{"record":{"id":"89878bdd952f3ec4","repo":"Tencent/WeKnora","slug":"oidc-discovery-document-missing-required-endpoints","errorCode":null,"errorMessage":"OIDC discovery document missing required endpoints","messagePattern":"OIDC discovery document missing required endpoints","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/user.go","lineNumber":1492,"sourceCode":"func oidcNeedsDiscovery(cfg *config.OIDCAuthConfig) bool {\n\treturn strings.TrimSpace(cfg.AuthorizationEndpoint) == \"\" ||\n\t\tstrings.TrimSpace(cfg.TokenEndpoint) == \"\" ||\n\t\tstrings.TrimSpace(cfg.JwksURI) == \"\" ||\n\t\tstrings.TrimSpace(cfg.IssuerURL) == \"\"\n}\n\nfunc (s *userService) populateOIDCEndpoints(ctx context.Context, cfg *config.OIDCAuthConfig) error {\n\tif oidcNeedsDiscovery(cfg) {\n\t\tif strings.TrimSpace(cfg.DiscoveryURL) == \"\" {\n\t\t\tif strings.TrimSpace(cfg.AuthorizationEndpoint) == \"\" || strings.TrimSpace(cfg.TokenEndpoint) == \"\" {\n\t\t\t\treturn errors.New(\"OIDC discovery_url or explicit endpoints are required\")\n\t\t\t}\n\t\t} else if err := s.applyOIDCDiscoveryDocument(ctx, cfg); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\tif strings.TrimSpace(cfg.AuthorizationEndpoint) == \"\" || strings.TrimSpace(cfg.TokenEndpoint) == \"\" {\n\t\treturn errors.New(\"OIDC discovery document missing required endpoints\")\n\t}\n\treturn validateOIDCEndpoints(cfg)\n}\n\nfunc (s *userService) applyOIDCDiscoveryDocument(ctx context.Context, cfg *config.OIDCAuthConfig) error {\n\tif err := validateOIDCEndpoint(\"discovery\", cfg.DiscoveryURL, true); err != nil {\n\t\treturn err\n\t}\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, cfg.DiscoveryURL, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create OIDC discovery request: %w\", err)\n\t}\n\n\tresp, err := newOIDCHTTPClient().Do(req)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to load OIDC discovery document: %w\", err)\n\t}","sourceCodeStart":1474,"sourceCodeEnd":1510,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/user.go#L1474-L1510","documentation":"Raised in populateOIDCEndpoints when the discovery document fetched from discovery_url lacks the endpoints required to fill oidcNeedsDiscovery's gaps — the IdP's .well-known/openid-configuration is incomplete or malformed. Remote-metadata validation failure.","triggerScenarios":"Thrown at internal/application/service/user.go:1492 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the IdP publishes a complete discovery document with authorization_endpoint, token_endpoint and jwks_uri","Supply the missing endpoints explicitly in config instead of relying on discovery"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}