{"record":{"id":"c588ada44740d8c6","repo":"dagger/dagger","slug":"timed-out-waiting-for-vault-oidc-callback","errorCode":null,"errorMessage":"timed out waiting for Vault OIDC callback","messagePattern":"timed out waiting for Vault OIDC callback","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/client/secretprovider/vault_oidc.go","lineNumber":106,"sourceCode":"\t}\n\n\tfmt.Fprintln(os.Stderr, \"Opening browser for Vault OIDC authentication...\")\n\tif os.Getenv(\"VAULT_OIDC_SKIP_BROWSER\") != \"\" {\n\t\tfmt.Fprintf(os.Stderr, \"Open this URL to authenticate: %s\\n\", authURL)\n\t} else if err := vaultOpenURL(authURL); err != nil {\n\t\tfmt.Fprintf(os.Stderr, \"Failed to open browser: %v\\n\", err)\n\t\tfmt.Fprintf(os.Stderr, \"Open this URL to authenticate: %s\\n\", authURL)\n\t}\n\tfmt.Fprintln(os.Stderr, \"Waiting for Vault OIDC authentication callback...\")\n\n\twaitCtx, waitCancel := context.WithTimeout(ctx, vaultOIDCWaitTimeout)\n\tdefer waitCancel()\n\n\tvar callback vaultOIDCCallback\n\tselect {\n\tcase <-waitCtx.Done():\n\t\tif errors.Is(waitCtx.Err(), context.DeadlineExceeded) {\n\t\t\treturn 0, fmt.Errorf(\"timed out waiting for Vault OIDC callback\")\n\t\t}\n\t\treturn 0, waitCtx.Err()\n\tcase serveErr := <-serveErrCh:\n\t\tif serveErr != nil {\n\t\t\treturn 0, fmt.Errorf(\"oidc callback server error: %w\", serveErr)\n\t\t}\n\tcase callback = <-callbackCh:\n\t\tif callback.Err != nil {\n\t\t\treturn 0, callback.Err\n\t\t}\n\t}\n\n\tsecret, err := client.Logical().ReadWithDataWithContext(waitCtx, \"auth/\"+mount+\"/oidc/callback\", vaultOIDCCallbackQuery(callback.State, callback.Code, nonce))\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"vault OIDC callback exchange failed: %w\", err)\n\t}\n\tif secret == nil || secret.Auth == nil || secret.Auth.ClientToken == \"\" {\n\t\treturn 0, fmt.Errorf(\"vault OIDC callback returned no token\")","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/engine/client/secretprovider/vault_oidc.go#L88-L124","documentation":"vaultOIDCLogin gave up because the local OIDC callback HTTP server received no completed callback within vaultOIDCWaitTimeout. The user never finished (or never started) browser authentication, so no authorization code arrived on callbackCh before waitCtx expired.","triggerScenarios":"Thrown at engine/client/secretprovider/vault_oidc.go:106 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Complete the Vault OIDC login in the opened browser (or via the URL printed to stderr) before the wait timeout elapses","Check that the callback URL host/port is reachable from the browser (VPN, firewall, remote SSH port-forward) and retry the login","On a machine with no browser, set VAULT_OIDC_SKIP_BROWSER and authenticate from a device that can reach the callback listener"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}