{"record":{"id":"c2d3c8ecf161e553","repo":"EpicGames/lore","slug":"environment-endpoint-auth-url-is-set-but-server-auth-is-not","errorCode":null,"errorMessage":"[environment.endpoint] auth_url is set but [server.auth] is not: without [server.auth] tokens are not verified. Add [server.auth] (jwt_issuer, jwt_audience) to enable verification, or remove auth_url.","messagePattern":"\\[environment\\.endpoint\\] auth_url is set but \\[server\\.auth\\] is not: without \\[server\\.auth\\] tokens are not verified\\. Add \\[server\\.auth\\] \\(jwt_issuer, jwt_audience\\) to enable verification, or remove auth_url\\.","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"lore-server/src/authnz/repository_authorizer.rs","lineNumber":210,"sourceCode":"            Self::GlobalGrants => \"GlobalGrantsAuthorizer\",\n            Self::ResourceGrants => \"ResourceGrantsAuthorizer\",\n        })\n    }\n}\n\n/// The four-way selection:\n/// - neither `[server.auth]` nor `auth_url` → allow-all\n/// - `auth_url` set → the gRPC online auth check\n/// - `resource_claim` set → `ResourceGrants`\n/// - otherwise → `GlobalGrants`\npub fn select_repository_authorizer(\n    auth: Option<&AuthSettings>,\n    auth_url: Option<&str>,\n) -> anyhow::Result<AuthorizerSelection> {\n    let Some(auth) = auth else {\n        return match auth_url {\n            None => Ok(AuthorizerSelection::AllowAll),\n            Some(_) => bail!(\n                \"[environment.endpoint] auth_url is set but [server.auth] is not: without \\\n                 [server.auth] tokens are not verified. Add [server.auth] (jwt_issuer, jwt_audience) \\\n                 to enable verification, or remove auth_url.\"\n            ),\n        };\n    };\n    match (auth_url, auth.resource_claim.as_deref()) {\n        (Some(_), Some(_)) => bail!(\n            \"[environment.endpoint] auth_url and [server.auth] resource_claim are both set: \\\n             with auth_url configured, every check calls the auth service and resource_claim \\\n             does nothing. Remove auth_url to authorize from the token's resource claim, or \\\n             remove resource_claim to stay on the gRPC auth service.\"\n        ),\n        (Some(_), None) => Ok(AuthorizerSelection::AuthClient),\n        (None, Some(_)) => Ok(AuthorizerSelection::ResourceGrants),\n        (None, None) => Ok(AuthorizerSelection::GlobalGrants),\n    }\n}","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/EpicGames/lore/blob/074eb0b0d1194c997d7cf28b55519e3e197b3e23/lore-server/src/authnz/repository_authorizer.rs#L192-L228","documentation":"select_repository_authorizer refuses to start when [environment.endpoint] auth_url is configured but [server.auth] is absent. Without [server.auth] (jwt_issuer, jwt_audience), incoming tokens would not be verified at all, so pointing at an external auth service alone is treated as a dangerous misconfiguration and startup bails.","triggerScenarios":"Setting environment.endpoint.auth_url in config while omitting the entire [server.auth] section; then calling select_repository_authorizer (via repository_authorizer startup validation).","commonSituations":"Operators migrating from an external auth endpoint to local JWT verification and deleting [server.auth] prematurely; copy-pasted endpoint config without the auth section; docs examples showing auth_url alone.","solutions":["Add a [server.auth] section with jwt_issuer and jwt_audience to enable token verification.","Remove the auth_url setting if you intend to authorize purely from token claims or not at all.","Re-run startup validation (validate_auth_config) after editing to confirm the selection succeeds."],"exampleFix":"// before (config)\n[environment.endpoint]\nauth_url = \"https://auth.example.com\"\n// after (config)\n[server.auth]\njwt_issuer = \"https://auth.example.com\"\njwt_audience = \"my-audience\"\n[environment.endpoint]\nauth_url = \"https://auth.example.com\"","handlingStrategy":"validation","validationCode":"// config-load validation\nif config.environment.endpoint.auth_url.is_some() && config.server.auth.is_none() {\n    return Err(anyhow!(\"auth_url requires [server.auth] (jwt_issuer, jwt_audience)\"));\n}","typeGuard":null,"tryCatchPattern":"match select_repository_authorizer(&auth_opt, &auth_url_opt) {\n    Ok(sel) => start_server(sel),\n    Err(e) => { eprintln!(\"invalid auth config: {e:#}\"); std::process::exit(2); }\n}","preventionTips":["Treat [server.auth] as mandatory whenever auth_url is set.","Validate auth config in CI with a startup dry-run.","When removing local JWT verification, remove auth_url at the same time.","Document the auth_url <-> [server.auth] dependency."],"tags":["rust","auth","configuration","startup","validation"],"backgroundTag":"missing-required-config","analyzedSha":"074eb0b0d1194c997d7cf28b55519e3e197b3e23","analyzedAt":"2026-09-13T09:00:57.509Z","contentChangedAt":"2026-09-13T09:00:57.509Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}