{"record":{"id":"8dca7c76f5444246","repo":"netbirdio/netbird","slug":"invalid-provider-configuration-received-from-manag-8dca7c","errorCode":null,"errorMessage":"invalid provider configuration received from management: %s value is empty. Contact your NetBird administrator","messagePattern":"invalid provider configuration received from management: (.+?) value is empty\\. Contact your NetBird administrator","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/internal/auth/pkce_flow.go","lineNumber":70,"sourceCode":"\tRedirectURLs []string\n\t// UseIDToken indicates if the id token should be used for authentication\n\tUseIDToken bool\n\t// ClientCertPair is used for mTLS authentication to the IDP\n\tClientCertPair *tls.Certificate\n\t// DisablePromptLogin makes the PKCE flow to not prompt the user for login\n\tDisablePromptLogin bool\n\t// LoginFlag is used to configure the PKCE flow login behavior\n\tLoginFlag common.LoginFlag\n\t// LoginHint is used to pre-fill the email/username field during authentication\n\tLoginHint string\n}\n\n// validatePKCEConfig validates PKCE provider configuration\nfunc validatePKCEConfig(config *PKCEAuthProviderConfig) error {\n\terrorMsgFormat := \"invalid provider configuration received from management: %s value is empty. Contact your NetBird administrator\"\n\n\tif config.ClientID == \"\" {\n\t\treturn fmt.Errorf(errorMsgFormat, \"Client ID\")\n\t}\n\tif config.TokenEndpoint == \"\" {\n\t\treturn fmt.Errorf(errorMsgFormat, \"Token Endpoint\")\n\t}\n\tif config.AuthorizationEndpoint == \"\" {\n\t\treturn fmt.Errorf(errorMsgFormat, \"Authorization Auth Endpoint\")\n\t}\n\tif config.Scope == \"\" {\n\t\treturn fmt.Errorf(errorMsgFormat, \"PKCE Auth Scopes\")\n\t}\n\tif config.RedirectURLs == nil {\n\t\treturn fmt.Errorf(errorMsgFormat, \"PKCE Redirect URLs\")\n\t}\n\treturn nil\n}\n\n// PKCEAuthorizationFlow implements the OAuthFlow interface for\n// the Authorization Code Flow with PKCE.","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/internal/auth/pkce_flow.go#L52-L88","documentation":"Raised by validatePKCEConfig when the PKCE provider configuration delivered by management has an empty ClientID (client/internal/auth/pkce_flow.go:69-71). The IdP application's client ID is the first mandatory field of PKCEAuthProviderConfig; an empty value means management handed the client an incomplete SSO provider configuration. This is an administrator-side configuration problem, not something the end user can fix locally.","triggerScenarios":"authenticateWithPKCEFlow builds the flow from management's login response and validatePKCEConfig rejects it because ClientID == ''. Happens when the IdP integration on management was saved without the application (client) ID, or a management version/API path returns a provider object with unset fields.","commonSituations":"Admin partially configured an IdP connector (filled domain/issuer but not the app ID); IdP config migration lost the client ID field; test/dev management instances with stubbed provider settings.","solutions":["Have the NetBird administrator complete the IdP configuration on management: set the IdP application Client ID","Re-fetch provider config on the management side (OIDC discovery) and save the integration again","End user: retry netbird up after the admin fixes the config; no local change helps"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// For administrators: assert the provider config is complete before publishing it\nfunc providerConfigComplete(c *auth.PKCEAuthProviderConfig) error {\n\tmissing := []string{}\n\tif c.ClientID == \"\" {\n\t\tmissing = append(missing, \"ClientID\")\n\t}\n\tif c.TokenEndpoint == \"\" {\n\t\tmissing = append(missing, \"TokenEndpoint\")\n\t}\n\tif c.AuthorizationEndpoint == \"\" {\n\t\tmissing = append(missing, \"AuthorizationEndpoint\")\n\t}\n\tif c.Scope == \"\" {\n\t\tmissing = append(missing, \"Scope\")\n\t}\n\tif c.RedirectURLs == nil {\n\t\tmissing = append(missing, \"RedirectURLs\")\n\t}\n\tif len(missing) > 0 {\n\t\treturn fmt.Errorf(\"incomplete IdP config, missing: %s\", strings.Join(missing, \", \"))\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"invalid provider configuration received from management\") {\n\t// administrator-side gap: report which field the message names and stop - no local workaround\n}","preventionTips":["Administrators: run OIDC discovery and verify every field is populated before saving the IdP integration","Automate config validation in the management pipeline so incomplete integrations cannot be saved","End users: recognize the 'Contact your NetBird administrator' wording as a server-side config issue"],"tags":["pkce","configuration","sso","idp","administrator"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}