{"record":{"id":"92a32a542a1cb6dd","repo":"PrefectHQ/fastmcp","slug":"missing-required-configuration-metadata-attr","errorCode":null,"errorMessage":"Missing required configuration metadata: {attr}","messagePattern":"Missing required configuration metadata: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"fastmcp_slim/fastmcp/server/auth/oidc_proxy.py","lineNumber":128,"sourceCode":"        None\n    )\n\n    code_challenge_methods_supported: Sequence[str] | None = None\n\n    signed_metadata: str | None = None\n\n    @model_validator(mode=\"after\")\n    def _enforce_strict(self) -> Self:\n        \"\"\"Enforce strict rules.\"\"\"\n        if not self.strict:\n            return self\n\n        def enforce(attr: str, is_url: bool = False) -> None:\n            value = getattr(self, attr, None)\n            if not value:\n                message = f\"Missing required configuration metadata: {attr}\"\n                logger.error(message)\n                raise ValueError(message)\n\n            if not is_url or isinstance(value, AnyHttpUrl):\n                return\n\n            try:\n                AnyHttpUrl(value)\n            except Exception as e:\n                message = f\"Invalid URL for configuration metadata: {attr}\"\n                logger.error(message)\n                raise ValueError(message) from e\n\n        enforce(\"issuer\", True)\n        enforce(\"authorization_endpoint\", True)\n        enforce(\"token_endpoint\", True)\n        enforce(\"jwks_uri\", True)\n        enforce(\"response_types_supported\")\n        enforce(\"subject_types_supported\")\n        enforce(\"id_token_signing_alg_values_supported\")","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/PrefectHQ/fastmcp/blob/1f021142978e0861cd910c8df4e8074bc7cf3978/fastmcp_slim/fastmcp/server/auth/oidc_proxy.py#L110-L146","documentation":"In strict mode, the OIDC proxy validates that all required provider metadata fields were discovered/populated, raising ValueError for the first missing attribute. The message names the missing attribute (issuer, authorization_endpoint, token_endpoint, jwks_uri, or response_types_supported). It guards against running with an incomplete discovery document.","triggerScenarios":"Constructing OIDCProxy with strict validation while the fetched/discovered metadata dict lacks a required key — e.g. a non-compliant provider or a failed/partial discovery fetch that fell back to empty values.","commonSituations":"Provider's /.well-known/openid-configuration omits fields (some UMA/token-only issuers); discovery URL points to the wrong path; network/proxy truncating the discovery response.","solutions":["Verify the issuer's discovery URL returns a complete OpenID Connect discovery document (curl it and check for the named field)","If the provider is non-compliant, supply the missing metadata explicitly instead of relying on discovery, or disable strict validation if you accept the risk","Ensure discovery actually succeeded — check logs for earlier fetch errors"],"exampleFix":"// before: strict proxy with non-compliant provider\nproxy = OIDCProxy(config_url=..., strict=True)\n// after: provide endpoints explicitly or relax strict\nproxy = OIDCProxy(config_url=..., strict=False)  # after verifying endpoints manually","handlingStrategy":"validation","validationCode":"required = [\"issuer\", \"authorization_endpoint\", \"token_endpoint\", \"jwks_uri\", \"response_types_supported\"]\nmeta = httpx.get(config_url).json()\nmissing = [k for k in required if not meta.get(k)]\nif missing:\n    raise ValueError(f\"provider discovery document missing: {missing}\")","typeGuard":"def is_complete_discovery(meta: dict) -> bool:\n    return all(meta.get(k) for k in\n        (\"issuer\", \"authorization_endpoint\", \"token_endpoint\", \"jwks_uri\", \"response_types_supported\"))","tryCatchPattern":"try:\n    proxy = OIDCProxy(config_url=..., strict=True)\nexcept ValueError as e:\n    logger.error(\"OIDC metadata incomplete: %s\", e)\n    raise SystemExit(1)","preventionTips":["Curl the discovery URL and check all required fields before wiring it in","Prefer providers with compliant discovery documents, or supply endpoints explicitly","Keep strict mode on in production to fail fast on bad metadata"],"tags":["oidc","configuration","discovery","validation"],"backgroundTag":"oauth-metadata-validation-failed","analyzedSha":"1f021142978e0861cd910c8df4e8074bc7cf3978","analyzedAt":"2026-08-29T14:31:16.082Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}