{"record":{"id":"a96f49471f8a005e","repo":"googleapis/mcp-toolbox","slug":"failed-to-discover-oidc-config-w","errorCode":null,"errorMessage":"failed to discover OIDC config: %w","messagePattern":"failed to discover OIDC config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":83,"sourceCode":"\t\tif cfg.IntrospectionEndpoint != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionEndpoint` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif cfg.IntrospectionMethod != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionMethod` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif cfg.IntrospectionParamName != \"\" {\n\t\t\treturn nil, fmt.Errorf(\"`introspectionParamName` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t\tif len(cfg.ScopesRequired) > 0 {\n\t\t\treturn nil, fmt.Errorf(\"`scopesRequired` is not allowed when `mcpEnabled` is false\")\n\t\t}\n\t}\n\thttpClient := newSecureHTTPClient()\n\n\t// Discover OIDC endpoints\n\tjwksURL, introspectionURL, issuer, err := discoverOIDCConfig(httpClient, cfg.AuthorizationServer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to discover OIDC config: %w\", err)\n\t}\n\n\t// Override introspection URL if configured\n\tif cfg.IntrospectionEndpoint != \"\" {\n\t\tintrospectionURL = cfg.IntrospectionEndpoint\n\t}\n\n\t// Create the keyfunc to fetch and cache the JWKS in the background\n\tkf, err := keyfunc.NewDefault([]string{jwksURL})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create keyfunc from JWKS URL %s: %w\", jwksURL, err)\n\t}\n\n\ta := &AuthService{\n\t\tConfig:           cfg,\n\t\tkf:               kf,\n\t\tclient:           httpClient,\n\t\tintrospectionURL: introspectionURL,","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L65-L101","documentation":"This error wraps any failure that occurs while fetching and parsing the OpenID Connect discovery document (<authorizationServer>/.well-known/openid-configuration) during AuthService initialization. The generic auth service needs the issuer, jwks_uri, and introspection_endpoint from the discovery document before it can verify tokens, so if discovery fails the whole auth service cannot start. The underlying cause (URL parse error, network failure, bad status, missing fields) is preserved via %w.","triggerScenarios":"cfg.AuthorizationServer is unreachable or misconfigured when Config.Initialize() runs at server startup: unparseable URL, DNS/connection failure, non-200 discovery response, or discovery document missing issuer/jwks_uri.","commonSituations":"Typo in the authorizationServer YAML field (e.g. missing scheme or trailing path), auth server down or firewalled at boot, pointing at a non-OIDC endpoint that returns 404, or a corporate proxy blocking the outbound request.","solutions":["Verify the authorizationServer value in your YAML is a reachable base URL of an OIDC provider (e.g. https://accounts.google.com)","Test discovery manually with curl <authorizationServer>/.well-known/openid-configuration and confirm it returns JSON with issuer and jwks_uri","Check network/DNS/proxy connectivity from the machine running toolbox","Inspect the wrapped cause in the error chain to identify whether it was fetch, status, or parse failure","If the provider lacks discovery, consider an auth service type that accepts explicit endpoints"],"exampleFix":"// before\nauthServices:\n  - name: myauth\n    type: generic\n    authorizationServer: auth.example.com\n// after\nauthServices:\n  - name: myauth\n    type: generic\n    authorizationServer: https://auth.example.com","handlingStrategy":"validation","validationCode":"u, err := url.Parse(cfg.AuthorizationServer)\nif err != nil || u.Scheme == \"\" || u.Host == \"\" {\n    return fmt.Errorf(\"authorizationServer %q is not a valid absolute URL\", cfg.AuthorizationServer)\n}\nresp, err := http.Get(u.String() + \"/.well-known/openid-configuration\")\nif err != nil || resp.StatusCode != 200 {\n    return fmt.Errorf(\"authorizationServer discovery unreachable: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"svc, err := cfg.Initialize()\nif err != nil {\n    var dnErr error\n    if errors.As(err, &dnErr) && strings.Contains(err.Error(), \"failed to discover OIDC config\") {\n        log.Fatalf(\"check authorizationServer config/network: %v\", err)\n    }\n    return err\n}","preventionTips":["Validate authorizationServer is an absolute https URL before writing it into config","Smoke-test the discovery endpoint with curl at deploy time","Add a startup health check that hits the discovery URL before serving traffic"],"tags":["go","oidc","network","startup"],"backgroundTag":"oidc-discovery-failed","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}