{"record":{"id":"90d72c8509ec4ebe","repo":"Budibase/budibase","slug":"error-constructing-oidc-authentication-strategy","errorCode":null,"errorMessage":"Error constructing OIDC authentication strategy - ${err}","messagePattern":"Error constructing OIDC authentication strategy - (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/backend-core/src/middleware/passport/sso/oidc.ts","lineNumber":193,"sourceCode":"  return false\n}\n\n/**\n * Create an instance of the oidc passport strategy. This wrapper fetches the configuration\n * from couchDB rather than environment variables, using this factory is necessary for dynamically configuring passport.\n * @returns Dynamically configured Passport OIDC Strategy\n */\nexport async function strategyFactory(\n  config: OIDCStrategyConfiguration,\n  saveUserFn: SaveSSOUserFunction\n) {\n  try {\n    const verify = buildVerifyFn(saveUserFn, config.allowUnverifiedEmailLinking)\n    const strategy = new OIDCStrategy(config, verify)\n    strategy.name = \"oidc\"\n    return strategy\n  } catch (err: any) {\n    throw new Error(`Error constructing OIDC authentication strategy - ${err}`)\n  }\n}\n\n/**\n * Resolves the effective allowUnverifiedEmailLinking value. A boot-time\n * environment override wins over the per-provider database value when set,\n * otherwise the database value is used.\n */\nfunction resolveAllowUnverifiedEmailLinking(\n  configValue?: boolean\n): boolean | undefined {\n  const override = env.OIDC_ALLOW_UNVERIFIED_EMAIL_LINKING\n  if (override === undefined) {\n    return configValue\n  }\n  const normalized = `${override}`.toLowerCase()\n  return normalized !== \"\" && normalized !== \"false\" && normalized !== \"0\"\n}","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/backend-core/src/middleware/passport/sso/oidc.ts#L175-L211","documentation":"strategyFactory wraps OIDCStrategy construction in try/catch and rethrows any failure with this prefix. It means the openid-client backed passport OIDC strategy constructor rejected the supplied issuer/client configuration. The original error is appended to the message.","triggerScenarios":"new OIDCStrategy(config, verify) throwing due to an invalid issuer, malformed clientID/secret, bad config shape, or an openid-client initialization failure (e.g. unreachable issuer metadata when the strategy validates it).","commonSituations":"OIDC provider saved with a typo in issuer or client secret; issuer URL unreachable at construction time; mismatch between saved config schema and the strategy version; allowUnverifiedEmailLinking passed with a wrong type.","solutions":["Read the appended original error text for the root cause","Validate the OIDC issuer URL is reachable and serves /.well-known/openid-configuration","Re-enter clientId/clientSecret/issuer/callback URL in the SSO provider config, checking for whitespace and truncation","Confirm openid-client / passport dependency versions are consistent after upgrades"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"async function validateOidcIssuer(issuerUrl) {\n  const res = await fetch(new URL(\".well-known/openid-configuration\", issuerUrl).toString())\n  if (!res.ok) throw new Error(`issuer discovery returned ${res.status}`)\n  const body = await res.json()\n  return Boolean(body.issuer && body.authorization_endpoint && body.token_endpoint)\n}","typeGuard":"function isOidcStrategyConfig(config): config is Required<OidcConfig> {\n  return Boolean(config && typeof config.issuer === \"string\" && typeof config.clientID === \"string\" && typeof config.clientSecret === \"string\")\n}","tryCatchPattern":"try {\n  const strategy = await strategyFactory(config)\n} catch (err) {\n  if (String(err.message).startsWith(\"Error constructing OIDC authentication strategy\")) {\n    // inspect text after '-' for the underlying openid-client error\n  }\n}","preventionTips":["Verify the issuer URL serves valid discovery metadata from the server before saving provider config","Enter credentials without leading/trailing whitespace","Keep openid-client and passport dependencies in the versions the provider config schema expects","Smoke-test OIDC login in CI against a test realm (e.g. Keycloak)"],"tags":["sso","oidc","passport","configuration"],"backgroundTag":"sso-provider-configuration-invalid","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}