{"record":{"id":"8d615fcd19e72839","repo":"vxcontrol/pentagi","slug":"could-not-create-google-openid-client-w","errorCode":null,"errorMessage":"could not create Google OpenID client: %w","messagePattern":"could not create Google OpenID client: %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/pkg/server/oauth/google.go","lineNumber":22,"sourceCode":"\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/coreos/go-oidc/v3/oidc\"\n\t\"golang.org/x/oauth2\"\n\t\"golang.org/x/oauth2/google\"\n)\n\ntype googleTokenClaims struct {\n\tNonce         string `json:\"nonce\"`\n\tEmail         string `json:\"email\"`\n\tEmailVerified bool   `json:\"email_verified\"`\n}\n\nfunc newGoogleEmailResolver(clientID string) OAuthEmailResolver {\n\treturn func(ctx context.Context, nonce string, token *oauth2.Token) (string, bool, error) {\n\t\tprovider, err := oidc.NewProvider(ctx, \"https://accounts.google.com\")\n\t\tif err != nil {\n\t\t\treturn \"\", false, fmt.Errorf(\"could not create Google OpenID client: %w\", err)\n\t\t}\n\n\t\toidToken, ok := token.Extra(\"id_token\").(string)\n\t\tif !ok {\n\t\t\treturn \"\", false, fmt.Errorf(\"id_token is not present in the token\")\n\t\t}\n\n\t\tverifier := provider.Verifier(&oidc.Config{ClientID: clientID})\n\t\tidToken, err := verifier.Verify(ctx, oidToken)\n\t\tif err != nil {\n\t\t\treturn \"\", false, fmt.Errorf(\"could not verify Google ID Token: %w\", err)\n\t\t}\n\n\t\tif idToken.Nonce != nonce {\n\t\t\treturn \"\", false, fmt.Errorf(\"nonce mismatch in Google ID Token\")\n\t\t}\n\n\t\tif err = idToken.VerifyAccessToken(token.AccessToken); err != nil {","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/server/oauth/google.go#L4-L40","documentation":"Inside newGoogleEmailResolver (backend/pkg/server/oauth/google.go:22), oidc.NewProvider fetches Google's OpenID Connect discovery document from https://accounts.google.com. If that HTTP discovery request fails, the error is wrapped as \"could not create Google OpenID client\" and the email resolver aborts before any token is inspected.","triggerScenarios":"Any callback-time invocation where oidc.NewProvider cannot reach or parse the discovery document: network/DNS failure, blocked egress, TLS interception, or Google returning a non-200/error response.","commonSituations":"Backend running in an air-gapped or firewalled environment without access to accounts.google.com; corporate proxy with TLS re-signing; Docker/Compose network without outbound internet; transient Google outage during login.","solutions":["Restore outbound HTTPS connectivity to https://accounts.google.com from the backend (proxy/firewall/DNS).","If a proxy is required, configure HTTPS_PROXY for the process.","Cache the OIDC provider (create it once at startup) instead of per-request to reduce discovery calls and surface config issues early.","Retry the login if the failure was transient."],"exampleFix":"// before (per request)\nprovider, err := oidc.NewProvider(ctx, \"https://accounts.google.com\")\n\n// after (once at startup)\nvar googleProvider *oidc.Provider\nfunc initGoogleOIDC(ctx context.Context) error {\n    p, err := oidc.NewProvider(ctx, \"https://accounts.google.com\")\n    if err != nil {\n        return err\n    }\n    googleProvider = p\n    return nil\n}","handlingStrategy":"try-catch","validationCode":"// preflight reachability of Google's OIDC discovery document\nreq, _ := http.NewRequestWithContext(ctx, http.MethodGet, \"https://accounts.google.com/.well-known/openid-configuration\", nil)\nresp, err := http.DefaultClient.Do(req)\nif err != nil {\n    return fmt.Errorf(\"Google OIDC discovery unreachable (check egress/proxy/DNS): %w\", err)\n}\nresp.Body.Close()","typeGuard":null,"tryCatchPattern":"email, verified, err := googleEmailResolver(ctx, nonce, token)\nif err != nil {\n    var ue *url.Error\n    if errors.As(err, &ue) || strings.Contains(err.Error(), \"could not create Google OpenID client\") {\n        return \"\", false, fmt.Errorf(\"sign-in temporarily unavailable (cannot reach Google); retry\")\n    }\n    return \"\", false, err\n}","preventionTips":["Ensure the backend has outbound HTTPS to accounts.google.com (firewall, proxy, DNS).","Set HTTPS_PROXY explicitly in containerized deployments that need egress via a proxy.","Construct the oidc.Provider once at startup to fail fast on misconfig instead of at login time.","Add a health check that pings the discovery endpoint."],"tags":["oauth","oidc","google","network"],"backgroundTag":"oidc-discovery-failed","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}