{"record":{"id":"a7d309271ca7ba74","repo":"ory/kratos","slug":"failed-to-deserialize-provider-claims","errorCode":null,"errorMessage":"failed to deserialize provider claims","messagePattern":"failed to deserialize provider claims","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"selfservice/strategy/oidc/pkce.go","lineNumber":77,"sourceCode":"\t}\n\treturn oauth2.GenerateVerifier()\n}\n\nfunc discoverPKCE(ctx context.Context, d pkceDependencies, p OAuth2Provider) (pkceSupported bool, err error) {\n\tif p.Config().IssuerURL == \"\" {\n\t\treturn false, errors.New(\"Issuer URL must be set to autodiscover PKCE support\")\n\t}\n\n\tctx = gooidc.ClientContext(ctx, d.HTTPClient(ctx).HTTPClient)\n\tgp, err := gooidc.NewProvider(ctx, p.Config().IssuerURL)\n\tif err != nil {\n\t\treturn false, errors.Wrap(err, \"failed to initialize provider\")\n\t}\n\tvar claims struct {\n\t\tCodeChallengeMethodsSupported []string `json:\"code_challenge_methods_supported\"`\n\t}\n\tif err := gp.Claims(&claims); err != nil {\n\t\treturn false, errors.Wrap(err, \"failed to deserialize provider claims\")\n\t}\n\treturn slices.Contains(claims.CodeChallengeMethodsSupported, \"S256\"), nil\n}\n","sourceCodeStart":59,"sourceCodeEnd":81,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/selfservice/strategy/oidc/pkce.go#L59-L81","documentation":"After a successful OIDC discovery, discoverPKCE extracts claims (notably code_challenge_methods_supported) from the provider metadata via gp.Claims(&claims). This error means the discovery document was fetched but its claims could not be deserialized into the expected struct — the JSON did not conform to expectations.","triggerScenarios":"gp.Claims(&claims) fails during discoverPKCE because the discovery document returned by the OP contains code_challenge_methods_supported (or the overall metadata) in a shape that cannot unmarshal into the claims struct, or the response is malformed JSON.","commonSituations":"Non-compliant OIDC providers returning discovery metadata with unexpected types, proxies/HTML error pages served with 200 instead of the JSON document, or truncated responses.","solutions":["Fetch <issuer>/.well-known/openid-configuration with curl and validate it is well-formed JSON matching the OIDC Discovery spec.","Check for a proxy or WAF rewriting the discovery response.","Update the go-oidc library / Ory Kratos version in case of known claim-parsing incompatibilities.","As a workaround, disable automatic PKCE autodiscovery for this provider and configure PKCE explicitly if the option exists."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"body, _ := io.ReadAll(resp.Body)\nvar raw map[string]any\nif err := json.Unmarshal(body, &raw); err != nil { /* provider returned invalid discovery JSON */ }","typeGuard":null,"tryCatchPattern":"supported, err := discoverPKCE(ctx, p)\nif err != nil {\n  log.WithError(err).Warn(\"PKCE autodiscovery failed; assuming S256\")\n  supported = true // safe fallback: S256 is widely supported\n}","preventionTips":["Validate the OP's discovery document against the OIDC Discovery spec once during setup.","Watch for proxies that replace error pages for the well-known endpoint.","Pin and update go-oidc versions to get claim-parsing fixes."],"tags":["oidc","discovery","json","parsing"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}