{"record":{"id":"af716d72b32333c4","repo":"fatedier/frp","slug":"couldn-t-acquire-oidc-token-for-login-v","errorCode":null,"errorMessage":"couldn't acquire OIDC token for login: %v","messagePattern":"couldn't acquire OIDC token for login: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/oidc.go","lineNumber":236,"sourceCode":"\ntype OidcTokenSourceAuthProvider struct {\n\tadditionalAuthScopes []v1.AuthScope\n\n\tvalueSource *v1.ValueSource\n}\n\nfunc NewOidcTokenSourceAuthSetter(additionalAuthScopes []v1.AuthScope, valueSource *v1.ValueSource) *OidcTokenSourceAuthProvider {\n\treturn &OidcTokenSourceAuthProvider{\n\t\tadditionalAuthScopes: additionalAuthScopes,\n\t\tvalueSource:          valueSource,\n\t}\n}\n\nfunc (auth *OidcTokenSourceAuthProvider) generateAccessToken() (accessToken string, err error) {\n\tctx := context.Background()\n\taccessToken, err = auth.valueSource.Resolve(ctx)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"couldn't acquire OIDC token for login: %v\", err)\n\t}\n\treturn\n}\n\nfunc (auth *OidcTokenSourceAuthProvider) SetLogin(loginMsg *msg.Login) (err error) {\n\tloginMsg.PrivilegeKey, err = auth.generateAccessToken()\n\treturn err\n}\n\nfunc (auth *OidcTokenSourceAuthProvider) SetPing(pingMsg *msg.Ping) (err error) {\n\tif !slices.Contains(auth.additionalAuthScopes, v1.AuthScopeHeartBeats) {\n\t\treturn nil\n\t}\n\n\tpingMsg.PrivilegeKey, err = auth.generateAccessToken()\n\treturn err\n}\n","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/auth/oidc.go#L218-L254","documentation":"Used by frps-side components that obtain their OIDC token from a ValueSource (frp's typed secret-reference mechanism: raw value, environment variable, file, or Kubernetes secret/configmap reference) rather than the client-credentials flow. OidcTokenSourceAuthProvider.generateAccessToken calls valueSource.Resolve(context.Background()); any resolution failure is wrapped with this message and fails Login construction.","triggerScenarios":"Configuring an OidcTokenSourceAuthProvider whose ValueSource points to a missing environment variable, a nonexistent file path, or a Kubernetes secret that does not exist / is not mounted / has no such key; Resolve also fails on malformed reference syntax.","commonSituations":"Kubernetes deployments where the secret holding the OIDC token was not created before frps started; the referenced env var is only set in a different container; file-based token path not mounted; typo in the secret name or key.","solutions":["Inspect the wrapped error from Resolve — it identifies which source kind (env/file/secret) failed","Verify the referenced object exists: kubectl get secret <name> -o jsonpath='{.data.<key>}' or check the env var with printenv","Create or mount the secret/file before starting the process, and ensure the service account can read it","If the token is static for testing, use a plain value source first, then switch to the secret reference"],"exampleFix":"# before (secret not yet created)\nvalueSource:\n  secretKeyRef:\n    name: frp-oidc-token\n    key: token\n\n# after: create it first\n# kubectl create secret generic frp-oidc-token --from-literal=token=<jwt>\nvalueSource:\n  secretKeyRef:\n    name: frp-oidc-token\n    key: token","handlingStrategy":"validation","validationCode":"switch {\ncase vs.SecretKeyRef != nil:\n    _, err := k8sClient.CoreV1().Secrets(ns).Get(ctx, vs.SecretKeyRef.Name, metav1.GetOptions{})\n    if err != nil { return fmt.Errorf(\"secret %s missing: %w\", vs.SecretKeyRef.Name, err) }\ncase vs.Env != nil:\n    if os.Getenv(vs.Env) == \"\" { return fmt.Errorf(\"env %s unset\", vs.Env) }\ncase vs.File != nil:\n    if _, err := os.Stat(vs.File); err != nil { return err }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Create Kubernetes secrets before deploying the frp component that references them","Add readiness checks that the referenced env var/file/secret resolves","Reference secrets by name in alerts, never inline values"],"tags":["frp","oidc","value-source","kubernetes","secrets"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}