes its unstructured content, and reads referenced secrets (e.g. the private key). Failure means the stored provider configuration could not be fetched or interpreted — the logout request never reaches Cognito.","triggerScenarios":"The cognito authConfig CR is deleted or the API read fails; stored fields are corrupted so Decode fails; a referenced Kubernetes secret (private key and similar) is missing or unreadable; RBAC denies the read.","commonSituations":"Provider config partially deleted or hand-edited; secret removed during credential rotation; upgrade migrations leaving the authConfig in a shape the decoder rejects; API server connectivity issues at logout time.","solutions":["Inspect the stored object: kubectl get authconfig cognito -o yaml (or the management cluster equivalent) and verify it is intact","Re-save the Cognito configuration through the Rancher UI/auth API to regenerate a well-formed object and secret","Verify any referenced secrets still exist and contain the expected keys","Check the wrapped inner error — it distinguishes fetch failure, decode failure, and secret-read failure"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"oidcConfig, err := p.GetConfig()\nif err != nil {\n    // config-store problem, not a Cognito problem: distinguish fetch vs decode vs secret-read in the inner error\n    return fmt.Errorf(\"logout unavailable: Cognito authConfig unreadable: %w\", err)\n}","preventionTips":["Manage the Cognito authConfig and its secrets only through the Rancher API/UI so they stay well-formed","Include the authConfig object in backup/restore procedures and verify after upgrades","Alert on missing authConfig CRs so drift is caught before users log out"],"tags":["cognito","rancher","kubernetes","configuration","logout","go"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}