{"record":{"id":"88a834a59216f540","repo":"Budibase/budibase","slug":"unexpected-response-when-fetching-openid-configura","errorCode":null,"errorMessage":"Unexpected response when fetching openid-configuration: ${response.statusText}","messagePattern":"Unexpected response when fetching openid-configuration: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/backend-core/src/middleware/passport/sso/oidc.ts","lineNumber":236,"sourceCode":"    const {\n      clientID,\n      clientSecret,\n      configUrl,\n      pkce,\n      allowUnverifiedEmailLinking,\n    } = oidcConfig\n\n    if (!clientID || !clientSecret || !callbackUrl || !configUrl) {\n      // check for remote config and all required elements\n      throw new Error(\n        \"Configuration invalid. Must contain clientID, clientSecret, callbackUrl and configUrl\"\n      )\n    }\n\n    const response = await fetch(configUrl)\n\n    if (!response.ok) {\n      throw new Error(\n        `Unexpected response when fetching openid-configuration: ${response.statusText}`\n      )\n    }\n\n    const body = await response.json()\n\n    return {\n      issuer: body.issuer,\n      authorizationURL: body.authorization_endpoint,\n      tokenURL: body.token_endpoint,\n      userInfoURL: body.userinfo_endpoint,\n      clientID: clientID,\n      clientSecret: clientSecret,\n      callbackURL: callbackUrl,\n      pkce: pkce,\n      allowUnverifiedEmailLinking: resolveAllowUnverifiedEmailLinking(\n        allowUnverifiedEmailLinking\n      ),","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/backend-core/src/middleware/passport/sso/oidc.ts#L218-L254","documentation":"After fetching the OIDC discovery document (openid-configuration) from configUrl, fetchStrategyConfig checks response.ok. Any non-2xx HTTP status causes this error with the statusText embedded. It indicates the IdP's discovery endpoint refused the request rather than returning metadata.","triggerScenarios":"fetch(configUrl) returns 401/403/404/500 — e.g. wrong discovery URL, IdP requiring auth or IP allowlisting, or the IdP being down.","commonSituations":"configUrl typo (404); self-hosted Keycloak realm name wrong in the URL; corporate firewall blocking the server's outbound request; IdP temporarily unavailable during login or token refresh.","solutions":["Verify configUrl returns 200 when curled from the Budibase server host (network/DNS/firewall can differ from your laptop)","Check the statusText in the message: 404 → fix the discovery URL/realm name; 401/403 → remove auth requirements or allowlist the server IP","Confirm the IdP service is up and serving /.well-known/openid-configuration","Retry after transient IdP downtime, especially if this surfaced during refreshOIDCAccessToken"],"exampleFix":"// before\nconfigUrl: \"https://keycloak.example.com/realms/wrong/.well-known/openid-configuration\" // 404\n// after\nconfigUrl: \"https://keycloak.example.com/realms/master/.well-known/openid-configuration\"","handlingStrategy":"retry","validationCode":"async function discoveryReachable(configUrl) {\n  try {\n    const res = await fetch(configUrl)\n    return res.ok\n  } catch {\n    return false\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  await enrichedConfig(provider)\n} catch (err) {\n  if (String(err.message).startsWith(\"Unexpected response when fetching openid-configuration\")) {\n    // exponential backoff retry for transient 5xx; alert on persistent 401/403/404\n  }\n}","preventionTips":["curl the configUrl from the server host during setup to confirm 200 + JSON","Use the exact issuer-based discovery URL including the correct realm/tenant path","Allowlist the server's egress IP at the IdP/proxy if it restricts access","Monitor IdP health; alert when discovery fetches fail repeatedly"],"tags":["network","oidc","http","discovery"],"backgroundTag":"http-request-failed","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}