{"record":{"id":"cd0e84635a6887c1","repo":"googleapis/mcp-toolbox","slug":"failed-to-fetch-oidc-config-w","errorCode":null,"errorMessage":"failed to fetch OIDC config: %w","messagePattern":"failed to fetch OIDC config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/generic/generic.go","lineNumber":139,"sourceCode":"}\n\nfunc discoverOIDCConfig(client *http.Client, AuthorizationServer string) (jwksURI string, introspectionEndpoint string, issuer string, err error) {\n\tu, err := url.Parse(AuthorizationServer)\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"invalid auth URL\")\n\t}\n\tif u.Scheme != \"https\" {\n\t\tlog.Printf(\"WARNING: HTTP instead of HTTPS is being used for AuthorizationServer: %s\", AuthorizationServer)\n\t}\n\n\toidcConfigURL, err := url.JoinPath(AuthorizationServer, \".well-known/openid-configuration\")\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tresp, err := client.Get(oidcConfigURL)\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"failed to fetch OIDC config: %w\", err)\n\t}\n\tdefer resp.Body.Close()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn \"\", \"\", \"\", fmt.Errorf(\"unexpected status: %d\", resp.StatusCode)\n\t}\n\n\t// Limit read size to 1MB to prevent memory exhaustion\n\tbody, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))\n\tif err != nil {\n\t\treturn \"\", \"\", \"\", err\n\t}\n\n\tvar config struct {\n\t\tIssuer                string `json:\"issuer\"`\n\t\tJwksUri               string `json:\"jwks_uri\"`\n\t\tIntrospectionEndpoint string `json:\"introspection_endpoint\"`\n\t}","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/auth/generic/generic.go#L121-L157","documentation":"This error wraps the transport-level failure of the HTTP GET request to the OIDC discovery document URL (<authorizationServer>/.well-known/openid-configuration). It means the request never completed: DNS failure, connection refused, TLS error, or the 10-second timeout of the secure HTTP client was exceeded.","triggerScenarios":"client.Get(oidcConfigURL) returns a non-nil error during Initialize() — server unreachable, TLS handshake failure, redirect policy, or timeout (10s).","commonSituations":"Authorization server is behind a firewall, wrong port, DNS not resolvable from the toolbox host, self-signed certificate not trusted, or the auth server is slow to respond at boot.","solutions":["Confirm network reachability: curl -v <authorizationServer>/.well-known/openid-configuration from the toolbox host","Check DNS resolution and firewall/proxy rules","If using TLS with a private CA, install the CA cert into the system trust store","Check for slow responses hitting the 10s client timeout","Verify the scheme is https and the port is correct"],"exampleFix":"// before (unreachable internal host)\nauthorizationServer: \"https://internal-auth:9999\"\n// after (correct port and host)\nauthorizationServer: \"https://internal-auth:8443\"","handlingStrategy":"retry","validationCode":"req, _ := http.NewRequest(\"GET\", cfg.AuthorizationServer+\"/.well-known/openid-configuration\", nil)\nresp, err := (&http.Client{Timeout: 10 * time.Second}).Do(req)\nif err != nil {\n    return fmt.Errorf(\"discovery endpoint unreachable: %v\", err)\n}\nresp.Body.Close()","typeGuard":null,"tryCatchPattern":"for attempt := 0; attempt < 3; attempt++ {\n    svc, err := cfg.Initialize()\n    if err == nil {\n        break\n    }\n    if strings.Contains(err.Error(), \"failed to fetch OIDC config\") {\n        time.Sleep(time.Duration(attempt+1) * time.Second) // transient network/timeout\n        continue\n    }\n    return err\n}","preventionTips":["Ensure DNS, firewall, and proxy rules allow egress to the auth server from the toolbox host","Install private CA certs into the system trust store for TLS","Alert on auth-server latency so the 10s timeout is not hit"],"tags":["go","network","http","oidc","timeout"],"backgroundTag":"http-request-failed","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}