{"record":{"id":"89c9571e9377940b","repo":"googleapis/mcp-toolbox","slug":"jwks-uri-not-found-in-config","errorCode":null,"errorMessage":"jwks_uri not found in config","messagePattern":"jwks_uri not found in config","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":167,"sourceCode":"\tif err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tvar config struct {\n\t\tIssuer                string `json:\"issuer\"`\n\t\tJwksUri               string `json:\"jwks_uri\"`\n\t\tIntrospectionEndpoint string `json:\"introspection_endpoint\"`\n\t}\n\tif err := json.Unmarshal(body, &config); err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tif config.Issuer == \"\" {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"issuer not found in config\")\n\t}\n\n\tif config.JwksUri == \"\" {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"jwks_uri not found in config\")\n\t}\n\n\t// Sanitize the resulting JWKS URI before returning it\n\tparsedJWKS, err := url.Parse(config.JwksUri)\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"invalid jwks_uri detected\")\n\t}\n\tif parsedJWKS.Scheme != \"https\" {\n\t\tlog.Printf(\"WARNING: HTTP instead of HTTPS is being used for JWKS URI: %s\", config.JwksUri)\n\t}\n\n\treturn config.JwksUri, config.IntrospectionEndpoint, config.Issuer, nil\n}\n\nvar _ auth.MCPAuthService = AuthService{}\n\n// struct used to store auth service info\ntype AuthService struct {","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L149-L185","documentation":"The discovery document parsed fine and contained an issuer, but the 'jwks_uri' field was empty or missing. The jwks_uri is required to fetch the signing keys used for JWT verification, so initialization cannot continue without it.","triggerScenarios":"json.Unmarshal of the discovery body succeeds, config.Issuer is set, but config.JwksUri == \"\" — the provider's discovery document omits jwks_uri.","commonSituations":"Minimal or partially-compliant OIDC providers that omit jwks_uri; misconfigured auth middleware serving a trimmed discovery doc; a spoofed/incorrect discovery endpoint.","solutions":["curl the discovery URL and confirm \"jwks_uri\" is present and non-empty","Use a spec-compliant OIDC provider or fix the provider's discovery document","Ensure you are hitting the real discovery endpoint and not a stub/mock","If the provider serves keys at a known path but omits discovery, switch to an auth config that accepts an explicit JWKS URL"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"var doc struct{ JwksUri string `json:\"jwks_uri\"` }\njson.NewDecoder(resp.Body).Decode(&doc)\nif doc.JwksUri == \"\" {\n    return fmt.Errorf(\"discovery doc has no jwks_uri; provider not supported by generic auth\")\n}","typeGuard":null,"tryCatchPattern":"_, err := cfg.Initialize()\nif err != nil && strings.Contains(err.Error(), \"jwks_uri not found in config\") {\n    log.Fatalf(\"auth provider discovery lacks jwks_uri; switch providers or configure keys explicitly: %v\", err)\n}","preventionTips":["Verify the provider advertises jwks_uri in its discovery document during vendor evaluation","Pin a compliant auth server version in your deployment"],"tags":["go","oidc","jwks","discovery"],"backgroundTag":"oidc-discovery-invalid","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}