{"record":{"id":"8096d775b4a6db4d","repo":"netbirdio/netbird","slug":"authentication-failed-s","errorCode":null,"errorMessage":"authentication failed: %s","messagePattern":"authentication failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/internal/auth/pkce_flow.go","lineNumber":262,"sourceCode":"\t\t}\n\n\t\trenderPKCEFlowTmpl(w, nil)\n\t\ttokenChan <- token\n\t})\n\n\tserver.Handler = mux\n\tif err := server.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {\n\t\terrChan <- err\n\t}\n}\n\nfunc (p *PKCEAuthorizationFlow) handleRequest(req *http.Request) (*oauth2.Token, error) {\n\tquery := req.URL.Query()\n\n\tif authError := query.Get(queryError); authError != \"\" {\n\t\tauthErrorDesc := query.Get(queryErrorDesc)\n\t\tif authErrorDesc != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"authentication failed: %s\", authErrorDesc)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"authentication failed: %s\", authError)\n\t}\n\n\t// Prevent timing attacks on the state\n\tif state := query.Get(queryState); subtle.ConstantTimeCompare([]byte(p.state), []byte(state)) == 0 {\n\t\treturn nil, fmt.Errorf(\"authentication failed: Invalid state\")\n\t}\n\n\tcode := query.Get(queryCode)\n\tif code == \"\" {\n\t\treturn nil, fmt.Errorf(\"authentication failed: missing code\")\n\t}\n\n\texchangeStart := time.Now()\n\ttoken, err := p.oAuthConfig.Exchange(\n\t\treq.Context(),\n\t\tcode,","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/internal/auth/pkce_flow.go#L244-L280","documentation":"The IdP redirected back to the local callback with the RFC 6749 error parameter set and an error_description present. This is the provider's own refusal of the authorization request, surfaced verbatim: for example 'access_denied' with a consent message, 'invalid_scope', or a tenant policy explanation from Azure AD / Auth0 / Keycloak.","triggerScenarios":"Callback query contains a non-empty error and a non-empty error_description: the user denied the consent prompt, a requested scope is not granted to the IdP application, conditional-access or MFA policy blocked the sign-in, or the application is misconfigured for the authorization-code grant.","commonSituations":"User cancels the consent screen; IdP app lacks admin consent for scopes such as offline_access or openid; tenant administrators disabled user consent; conditional access requires a compliant or domain-joined device; scope names in management's IdP config do not match what the app exposes.","solutions":["Read the description text - it is the IdP's verbatim explanation and points at the exact consent or policy problem.","Retry the login and complete the consent step; if consent was denied by policy, an IdP tenant admin must grant admin consent for the requested scopes.","Ask the NetBird administrator to verify the IdP application's API permissions and scopes match the PKCE provider configuration.","If a conditional-access or MFA policy blocks the client, satisfy the policy (compliant device, approved network) or have it relaxed for this application."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"_, err := flow.WaitToken(ctx, info)\nif err != nil && strings.Contains(err.Error(), \"authentication failed:\") {\n    // err.Error() embeds the IdP's verbatim error_description;\n    // surface it to the user and map known codes (access_denied, invalid_scope)\n    // to remediation prompts instead of retrying blindly\n}","preventionTips":["Pre-grant admin consent for all requested scopes (openid, offline_access, profile, email) in the IdP tenant.","Keep the scopes configured in NetBird's IdP settings within what the IdP application exposes.","Review conditional-access policies that silently deny non-compliant clients before rolling out logins."],"tags":["oauth2","idp","consent","authentication"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}