{"record":{"id":"81fc678f5601f6de","repo":"crewAIInc/crewAI","slug":"missing-authentication-provider-required-fields-in","errorCode":null,"errorMessage":"Missing authentication provider required fields in OAuth2 configuration: [{', '.join(missing_provider_specific_fields)}] (Configured provider: '{oauth_config['provider']}')","messagePattern":"Missing authentication provider required fields in OAuth2 configuration: \\[(.+?)\\] \\(Configured provider: '(.+?)'\\)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"lib/cli/src/crewai_cli/enterprise/main.py","lineNumber":116,"sourceCode":"            \"extra\",\n        ]\n\n        missing_basic_fields = [\n            field for field in required_fields if field not in oauth_config\n        ]\n        missing_provider_specific_fields = [\n            field\n            for field in self._get_provider_specific_fields(oauth_config[\"provider\"])\n            if field not in oauth_config.get(\"extra\", {})\n        ]\n\n        if missing_basic_fields:\n            raise ValueError(\n                f\"Missing required fields in OAuth2 configuration: [{', '.join(missing_basic_fields)}]\"\n            )\n\n        if missing_provider_specific_fields:\n            raise ValueError(\n                f\"Missing authentication provider required fields in OAuth2 configuration: [{', '.join(missing_provider_specific_fields)}] (Configured provider: '{oauth_config['provider']}')\"\n            )\n\n    def _get_provider_specific_fields(self, provider_name: str) -> list[str]:\n        provider = ProviderFactory.from_settings(\n            Oauth2Settings(provider=provider_name, client_id=\"dummy\", domain=\"dummy\")\n        )\n\n        return provider.get_required_fields()\n","sourceCodeStart":98,"sourceCodeEnd":126,"githubUrl":"https://github.com/crewAIInc/crewAI/blob/754d7323beb2fd042e33444a115ea2d5a47193f0/lib/cli/src/crewai_cli/enterprise/main.py#L98-L126","documentation":"Validation error from enterprise OAuth2 discovery: the top-level fields are present, but the provider-specific required fields inside oauth_config['extra'] are missing. The CLI builds the provider via ProviderFactory.from_settings and calls get_required_fields(); any field that provider demands (e.g. tenant_id for Azure AD style providers) absent from `extra` triggers this. The message lists missing fields and names the configured provider.","triggerScenarios":"`crewai enterprise connect <url>` where the discovery document declares provider X but the `extra` object lacks the fields provider X requires — typical when an enterprise adds a new OAuth provider (Okta, Azure AD, Keycloak...) but does not populate provider-specific claims in the discovery response.","commonSituations":"Enterprise admins enabling a new IdP without completing provider-specific config; CLI updated with stricter/newer per-provider requirements than the server emits; discovery documents reused across environments where tenant/auth-url specifics differ.","solutions":["Read the message: it names the exact missing fields and the configured provider","Have the enterprise admin add those fields to the `extra` section of the discovery endpoint response","If the CLI was recently upgraded and the server is older, align versions (upgrade server or pin CLI)","Verify with curl that extra now contains the listed fields, then re-run connect"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"def extra_fields_sufficient(doc: dict) -> bool:\n    provider = doc.get(\"provider\")\n    extra = doc.get(\"extra\") or {}\n    # mirror the CLI: provider factories declare their required fields\n    from crewai_cli.authentication.providers.factory import ProviderFactory\n    from crewai_cli.authentication.schemas import Oauth2Settings\n    needed = ProviderFactory.from_settings(Oauth2Settings(provider=provider, client_id=\"x\", domain=\"x\")).get_required_fields()\n    return all(f in extra for f in needed)","typeGuard":"def provider_extra_valid(provider: str, extra: object) -> bool:\n    return isinstance(extra, dict)  # full check requires the provider factory's field list","tryCatchPattern":"try:\n    enterprise_cmd.connect(url)\nexcept ValueError as e:\n    if \"authentication provider required fields\" in str(e):\n        # parse missing field names and the provider from the message for the admin\n        ...","preventionTips":["Pre-validate the discovery doc's extra section per provider before onboarding","When the enterprise adds an IdP, test connect with one CLI user first","Upgrade CLI whenever the enterprise adds a new OAuth provider type"],"tags":["enterprise","oauth","validation","provider"],"backgroundTag":null,"analyzedSha":"754d7323beb2fd042e33444a115ea2d5a47193f0","analyzedAt":"2026-08-15T04:06:56.746Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}