{"record":{"id":"b5219aaa37f40dd9","repo":"rancher/rancher","slug":"invalid-provider-configuration","errorCode":null,"errorMessage":"Invalid provider configuration","messagePattern":"Invalid provider configuration","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"pkg/auth/handler/handler.go","lineNumber":107,"sourceCode":"\t\thttp.Error(w, \"Failed to get provider configuration\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tauthConfigData, ok := authConfig.(runtime.Unstructured)\n\tif !ok {\n\t\tlogrus.Errorf(\"[oidc] Invalid auth config format for provider %s: expected runtime.Unstructured\", provider)\n\t\thttp.Error(w, \"Invalid auth config format\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\tdata := authConfigData.UnstructuredContent()\n\tlogrus.Debugf(\"[oidc] Retrieved auth config for provider: %s\", provider)\n\n\t// Validate that the provider is enabled\n\tif enabledRaw := data[client.GenericOIDCConfigFieldEnabled]; enabledRaw != nil {\n\t\tenabled, ok := enabledRaw.(bool)\n\t\tif !ok {\n\t\t\tlogrus.Errorf(\"[oidc] Invalid enabled field type for provider %s: expected bool, got %T\", provider, enabledRaw)\n\t\t\thttp.Error(w, \"Invalid provider configuration\", http.StatusInternalServerError)\n\t\t\treturn\n\t\t}\n\t\tif !enabled {\n\t\t\tlogrus.Debugf(\"[oidc] Provider %s is disabled\", provider)\n\t\t\thttp.Error(w, \"Provider is disabled\", http.StatusNotFound)\n\t\t\treturn\n\t\t}\n\t}\n\n\t// Validate PKCE method if configured\n\tvar pkceVerifier string\n\tif pkceMethodRaw := data[client.GenericOIDCConfigFieldPKCEMethod]; pkceMethodRaw != nil {\n\t\tpkceMethod, ok := pkceMethodRaw.(string)\n\t\tif !ok {\n\t\t\tlogrus.Errorf(\"[oidc] Invalid PKCE method type for provider %s: expected string, got %T\", provider, pkceMethodRaw)\n\t\t\thttp.Error(w, \"Invalid PKCE method type\", http.StatusInternalServerError)\n\t\t\treturn\n\t\t}","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/handler/handler.go#L89-L125","documentation":"The OIDC redirect handler reads the genericoidc config's `enabled` field from the unstructured map and asserts it to bool. If the field exists but is a different JSON type (string \"true\", number 1, null handled separately), the assertion fails and returns 500 \"Invalid provider configuration\" — the operator's log names the provider and the offending Go type.","triggerScenarios":"An AuthConfig of type genericOIDCProvider whose genericoidcConfig.enabled is present but not a boolean — e.g. applied via kubectl as enabled: \"true\" (quoted) or enabled: 1, or written by automation that stringifies values. Every login redirect for that provider 500s.","commonSituations":"Hand-edited AuthConfig YAML quoting the bool; Helm/GitOps templating rendering booleans as strings; CRD schema drift that stopped enforcing boolean type; external tools writing config maps of values into the object.","solutions":["Check the log \"[oidc] Invalid enabled field type ... got %T\" to see the actual type stored","Fix the field to a real boolean: kubectl patch authconfig <provider> --type merge -p '{\"genericOIDCConfig\":{\"enabled\":true}}' (unquoted)","Validate the AuthConfig against the rancher CRD schema (kubectl apply --dry-run=server) before applying","Audit whatever automation produced the value and stop it coercing booleans to strings/numbers"],"exampleFix":"# before\ngenericOIDCConfig:\n  enabled: \"true\"\n# after\ngenericOIDCConfig:\n  enabled: true","handlingStrategy":"type-guard","validationCode":"// Before enabling a generic OIDC provider, verify scalar types on the config map:\nfunc validateOIDCEnabled(m map[string]any) error {\n    v, ok := m[\"enabled\"]\n    if !ok || v == nil {\n        return nil // absent is fine\n    }\n    if _, ok := v.(bool); !ok {\n        return fmt.Errorf(\"enabled must be bool, got %T\", v)\n    }\n    return nil\n}","typeGuard":"func boolField(m map[string]any, key string) (bool, bool) {\n    b, ok := m[key].(bool)\n    return b, ok\n}","tryCatchPattern":"When reading the unstructured config yourself, always two-value assert per field and emit a precise error instead of relying on the handler's 500.","preventionTips":["Apply AuthConfigs with --dry-run=server so the CRD schema rejects wrong field types","Never quote booleans in provider config YAML","Audit GitOps-rendered AuthConfigs for type drift (strings where bools belong) after rancher upgrades"],"tags":["rancher","oidc","authconfig","type-mismatch","configuration"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}