{"record":{"id":"a1dc3a565d9251d6","repo":"netbirdio/netbird","slug":"identity-provider-issuer-is-unreachable","errorCode":null,"errorMessage":"identity provider issuer is unreachable","messagePattern":"identity provider issuer is unreachable","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"management/server/types/identity_provider.go","lineNumber":15,"sourceCode":"package types\n\nimport (\n\t\"errors\"\n\t\"net/url\"\n)\n\n// Identity provider validation errors\nvar (\n\tErrIdentityProviderNameRequired      = errors.New(\"identity provider name is required\")\n\tErrIdentityProviderTypeRequired      = errors.New(\"identity provider type is required\")\n\tErrIdentityProviderTypeUnsupported   = errors.New(\"unsupported identity provider type\")\n\tErrIdentityProviderIssuerRequired    = errors.New(\"identity provider issuer is required\")\n\tErrIdentityProviderIssuerInvalid     = errors.New(\"identity provider issuer must be a valid URL\")\n\tErrIdentityProviderIssuerUnreachable = errors.New(\"identity provider issuer is unreachable\")\n\tErrIdentityProviderIssuerMismatch    = errors.New(\"identity provider issuer does not match the issuer returned by the provider\")\n\tErrIdentityProviderClientIDRequired  = errors.New(\"identity provider client ID is required\")\n)\n\n// IdentityProviderType is the type of identity provider\ntype IdentityProviderType string\n\nconst (\n\t// IdentityProviderTypeOIDC is a generic OIDC identity provider\n\tIdentityProviderTypeOIDC IdentityProviderType = \"oidc\"\n\t// IdentityProviderTypeZitadel is the Zitadel identity provider\n\tIdentityProviderTypeZitadel IdentityProviderType = \"zitadel\"\n\t// IdentityProviderTypeEntra is the Microsoft Entra (Azure AD) identity provider\n\tIdentityProviderTypeEntra IdentityProviderType = \"entra\"\n\t// IdentityProviderTypeGoogle is the Google identity provider\n\tIdentityProviderTypeGoogle IdentityProviderType = \"google\"\n\t// IdentityProviderTypeOkta is the Okta identity provider\n\tIdentityProviderTypeOkta IdentityProviderType = \"okta\"","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/management/server/types/identity_provider.go#L1-L33","documentation":"Sentinel error types.ErrIdentityProviderIssuerUnreachable (management/server/types/identity_provider.go:15), wrapped by validateOIDCIssuer (management/server/identity_provider.go:33-70): when saving an IdP config, management performs a live GET of {issuer}/.well-known/openid-configuration with a 10s timeout. This error means that probe failed to connect, returned a non-200 status, or the body was not a discovery document.","triggerScenarios":"Saving an IdP whose issuer host cannot be reached from the management server process: DNS failure, firewall/proxy block, TLS handshake failure, 404/500 from the well-known path, or a >10s slow response. The exact cause is appended (%w wrap with status/body/err detail).","commonSituations":"Management running in Docker/Kubernetes without access to the internal IdP host; IdP behind a self-signed certificate not trusted by the management container; issuer pointing to the public URL while the IdP is only reachable internally; IdP briefly down during IaC apply.","solutions":["From inside the management container/host, curl the exact URL in the error: {issuer}/.well-known/openid-configuration and confirm HTTP 200","Fix the network path: DNS resolution, egress proxy env vars, firewall rules, or use an issuer host reachable from management","If TLS is the cause, make sure the IdP certificate chain is valid for the management host (CA bundle of the container)","If the IdP was transiently down, retry the save once it is healthy"],"exampleFix":"// before: issuer only resolvable from user laptops, not from management\nidp.Issuer = \"https://sso.corp.internal/realms/nb\" // management container cannot resolve corp.internal\n\n// after: issuer reachable from the management network\nidp.Issuer = \"https://sso.internal.svc.cluster.local/realms/nb\"","handlingStrategy":"retry","validationCode":"// Pre-flight from the same host/container that runs management\nfunc issuerReachable(ctx context.Context, issuer string) error {\n    c := &http.Client{Timeout: 10 * time.Second}\n    req, _ := http.NewRequestWithContext(ctx, http.MethodGet,\n        strings.TrimSuffix(issuer, \"/\")+\"/.well-known/openid-configuration\", nil)\n    resp, err := c.Do(req)\n    if err != nil { return err }\n    defer resp.Body.Close()\n    if resp.StatusCode != http.StatusOK { return fmt.Errorf(\"discovery returned %s\", resp.Status) }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"err := saveIdP(ctx, idp)\nif err != nil && errors.Is(err, types.ErrIdentityProviderIssuerUnreachable) {\n    // read the wrapped cause; only retry for transient causes (timeouts, 503),\n    // fix DNS/firewall/TLS for permanent ones\n}","preventionTips":["curl the discovery URL from inside the management container before configuring the IdP","Ensure egress proxy/DNS env vars of the management process cover the IdP host","Keep IdP certificates valid and trusted by the management host's CA bundle"],"tags":["management","identity-provider","oidc","network","connectivity"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}